4 ms·

TrueCrypt offered cascading ciphers. I never liked it, however, they were never really criticized for doing that and no one ever cited that as a reason to not u

by w8rbt 11y ago

TrueCrypt offered cascading ciphers. I never liked it, however, they were never really criticized for doing that and no one ever cited that as a reason to not use it. There were lots of other reasons not to use it.

nickpsecurity 11y ago
I submitted them to expert after expert. Nobody ever showed a break with many citing meet-in-middle with 2DES or whatever. Opposite of diverse, multi-encryption. Just lots of people telling me it was stupid while their single modes and protocols got smashed. My formula varied but amounted to this: at least three passes; 1-3 of strongest ciphers (eg AES finalists); optionally 1 old one (eg IDEA, Blowfish) for obfuscation; randomized choice of ciphers, keys, IV's, and counter values; counter mode or random good ones; those sent during key exchange. Each thing in isolation had necessary pre-conditions and configuration for secure operation. In combination, they should be as strong as weakest link plus difficulty of breaking obfuscations. Seemed to work in practice. Many years later, I see a very watered-down version called TripleSec here with similar claims. Also, Marcus Ottela implemented a subset of my scheme in Tinfoil Chat. Past that, the advice has been "use OpenSSL" or something followed by "patch OpenSSL before the latest flaw in one component affects you." They know better, though, as easy compromises are OK when it's something everyone was doing. Maybe they're disguising CYA legal strategy as good crypto recommendations. (shrugs)
- ryan-c 11y ago
  Cipher cascades have been proven to be at least as strong as the strongest cipher, but only if you use commutative encryption - multiple stream ciphers (and/or block ciphers in counter mode) xor'd together. Truecrypt did not use this construction.
  - nickpsecurity 11y ago
    There we go! Been a while since the last positive comment on this. :)
    - ryan-c 11y ago
      My opinion on cascade ciphers is currently neutral. If done properly, they are a nice hedge against currently unknown weaknesses, but a more complicated construction means more places to make mistakes.
      - nickpsecurity 11y ago
        That's why I used them. There could be obscure, mathematical interactions that they introduce that are problematic. We might eventually figure those out. The enemy might be able to exploit those without knowing which ciphers, which order, and which initial data. Meanwhile, there's a steady stream of problems in regular ciphers, modes, and protocols that justify mitigating any one in a design. So, yeah, my polyciphers are a hedge. They also exploit combinatorial explosion by randomizing extra, large numbers. Used to by resources required to simulate the combos of algorithms themselves but FPGA's made that obsolete. :(
  - baby 11y ago
    So it should be AT LEAST as strong as the first cipher used in the chain. This is still a good reason to use cascade.
    - ryan-c 11y ago
      The paper that proves this, is actually called "Cascade Ciphers: The Importance of Being First". http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.36.5309&rep=rep1&type=pdf http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.36....

by w8rbt 11y ago

nickpsecurity 11y ago

I submitted them to expert after expert. Nobody ever showed a break with many citing meet-in-middle with 2DES or whatever. Opposite of diverse, multi-encryption. Just lots of people telling me it was stupid while their single modes and protocols got smashed. My formula varied but amounted to this: at least three passes; 1-3 of strongest ciphers (eg AES finalists); optionally 1 old one (eg IDEA, Blowfish) for obfuscation; randomized choice of ciphers, keys, IV's, and counter values; counter mode or random good ones; those sent during key exchange. Each thing in isolation had necessary pre-conditions and configuration for secure operation. In combination, they should be as strong as weakest link plus difficulty of breaking obfuscations. Seemed to work in practice. Many years later, I see a very watered-down version called TripleSec here with similar claims. Also, Marcus Ottela implemented a subset of my scheme in Tinfoil Chat. Past that, the advice has been "use OpenSSL" or something followed by "patch OpenSSL before the latest flaw in one component affects you." They know better, though, as easy compromises are OK when it's something everyone was doing. Maybe they're disguising CYA legal strategy as good crypto recommendations. (shrugs)

ryan-c 11y ago
Cipher cascades have been proven to be at least as strong as the strongest cipher, but only if you use commutative encryption - multiple stream ciphers (and/or block ciphers in counter mode) xor'd together. Truecrypt did not use this construction.
- nickpsecurity 11y ago
  There we go! Been a while since the last positive comment on this. :)
  - ryan-c 11y ago
    My opinion on cascade ciphers is currently neutral. If done properly, they are a nice hedge against currently unknown weaknesses, but a more complicated construction means more places to make mistakes.
    - nickpsecurity 11y ago
      That's why I used them. There could be obscure, mathematical interactions that they introduce that are problematic. We might eventually figure those out. The enemy might be able to exploit those without knowing which ciphers, which order, and which initial data. Meanwhile, there's a steady stream of problems in regular ciphers, modes, and protocols that justify mitigating any one in a design. So, yeah, my polyciphers are a hedge. They also exploit combinatorial explosion by randomizing extra, large numbers. Used to by resources required to simulate the combos of algorithms themselves but FPGA's made that obsolete. :(
- baby 11y ago
  So it should be AT LEAST as strong as the first cipher used in the chain. This is still a good reason to use cascade.
  - ryan-c 11y ago
    The paper that proves this, is actually called "Cascade Ciphers: The Importance of Being First". http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.36.5309&rep=rep1&type=pdf http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.36....