5 ms·
Can someone explain how the stacking on top of existing crypto works? Is it redundant (aka double)?
by cm3 10y ago
Can someone explain how the stacking on top of existing crypto works? Is it redundant (aka double)?
- hannob 10y agoThis is pretty simple: The results from the two key exchanges are concatenated and hashed. The result is used as a TLS session key. The idea is then that in order to attack this an am attacker would need to break both key exchanges. Thus even if one of them is insecure the combination still stays secure. This is a well known method, but it's rarely used. Usually we are confident enough in our algorithms and most people don't see a need to combine them.
- cm3 10y agoBut there is splitting involved, or it's duplicate, isn't it? Edit: What's the name of the scheme used?
- are595 10y agoTheir blog post goes into more details: https://security.googleblog.com/2016/07/experimenting-with-post-quantum.html https://security.googleblog.com/2016/07/experimenting-with-p... They are using "New Hope" on top of EC-crypto and calling it CECPQ1-ECDSA.
- cm3 10y agoI've read that, but can't find the details or make concrete sense of the scheme involved. will use a post-quantum key-exchange algorithm in addition to the elliptic-curve key-exchange algorithm that would typically be used. By adding a post-quantum algorithm on top of the existing one, we are able to experiment without affecting user security. The post-quantum algorithm might turn out to be breakable even with today's computers, in which case the elliptic-curve algorithm will still provide the best security that today’s technology can offer. I mean, I can't answer the question with the info found in the blog. Hanno commented this is a well known scheme without mentioning the name. If someone knows the name, I'll look that up. In the meantime, I'll dig through the code to understand what they're actually doing.
- Ar-Curunir 10y agoThe new key exchange is based on lattice cryptography, which is conjectured to be quantum resistant. The precise assumption is RLWE.
- cm3 10y agoThanks, and yes, I've read about what hardness assumption is used. My confusion is about what pieces are concatenated. Is the same input processed twice (different ciphers) and then concatenated, which is then the generated key?
- tptacek 10y agoThe outputs of an RLWE and ECDH handshake are both fed into the TLS KDF.
- cm3 10y agoThanks for the info. May I ask if you figured that out from the blog or BoringSSL code?
- pbsd 10y agoThe hybrid ciphersuite idea comes from [1, Section 5.2], though you could also chalk it up to common sense. I don't think the blog spells out how it's done. [1] https://eprint.iacr.org/2014/599 https://eprint.iacr.org/2014/599
- wolf550e 10y agoAdam Langley answered this on HN: https://news.ycombinator.com/item?id=12051438 https://news.ycombinator.com/item?id=12051438
- dtemp 10y agoSince we're talking about key exchange, shouldn't it be called CECPQ1-ECDHE? ECDSA is for the cert...
- stephengillie 10y agoHow do we know the inner cryptography isn't weakening the outer cryptography? Couldn't they conflict somehow, making the message easier to decrypt?
- Ar-Curunir 10y agoIt because the hash function is just looking at a concatenation of two (computationally) pseudorandom strings, and output the hash of that. If either method is broken (but not both) there is still enough entropy to create a safe key.