5 ms·

>It isn't that there are no levels of security, it's that you can't be at two separate levels at the same time. There is no overlap. What do you say to DUAL_EC

>It isn't that there are no levels of security, it's that you can't be at two separate levels at the same time. There is no overlap. What do you say to DUAL_EC_DRBG, which seems to be precisely that "separate levels" of security you claim is impossible?

cesarb 9y ago
DUAL_EC_DRBG is, in principle, equivalent to encrypting the same data with two separate keys, each one being able to recover the plaintext. There are no "two separate levels at the same time" here: the weakest of these two keys determines your security level. With DUAL_EC_DRBG, one of these keys is a static key which, once leaked, can break every message with a small amount of extra effort. The same applies to the recently published DUHK attack: once the hardcoded key is known, the whole thing gets broken, showing that the security level was only as strong as the weaker key.
- hackinthebochs 9y ago
  I don't see how this is a substantive reply. Yes, once your key is known you no longer have security. That's true regardless of how many keys your scheme employs. Just like in traditional encryption scenarios, your personal key remaining secret is a part of the assumption. That there are now two secret keys doesn't alter the analysis substantially.
  - AnthonyMouse 9y ago
    > Just like in traditional encryption scenarios, your personal key remaining secret is a part of the assumption. That there are now two secret keys doesn't alter the analysis substantially. Of course it does. At best it doubles the risk of key compromise, but it's really much worse than that. A master key isn't like a normal key. If you compromise Alice and Bob's key, you can spy on Alice and Bob, but not Alice and Carol and definitely not Carol and Dan. The existence of a master key is a massive security risk. Alice and Bob's key is worth say $5000. The value of stealing it generally isn't worth the effort. Nobody sends Mossad to spy on every plain old Alice and Bob. A master key for everything is worth trillions of dollars. Every government and crime family would throw everything they have at stealing it, and many of them would succeed. Spetsnaz units and foreign intelligence operatives would fall out of the sky. Crime bosses would pay multi-million dollar bribes and still turn a huge profit. And from there it would leak. It's a completely different level of risk. Orders of magnitude worse. And it implies a prohibition on forward secrecy. So when it leaks, Armageddon.
    - hackinthebochs 9y ago
      Lets say I grant everything you say about the danger to every Alice and Bob that a master key exists. The question is, can policies be enacted and systems put into place that provide a commensurate amount of security for the risk the backdoor key poses? It seems plausible that it can be. But this is the conversation that needs to happen, not the boneheaded claim that its "mathematically impossible" to have a secure system with a backdoor. It's plausible that a system can be "secure" under appropriate definitions while having such a backdoor mechanism. If the analysis shows its not possible in practice, then that's fine as well. But we have to actually do the analysis.
      - AnthonyMouse 9y ago
        > The question is, can policies be enacted and systems put into place that provide a commensurate amount of security for the risk the backdoor key poses? It seems plausible that it can be. It's plausible that the government can permanently keep a key to every lock secure against every attacker? That is such a ridiculous claim that just skipping right to "no, that's impossible" is a completely reasonable thing to do. But we can do the analysis if you really want to. Look at the other things the government has tried really hard to protect. Nuclear secrets? Nope. https://en.wikipedia.org/wiki/Atomic_spies https://en.wikipedia.org/wiki/Atomic_spies The government has actually lost hydrogen bombs on multiple separate occasions. Not the secrets, the actual live thermonuclear weapons. The things that one of which can turn all of D.C. into radioactive glass. What about all the sensitive information about the people with security clearances? https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.wikipedia.org/wiki/Office_of_Personnel_Management... Incredibly dangerous biological materials ("arguably the most deadly disease ever to affect mankind")? https://www.npr.org/2014/07/08/329884145/in-a-lab-store-room-an-unsettling-surprise-lost-vials-of-smallpox https://www.npr.org/2014/07/08/329884145/in-a-lab-store-room... Classified information in general? The list of violations is too long to even enumerate. And this is what happens when the thing they're supposed to be protecting doesn't have incomprehensibly large commercial value on the black market. There is no question that they are not capable of doing this.
        9y ago
  - cesarb 9y ago
    > That there are now two secret keys doesn't alter the analysis substantially. It doesn't, and that's the point. There are no "separate levels" of security. The attacker only has to break one of the keys, whichever is the weakest one. The "security level" of the whole system is the "security level" of its least secure part.

cesarb 9y ago

DUAL_EC_DRBG is, in principle, equivalent to encrypting the same data with two separate keys, each one being able to recover the plaintext. There are no "two separate levels at the same time" here: the weakest of these two keys determines your security level. With DUAL_EC_DRBG, one of these keys is a static key which, once leaked, can break every message with a small amount of extra effort. The same applies to the recently published DUHK attack: once the hardcoded key is known, the whole thing gets broken, showing that the security level was only as strong as the weaker key.

hackinthebochs 9y ago
I don't see how this is a substantive reply. Yes, once your key is known you no longer have security. That's true regardless of how many keys your scheme employs. Just like in traditional encryption scenarios, your personal key remaining secret is a part of the assumption. That there are now two secret keys doesn't alter the analysis substantially.
- AnthonyMouse 9y ago
  > Just like in traditional encryption scenarios, your personal key remaining secret is a part of the assumption. That there are now two secret keys doesn't alter the analysis substantially. Of course it does. At best it doubles the risk of key compromise, but it's really much worse than that. A master key isn't like a normal key. If you compromise Alice and Bob's key, you can spy on Alice and Bob, but not Alice and Carol and definitely not Carol and Dan. The existence of a master key is a massive security risk. Alice and Bob's key is worth say $5000. The value of stealing it generally isn't worth the effort. Nobody sends Mossad to spy on every plain old Alice and Bob. A master key for everything is worth trillions of dollars. Every government and crime family would throw everything they have at stealing it, and many of them would succeed. Spetsnaz units and foreign intelligence operatives would fall out of the sky. Crime bosses would pay multi-million dollar bribes and still turn a huge profit. And from there it would leak. It's a completely different level of risk. Orders of magnitude worse. And it implies a prohibition on forward secrecy. So when it leaks, Armageddon.
  - hackinthebochs 9y ago
    Lets say I grant everything you say about the danger to every Alice and Bob that a master key exists. The question is, can policies be enacted and systems put into place that provide a commensurate amount of security for the risk the backdoor key poses? It seems plausible that it can be. But this is the conversation that needs to happen, not the boneheaded claim that its "mathematically impossible" to have a secure system with a backdoor. It's plausible that a system can be "secure" under appropriate definitions while having such a backdoor mechanism. If the analysis shows its not possible in practice, then that's fine as well. But we have to actually do the analysis.
    - AnthonyMouse 9y ago
      > The question is, can policies be enacted and systems put into place that provide a commensurate amount of security for the risk the backdoor key poses? It seems plausible that it can be. It's plausible that the government can permanently keep a key to every lock secure against every attacker? That is such a ridiculous claim that just skipping right to "no, that's impossible" is a completely reasonable thing to do. But we can do the analysis if you really want to. Look at the other things the government has tried really hard to protect. Nuclear secrets? Nope. https://en.wikipedia.org/wiki/Atomic_spies https://en.wikipedia.org/wiki/Atomic_spies The government has actually lost hydrogen bombs on multiple separate occasions. Not the secrets, the actual live thermonuclear weapons. The things that one of which can turn all of D.C. into radioactive glass. What about all the sensitive information about the people with security clearances? https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.wikipedia.org/wiki/Office_of_Personnel_Management... Incredibly dangerous biological materials ("arguably the most deadly disease ever to affect mankind")? https://www.npr.org/2014/07/08/329884145/in-a-lab-store-room-an-unsettling-surprise-lost-vials-of-smallpox https://www.npr.org/2014/07/08/329884145/in-a-lab-store-room... Classified information in general? The list of violations is too long to even enumerate. And this is what happens when the thing they're supposed to be protecting doesn't have incomprehensibly large commercial value on the black market. There is no question that they are not capable of doing this.
      - 9y ago
- cesarb 9y ago
  > That there are now two secret keys doesn't alter the analysis substantially. It doesn't, and that's the point. There are no "separate levels" of security. The attacker only has to break one of the keys, whichever is the weakest one. The "security level" of the whole system is the "security level" of its least secure part.