4 ms·

Something to remember: One-Time Pads are unbreakable, and as storage costs continue to drop, there are certainly many scenarios where they could be used and nev

Something to remember: One-Time Pads are unbreakable, and as storage costs continue to drop, there are certainly many scenarios where they could be used and never cracked. Think about it. How much actual secure data do you and your bank need to transfer back and forth? Certainly not web UI elements or site chrome. For each use of your online account, there's probably 3 or 4k max actual data that you need to be secure. Your bank could mail you a 1GB random noise file, perhaps a backup, and you two could communicate for the rest of your life without any fear of anybody understanding what you're saying. I understand that there's an entire e-commerce ease-of-use scenario where secure communications becomes mission-critical. And I'm certainly not suggesting to replace all secured comms. My only point is that there are parts of this problem that are very tough and there are parts of this problem that we have made more difficult than it has to be simply in an effort to standardize and abstract everything.

QuicksilverJohn 7y ago
The problem with this method is that it requires a side channel. This is the real beauty of public key cryptography, you can negotiate a secure channel over an open channel. (*Authentication sold separately)
- Silhouette 7y ago
  This is the real beauty of public key cryptography, you can negotiate a secure channel over an open channel. You still need sufficient shared information as a starting point to authenticate the other party, so that doesn't really avoid the need for a secure side channel. In practice we often trust that the baseline of certificates that come with a new device or built into a browser are sufficient for this purpose, but there is still an attack surface there and our existing CA infrastructure and processes are not perfect.
- rini17 7y ago
  I don't get why this argument is used so often as if it was valid. Setting up a banking account and many other things require a secure side channel anyway - physical presence :)
  - brokenmachine 7y ago
    The last bank account I registered was done completely online, except for the physical card being mailed to me.
mruts 7y ago
I mean, sure, but how are you going to protect the one time key? What might make more sense is if they gave you a usb drive that was good for a thousand transactions or whatever. Then you could get it replaced in person after the pad was used it. I didn’t read the article (paywall), but unless they are talking about quantum computers, the computation required to break the key and encrypt the data has a exponential difference. If we all started using keys that were, say, 2^32 bits long, we would be fine for the forseeable future.
deleted 7y ago
[deleted]
nabla9 7y ago
In practice schemes based on cryptographic hash functions work just as well and are quantum resistant. 512-bit key length is safe from quantum computers. Use bcrypt, Argon2 if you are pessimistic. Using side channel to share single 512-bit key that is used to generate other keys keys is enough.
- mrob 7y ago
  The best known quantum attack against symmetric ciphers uses Grover's algorithm to effectively halve the key size. AES-128 is considered secure against classical attacks, so assuming you have a secure side channel for key distribution, AES-256 is sufficient to defeat quantum attacks.
  - nabla9 7y ago
    I assume that we are talking about situations where public key cryptography is used. If you share one master key for long time, having (effectively) 128-bit secret shared state is too small.
empath75 7y ago
Do you mean like literally mail it to you, or email it to you? If it’s the latter you still have the problem of needing it to be encrypted. If it’s the former, it’s damned inconvenient.
abdullahkhalids 7y ago
There exists quantum key distribution https://en.wikipedia.org/wiki/Quantum_key_distribution#Quantum_key_distribution_networks https://en.wikipedia.org/wiki/Quantum_key_distribution#Quant... which is provably secure (up to side channel attacks), and allows two parties (say you and your bank) to remotely create a symmetric key. This will certainly require infrastructure to be built, but its possible that this infrastructure consists of beaming signals from bank->satellite->receiver in your home.
rbanffy 7y ago
> Your bank could mail you a 1GB random noise file Right. And the first RCE+escalation 0-day will enable someone to wipe out your accounts.

QuicksilverJohn 7y ago

The problem with this method is that it requires a side channel. This is the real beauty of public key cryptography, you can negotiate a secure channel over an open channel. (*Authentication sold separately)

Silhouette 7y ago
This is the real beauty of public key cryptography, you can negotiate a secure channel over an open channel. You still need sufficient shared information as a starting point to authenticate the other party, so that doesn't really avoid the need for a secure side channel. In practice we often trust that the baseline of certificates that come with a new device or built into a browser are sufficient for this purpose, but there is still an attack surface there and our existing CA infrastructure and processes are not perfect.
rini17 7y ago
I don't get why this argument is used so often as if it was valid. Setting up a banking account and many other things require a secure side channel anyway - physical presence :)
- brokenmachine 7y ago
  The last bank account I registered was done completely online, except for the physical card being mailed to me.

mruts 7y ago

I mean, sure, but how are you going to protect the one time key? What might make more sense is if they gave you a usb drive that was good for a thousand transactions or whatever. Then you could get it replaced in person after the pad was used it. I didn’t read the article (paywall), but unless they are talking about quantum computers, the computation required to break the key and encrypt the data has a exponential difference. If we all started using keys that were, say, 2^32 bits long, we would be fine for the forseeable future.

deleted 7y ago

[deleted]

nabla9 7y ago

In practice schemes based on cryptographic hash functions work just as well and are quantum resistant. 512-bit key length is safe from quantum computers. Use bcrypt, Argon2 if you are pessimistic. Using side channel to share single 512-bit key that is used to generate other keys keys is enough.

mrob 7y ago
The best known quantum attack against symmetric ciphers uses Grover's algorithm to effectively halve the key size. AES-128 is considered secure against classical attacks, so assuming you have a secure side channel for key distribution, AES-256 is sufficient to defeat quantum attacks.
- nabla9 7y ago
  I assume that we are talking about situations where public key cryptography is used. If you share one master key for long time, having (effectively) 128-bit secret shared state is too small.

empath75 7y ago

Do you mean like literally mail it to you, or email it to you? If it’s the latter you still have the problem of needing it to be encrypted. If it’s the former, it’s damned inconvenient.

abdullahkhalids 7y ago

There exists quantum key distribution https://en.wikipedia.org/wiki/Quantum_key_distribution#Quantum_key_distribution_networks https://en.wikipedia.org/wiki/Quantum_key_distribution#Quant... which is provably secure (up to side channel attacks), and allows two parties (say you and your bank) to remotely create a symmetric key. This will certainly require infrastructure to be built, but its possible that this infrastructure consists of beaming signals from bank->satellite->receiver in your home.

rbanffy 7y ago

> Your bank could mail you a 1GB random noise file Right. And the first RCE+escalation 0-day will enable someone to wipe out your accounts.