4 ms·

WTF, do not do this. You can use real encryption, like GPG in symmetric mode with a memorized passphrase that gets properly key-stretched. Then store the resul

by ohazi 6y ago

WTF, do not do this. You can use real encryption, like GPG in symmetric mode with a memorized passphrase that gets properly key-stretched. Then store the resulting uniform random-looking blob in image metadata or whatever. Obscurity is to prevent them from asking you what's in an obviously encrypted file like "bitcoin_wallet.dat.gpg," it's not for actual protection if they do happen to focus on you.

umvi 6y ago
> Then store the resulting uniform random-looking blob in image metadata or whatever. Steganography is still security through obscurity. I don't see how it's any more secure than storing a manipulated key in plain text, especially if you are competent. If it were me I would just xor my address with a key of the same length (correcthorsebatterystaple-esque) and then xor it back out on the other side. How would you even know it was a bitcoin wallet address vs. something else? Or even write a letter to someone, where the second letter of the first word of every paragraph form the wallet address.
- AgentME 6y ago
  >How would you even know it was a bitcoin wallet address vs. something else? The fact you talk about doing that sort of thing would be a big clue. The benefit of using proper symmetric encryption (like GPG, or even better, age[0]) is that even if you talk about or even fully explain your process, then it's still secure as long as you don't post your key. [0] https://age-encryption.org/ https://age-encryption.org/
  - umvi 6y ago
    If you use "proper symmetric encryption" you have the same problem as before: how to smuggle the key over the border assuming they will search your person and online accounts ...?
    - AgentME 6y ago
      Oh sorry, I think I'd lost that bit of context. This scenario of hiding a password during inspection is probably the main place where "security through obscurity" has validity. A big benefit of encrypting your cryptocurrency private key with a password and then hiding/obscuring that password instead of the raw private key itself is that good encryption will apply key-stretching to the password, making it harder to brute-force. If an attacker finds a random-looking value in your stuff, and believes that the value might be your bitcoin private key XORed by a short string, they it's very cheap for them to check whether each result is a valid bitcoin private key. There might even be structure in the bitcoin private key format that helps gives away the XOR key. But if they know your bitcoin private key (or something else) is encrypted by Age, and they find a random-looking value that might be your password XORed by a short string, then because Age uses scrypt on the password, then it will take longer for them to verify each attempt against the ciphertext.
    - ohazi 6y ago
      It's not difficult to memorize one reasonably good passphrase, and there are well-known key-stretching algorithms that are understood to provide however many bits you need of actual security from this passphrase. > Just shift all the digits of your key by some secret (but very simple) algorithm You are basically suggesting that people roll their own crypto here. Or pseudo-crypto, or stego, or whatever you want to call it. Don't tell people to "Just do X" when the ambiguity in the methods that you describe leave >90% odds that the result of their work won't even pass a statistical uniformity test. This leaks the key. Once your adversary realizes that you made some sort of mistake here, they can write software to make their attack orders of magnitude easier than it would otherwise be.
      - umvi 6y ago
        > Once your adversary realizes that you made some sort of mistake here, they can write software to "Writing software" takes time, and by then all the money in the wallet would be gone
        ohazi 6y ago
- ohazi 6y ago
  Steganography is for hiding the fact that you're hiding something, it's not for protecting the thing that you're hiding. You still need real cryptography to do that. You can encode a real cryptographic key in a relatively short passphrase that's easy to memorize using key-stretching. You can then use this passphrase to strongly encrypt as much data as you want. The only thing you should be hiding are the encrypted blocks. If they manage to find these blocks (which they absolutely might! steganography is nowhere near perfect), they should still be encrypted, and they should still look like uniform random noise. You're not supposed to hide the key!
  - umvi 6y ago
    Sure, I can agree with that. I probably wouldn't choose image-based steganography though because for all I know the country has a great firewall that scrubs all outgoing image metadata
- ohazi 6y ago
  > I don't see how it's any more secure than storing a manipulated key in plain text You don't see how not storing the key is more secure than storing the key? I'm suggesting you memorize the key, and only store the ciphertext. > I would just xor my address with a key of the same length (correcthorsebatterystaple-esque) and then xor it back out on the other side This would fail a statistical uniformity test, and your adversary would be able to figure out that something was hiding there, and might even be able to extract parts of your key. In order to do this safely, you'd need to whiten your "correcthorsebatterystaple-esque" key first. Or better yet, you shoud not even consider doing this and use a key-stretcher instead. Because there are a thousand other mistakes that you won't even know you're making that are completely avoidable.
  - umvi 6y ago
    > You don't see how not storing the key is more secure than storing the key? I'm suggesting you memorize the key, and only store the ciphertext. And when the border police see encrypted files and demand the key so they can examine further? > This would fail a statistical uniformity test, and your adversary would be able to figure out that something was hiding there, and might even be able to extract parts of your key. In order to do this safely, you'd need to whiten your "correcthorsebatterystaple-esque" key first. I'm telling you, I could invent an obscure security scheme that NSA couldn't crack in a million years because they wouldn't even know where to start. Heck, I could do it with a 1 character password 1. select 1 character password p 2. Take sha256(sha1(md5(p))) 1 million times 3. xor result with bitcoin wallet private key Bam, easy to remember, impossible to crack (unless you know the secret formula, which you won't) However, all this is moot if the border police demand a key upon seeing encrypted files. So actually I think the best approach is to hide the (encrypted) private key as innocuous words in emails.
    - ohazi 6y ago
      > I'm telling you, I could invent an obscure security scheme that NSA couldn't crack in a million years because they wouldn't even know where to start. Oh, boy. First of all, you didn't. You invented a broken scheme, and then when I pointed this out, you invented a new one without stopping to think about why your first scheme was broken, or why you didn't catch your mistake the first time. > easy to remember, impossible to crack (unless you know the secret formula, which you won't) That's not at all how this works. You're assuming that your "secret formula" automatically provides an arbitrary amount of secrecy. It doesn't. Every operation that you choose to apply can provide a certain number of equivalent bits of secrecy (it's fewer bits than you think), or, if chosen poorly, can completely wipe away any secrecy you've built up thus far. Unless you can provide a proof that your method is sound, it isn't. Based on comments you've made elsewhere, I have next to zero confidence in your ability to build a construct like this correctly, save for sheer dumb luck. All you've done is inform everybody here that you've not a cryptographer. > However, all this is moot if the border police demand a key upon seeing encrypted files. So actually I think the best approach is to hide the (encrypted) private key as innocuous words in emails. The whole point of this discussion was to point out that you can hide strongly encrypted ciphertext using weak steganographic techniques so that the police aren't going to see encrypted files, and aren't likely to suspect a hidden message. The point of using strong cryptography is so that even if they do manage to suspect a hidden message: 1) You're not making their job needlessly easy by also giving them the key by mistakenly thinking that you can hide it effectively. You can't. 2) You can get a strong key out of a passphrase that you can easily memorize, so hiding the key isn't even necessary in the first place. > And when the border police see encrypted files and demand the key so they can examine further? They're not going to see encrypted files. Hide ONLY the ciphertext. Memorize the key. It's simpler, provides more bits of secrecy, and is easier to validate than some harebrained secret-chained-hash scheme.
- ohazi 6y ago
  > Steganography is still security through obscurity. It doesn't have to be. Maybe that's where our misunderstanding is coming from. The method I'm suggesting is this: 1) Generate a good passphrase and memorize it. 2) Use a strong key-stretching algorithm like pbkdf2 to generate a symmetric encryption key from the passphrase. 3) Use a strong encryption algorithm like aes-256 to encrypt your bitcoin wallet using the key from step 2. 4) Use steganographic techniques to hide the ciphertext from step 3 in an image, email, executable, pdf, etc. 5) Walk across the border carrying the hidden ciphertext on a computer or a disk, and with the passphrase in your brain. This is not security through obscurity, this is hiding the fact that you're carrying a bitcoin wallet across a border through obscurity. The actual wallet is still protected using strong cryptography. You'd be perfectly safe publishing the ciphertext from step 3 online, or mailing a copy to the White House, because the protection comes from the computational guarantees provided by strong cryptography, and by your knowledge that nothing derived from key material was ever published or transmitted. It's safer to rely on strong cryptography as your fallback in case the steganography is discovered than to assume that the NSA can't figure out why you capitalized every third word in your last twenty emails to yourself. If they're going to do that anyway, let them discover your ciphertext, not your key.
  - umvi 6y ago
    > 3) Use a strong encryption algorithm like aes-256 to encrypt your bitcoin wallet using the key from step 2. bitcoin wallet private key is 256 bits. Why not just sha256 hash a password and xor it with the private key? Seems like a decent one time pad to me and much simpler than your approach. And before you say how easily sha256 passwords are brute-forced (they aren't if you pick a password longer than, say, 20 characters) the attacker would need to know so many things that it is unreasonable to assume they would even try that. They would need to know a) my bitcoin private key was xored with a OTP b) the OTP was generated using sha256 c) anything else I did > 4) Use steganographic techniques to hide the ciphertext from step 3 in an image, email, executable, pdf, etc. If I were the leader of a totalitarian regime, I would almost certainly make my country's great firewall have extensive anti-steganographic measures. Any common file formats used for smuggling information that pass through the great firewall must first have all of its padding bits zeroed before continuing to its destination. If people start abusing metadata, metadata should be zeroed as well. > 5) Walk across the border carrying the hidden ciphertext on a computer or a disk, and with the passphrase in your brain Didn't GP say they take everything of value at the border? That would include computers and disks. "You could pass the border occasionally to visit family on the other side, but it was risky to take anything."

by ohazi 6y ago

umvi 6y ago

> Then store the resulting uniform random-looking blob in image metadata or whatever. Steganography is still security through obscurity. I don't see how it's any more secure than storing a manipulated key in plain text, especially if you are competent. If it were me I would just xor my address with a key of the same length (correcthorsebatterystaple-esque) and then xor it back out on the other side. How would you even know it was a bitcoin wallet address vs. something else? Or even write a letter to someone, where the second letter of the first word of every paragraph form the wallet address.

AgentME 6y ago
>How would you even know it was a bitcoin wallet address vs. something else? The fact you talk about doing that sort of thing would be a big clue. The benefit of using proper symmetric encryption (like GPG, or even better, age[0]) is that even if you talk about or even fully explain your process, then it's still secure as long as you don't post your key. [0] https://age-encryption.org/ https://age-encryption.org/
- umvi 6y ago
  If you use "proper symmetric encryption" you have the same problem as before: how to smuggle the key over the border assuming they will search your person and online accounts ...?
  - AgentME 6y ago
    Oh sorry, I think I'd lost that bit of context. This scenario of hiding a password during inspection is probably the main place where "security through obscurity" has validity. A big benefit of encrypting your cryptocurrency private key with a password and then hiding/obscuring that password instead of the raw private key itself is that good encryption will apply key-stretching to the password, making it harder to brute-force. If an attacker finds a random-looking value in your stuff, and believes that the value might be your bitcoin private key XORed by a short string, they it's very cheap for them to check whether each result is a valid bitcoin private key. There might even be structure in the bitcoin private key format that helps gives away the XOR key. But if they know your bitcoin private key (or something else) is encrypted by Age, and they find a random-looking value that might be your password XORed by a short string, then because Age uses scrypt on the password, then it will take longer for them to verify each attempt against the ciphertext.
  - ohazi 6y ago
    It's not difficult to memorize one reasonably good passphrase, and there are well-known key-stretching algorithms that are understood to provide however many bits you need of actual security from this passphrase. > Just shift all the digits of your key by some secret (but very simple) algorithm You are basically suggesting that people roll their own crypto here. Or pseudo-crypto, or stego, or whatever you want to call it. Don't tell people to "Just do X" when the ambiguity in the methods that you describe leave >90% odds that the result of their work won't even pass a statistical uniformity test. This leaks the key. Once your adversary realizes that you made some sort of mistake here, they can write software to make their attack orders of magnitude easier than it would otherwise be.
    - umvi 6y ago
      > Once your adversary realizes that you made some sort of mistake here, they can write software to "Writing software" takes time, and by then all the money in the wallet would be gone
      - ohazi 6y ago
ohazi 6y ago
Steganography is for hiding the fact that you're hiding something, it's not for protecting the thing that you're hiding. You still need real cryptography to do that. You can encode a real cryptographic key in a relatively short passphrase that's easy to memorize using key-stretching. You can then use this passphrase to strongly encrypt as much data as you want. The only thing you should be hiding are the encrypted blocks. If they manage to find these blocks (which they absolutely might! steganography is nowhere near perfect), they should still be encrypted, and they should still look like uniform random noise. You're not supposed to hide the key!
- umvi 6y ago
  Sure, I can agree with that. I probably wouldn't choose image-based steganography though because for all I know the country has a great firewall that scrubs all outgoing image metadata
ohazi 6y ago
> I don't see how it's any more secure than storing a manipulated key in plain text You don't see how not storing the key is more secure than storing the key? I'm suggesting you memorize the key, and only store the ciphertext. > I would just xor my address with a key of the same length (correcthorsebatterystaple-esque) and then xor it back out on the other side This would fail a statistical uniformity test, and your adversary would be able to figure out that something was hiding there, and might even be able to extract parts of your key. In order to do this safely, you'd need to whiten your "correcthorsebatterystaple-esque" key first. Or better yet, you shoud not even consider doing this and use a key-stretcher instead. Because there are a thousand other mistakes that you won't even know you're making that are completely avoidable.
- umvi 6y ago
  > You don't see how not storing the key is more secure than storing the key? I'm suggesting you memorize the key, and only store the ciphertext. And when the border police see encrypted files and demand the key so they can examine further? > This would fail a statistical uniformity test, and your adversary would be able to figure out that something was hiding there, and might even be able to extract parts of your key. In order to do this safely, you'd need to whiten your "correcthorsebatterystaple-esque" key first. I'm telling you, I could invent an obscure security scheme that NSA couldn't crack in a million years because they wouldn't even know where to start. Heck, I could do it with a 1 character password 1. select 1 character password p 2. Take sha256(sha1(md5(p))) 1 million times 3. xor result with bitcoin wallet private key Bam, easy to remember, impossible to crack (unless you know the secret formula, which you won't) However, all this is moot if the border police demand a key upon seeing encrypted files. So actually I think the best approach is to hide the (encrypted) private key as innocuous words in emails.
  - ohazi 6y ago
    > I'm telling you, I could invent an obscure security scheme that NSA couldn't crack in a million years because they wouldn't even know where to start. Oh, boy. First of all, you didn't. You invented a broken scheme, and then when I pointed this out, you invented a new one without stopping to think about why your first scheme was broken, or why you didn't catch your mistake the first time. > easy to remember, impossible to crack (unless you know the secret formula, which you won't) That's not at all how this works. You're assuming that your "secret formula" automatically provides an arbitrary amount of secrecy. It doesn't. Every operation that you choose to apply can provide a certain number of equivalent bits of secrecy (it's fewer bits than you think), or, if chosen poorly, can completely wipe away any secrecy you've built up thus far. Unless you can provide a proof that your method is sound, it isn't. Based on comments you've made elsewhere, I have next to zero confidence in your ability to build a construct like this correctly, save for sheer dumb luck. All you've done is inform everybody here that you've not a cryptographer. > However, all this is moot if the border police demand a key upon seeing encrypted files. So actually I think the best approach is to hide the (encrypted) private key as innocuous words in emails. The whole point of this discussion was to point out that you can hide strongly encrypted ciphertext using weak steganographic techniques so that the police aren't going to see encrypted files, and aren't likely to suspect a hidden message. The point of using strong cryptography is so that even if they do manage to suspect a hidden message: 1) You're not making their job needlessly easy by also giving them the key by mistakenly thinking that you can hide it effectively. You can't. 2) You can get a strong key out of a passphrase that you can easily memorize, so hiding the key isn't even necessary in the first place. > And when the border police see encrypted files and demand the key so they can examine further? They're not going to see encrypted files. Hide ONLY the ciphertext. Memorize the key. It's simpler, provides more bits of secrecy, and is easier to validate than some harebrained secret-chained-hash scheme.
ohazi 6y ago
> Steganography is still security through obscurity. It doesn't have to be. Maybe that's where our misunderstanding is coming from. The method I'm suggesting is this: 1) Generate a good passphrase and memorize it. 2) Use a strong key-stretching algorithm like pbkdf2 to generate a symmetric encryption key from the passphrase. 3) Use a strong encryption algorithm like aes-256 to encrypt your bitcoin wallet using the key from step 2. 4) Use steganographic techniques to hide the ciphertext from step 3 in an image, email, executable, pdf, etc. 5) Walk across the border carrying the hidden ciphertext on a computer or a disk, and with the passphrase in your brain. This is not security through obscurity, this is hiding the fact that you're carrying a bitcoin wallet across a border through obscurity. The actual wallet is still protected using strong cryptography. You'd be perfectly safe publishing the ciphertext from step 3 online, or mailing a copy to the White House, because the protection comes from the computational guarantees provided by strong cryptography, and by your knowledge that nothing derived from key material was ever published or transmitted. It's safer to rely on strong cryptography as your fallback in case the steganography is discovered than to assume that the NSA can't figure out why you capitalized every third word in your last twenty emails to yourself. If they're going to do that anyway, let them discover your ciphertext, not your key.
- umvi 6y ago
  > 3) Use a strong encryption algorithm like aes-256 to encrypt your bitcoin wallet using the key from step 2. bitcoin wallet private key is 256 bits. Why not just sha256 hash a password and xor it with the private key? Seems like a decent one time pad to me and much simpler than your approach. And before you say how easily sha256 passwords are brute-forced (they aren't if you pick a password longer than, say, 20 characters) the attacker would need to know so many things that it is unreasonable to assume they would even try that. They would need to know a) my bitcoin private key was xored with a OTP b) the OTP was generated using sha256 c) anything else I did > 4) Use steganographic techniques to hide the ciphertext from step 3 in an image, email, executable, pdf, etc. If I were the leader of a totalitarian regime, I would almost certainly make my country's great firewall have extensive anti-steganographic measures. Any common file formats used for smuggling information that pass through the great firewall must first have all of its padding bits zeroed before continuing to its destination. If people start abusing metadata, metadata should be zeroed as well. > 5) Walk across the border carrying the hidden ciphertext on a computer or a disk, and with the passphrase in your brain Didn't GP say they take everything of value at the border? That would include computers and disks. "You could pass the border occasionally to visit family on the other side, but it was risky to take anything."