3 ms·

Right, you're spot on about the OTP. The pad is itself transmitted over the same channel(s) as the message, so there's no value in using an OTP per se. I think

by md_ 6y ago

Right, you're spot on about the OTP. The pad is itself transmitted over the same channel(s) as the message, so there's no value in using an OTP per se. I think the author was just going for a way to split a message in a way that one needs all parts of the split message (or key) to decrypt it. I'm not sure I buy your argument for the value this may provide, though. * The question you pose for an attacker--which platform and which device/identity was used to send a message of interest--already exists, in a more general form, for any attacker. Our threat model presumes the attacker has solved it, or else we wouldn't need e2ee to begin with. * If you're going to discuss something in person, instead of discussing how to use a small number of different channels or identities, just share cryptographic keys! It's my strong sense that the author is mostly ignorant of encryption itself (hence the misuse of OTP) and instead is trying to solve for the problem of lawful intercept (and hence the digression about supply chain security). This is a somewhat reasonable concern, but I don't think the proposal does much to help with it. As I noted above, barring assumptions of extremely pervasive full stack compromise (or full compromise of common cryptographic primitives, an air-gapped dedicated device for encrypting messages with preshared keys provides all the security of this scheme, reduces risk (e.g. of 0days), and is far more usable.

ljlolel 6y ago
OTP is not sent over the same channel. Is there some other way I can explain it better, maybe a specific section on a Threat Model (there's a vulnerabilities section to include things not in the threat model).
- md_ 6y ago
  OTP is sent over one of the two channels (or m of n). The lint is that the pad has effectively the same security as the message itself. In terms of explaining, try to describe specific threats (including what the attacker can and cannot do, ideally with a real-world example). E.g. can your attacker: * Observe ciphertext? Do they have global network MTIM? (Passive or active?) * Break e2ee? For example, do they have the ability to derive messages from merely passively observing ciphertext? * Compel service providers to share any data the provider has? * Compel providers to serve malicious code to their users? Etc. This proposal is missing any formal threat model, so it’s hard to evaluate what it’s intended to do. I cannot immediately come up with a threat model where this makes sense, unfortunately.
  - ljlolel 6y ago
    >OTP is sent over one of the two channels (or m of n). The lint is that the pad has effectively the same security as the message itself. Yes! Exactly, that's the brilliant part of this. There is symmetric trust (distrust really) of every channel. We equally distrust all channels a bit, and expect them to be exploitable by different non-overlapping parties (see Venn diagram). In old times you couldn't do this since there weren't so many ways to communicate, and they were all insecure except one very very expensive one. Nowadays, there are multiple channels people use which are all mostly secure using modern crypto, except for some very specific vulnerabilities and state-sponsored attacks, but usually only from 1 or otherwise very expensive per attack. That's the innovation that Horcruxes exploits! Do you see? There is a section on Threat Model, also if you just think about it you can imagine the threat models yourself, looking at what it does and the use cases. I've added those explicitly into that section.
    - maqp 6y ago
      "We equally distrust all channels a bit" The problem is you're proposing a scheme that's completely insecure if all channels are being watched by the same entity. The fact you're not employing public key encryption to mitigate this issue is really weird. "expect them to be exploitable by different non-overlapping parties (see Venn diagram)." Don't. NSA knew about the Sony hacks because they had hacked the systems of North Korea's cyber army. There's no telling if they're inside e.g. WeChat's servers. Cryptographic security is on so different level it's hard to emphasize it. Perhaps a comparison to computational effort would suffice: Let's say a zero-day exploit to compromise one server costs 1,000,000 USD. Let's say brute forcing an 80-bit key also costs 1,000,000 USD. Let's say you're using two servers to deliver the alone unbreakable horcrux halves. It's costing exactly 2,000,000 USD to recover the message This is the equivalent to brute forcing an 81-bit key. My point is, it's much cheaper to break the channels than it is to break the encryption keys that start from around 128 bits and go up to 256 bits. "In old times you couldn't do this since there weren't so many ways to communicate, and they were all insecure except one very very expensive one." In the old times there was no encryption whatsoever in Yahoo Messenger, MSN messenger etc. In the old times there was no E2EE so you only had to hack the servers to get access to massive amounts of user data (this still holds true for some shit services, e.g. Telegram). "--except for some very specific vulnerabilities and state-sponsored attacks" State sponsored attacks are about hacking endpoints, like Besos' WhatsApp. And Horcrux doesn't solve this in any way. Even if your magic wand is an airgapped device. See https://ieeexplore.ieee.org/document/7122176 https://ieeexplore.ieee.org/document/7122176 and https://www.computer.org/csdl/magazine/co/2015/07/mco2015070059/13rRUNvgyZk https://www.computer.org/csdl/magazine/co/2015/07/mco2015070...

by md_ 6y ago

ljlolel 6y ago

OTP is not sent over the same channel. Is there some other way I can explain it better, maybe a specific section on a Threat Model (there's a vulnerabilities section to include things not in the threat model).

md_ 6y ago
OTP is sent over one of the two channels (or m of n). The lint is that the pad has effectively the same security as the message itself. In terms of explaining, try to describe specific threats (including what the attacker can and cannot do, ideally with a real-world example). E.g. can your attacker: * Observe ciphertext? Do they have global network MTIM? (Passive or active?) * Break e2ee? For example, do they have the ability to derive messages from merely passively observing ciphertext? * Compel service providers to share any data the provider has? * Compel providers to serve malicious code to their users? Etc. This proposal is missing any formal threat model, so it’s hard to evaluate what it’s intended to do. I cannot immediately come up with a threat model where this makes sense, unfortunately.
- ljlolel 6y ago
  >OTP is sent over one of the two channels (or m of n). The lint is that the pad has effectively the same security as the message itself. Yes! Exactly, that's the brilliant part of this. There is symmetric trust (distrust really) of every channel. We equally distrust all channels a bit, and expect them to be exploitable by different non-overlapping parties (see Venn diagram). In old times you couldn't do this since there weren't so many ways to communicate, and they were all insecure except one very very expensive one. Nowadays, there are multiple channels people use which are all mostly secure using modern crypto, except for some very specific vulnerabilities and state-sponsored attacks, but usually only from 1 or otherwise very expensive per attack. That's the innovation that Horcruxes exploits! Do you see? There is a section on Threat Model, also if you just think about it you can imagine the threat models yourself, looking at what it does and the use cases. I've added those explicitly into that section.
  - maqp 6y ago
    "We equally distrust all channels a bit" The problem is you're proposing a scheme that's completely insecure if all channels are being watched by the same entity. The fact you're not employing public key encryption to mitigate this issue is really weird. "expect them to be exploitable by different non-overlapping parties (see Venn diagram)." Don't. NSA knew about the Sony hacks because they had hacked the systems of North Korea's cyber army. There's no telling if they're inside e.g. WeChat's servers. Cryptographic security is on so different level it's hard to emphasize it. Perhaps a comparison to computational effort would suffice: Let's say a zero-day exploit to compromise one server costs 1,000,000 USD. Let's say brute forcing an 80-bit key also costs 1,000,000 USD. Let's say you're using two servers to deliver the alone unbreakable horcrux halves. It's costing exactly 2,000,000 USD to recover the message This is the equivalent to brute forcing an 81-bit key. My point is, it's much cheaper to break the channels than it is to break the encryption keys that start from around 128 bits and go up to 256 bits. "In old times you couldn't do this since there weren't so many ways to communicate, and they were all insecure except one very very expensive one." In the old times there was no encryption whatsoever in Yahoo Messenger, MSN messenger etc. In the old times there was no E2EE so you only had to hack the servers to get access to massive amounts of user data (this still holds true for some shit services, e.g. Telegram). "--except for some very specific vulnerabilities and state-sponsored attacks" State sponsored attacks are about hacking endpoints, like Besos' WhatsApp. And Horcrux doesn't solve this in any way. Even if your magic wand is an airgapped device. See https://ieeexplore.ieee.org/document/7122176 https://ieeexplore.ieee.org/document/7122176 and https://www.computer.org/csdl/magazine/co/2015/07/mco2015070059/13rRUNvgyZk https://www.computer.org/csdl/magazine/co/2015/07/mco2015070...