4 ms·

> Proof of Concept Heh, that's funny, the threat model was looking at observing text, not changing it. I haven't heard about anybody making things tamper-proof

> Proof of Concept Heh, that's funny, the threat model was looking at observing text, not changing it. I haven't heard about anybody making things tamper-proof from a government that has got your keys. Signal, of course if they get your keys by force, can do the same thing, just on a single client. So there isn't any more security. Finally, if you have 3, 4, 5, horcruxes, then they would still all need to cooperate to get the messages in order to do this perfect XOR (and remember they need to hack through the E2EE on each service too by getting your keys).

lucb1e 6y ago
> Signal, of course if they get your keys by force, can do the same thing, just on a single client ... So there isn't any more security. What? Keys "by force"? So if they come to my house and threaten me? I doubt that any security scheme holds up under that, yours nor theirs. > Finally, if you have 3, 4, 5, horcruxes, then they would still all need to cooperate to get the messages in order to do this perfect XOR I won't spend another 30 minutes making another POC but I'm fairly sure that this is not true. Have you tried it? If I'm not mistaken: the third, fourth, and fifth OTP are xored together with the first and second, and are therefore the same as xoring messages 2..5 together into one value and xoring that with the first message. The result of {plaintext} xor {any of them} will match the value of {xor the others together}. Therefore any of them can decide to do the attack and they don't even need to know how many other messages/channels/OTPs/horcruxes there are.
- ljlolel 6y ago
  "by force" I mean force Signal to ship code to the end user to upload the private keys so they can give it to the government, as described in the doc.... Oh I see what you mean about modifying. Good point. That's not in the threat model, I haven't heard of people doing that, but if it is a worry and you want to add it to the threat model, it's not hard to add a hash to the messages that will be a commitment scheme to ensure that you have all horcruxes and they haven't been tampered with. That's pretty easy.
  - maqp 6y ago
    "it's not hard to add a hash to the messages that will be a commitment scheme to ensure that you have all horcruxes and they haven't been tampered with" Oh dear god. No, hashes aren't to provide authenticity and integrity for messages under hostile conditions, look into Message Authentication Codes (effectively keyed hashes) like HMAC-SHA256, or use modern hash function (SHA3-256 or BLAKE2) in H(key+message), or since you're going for information theoretic security, look into unconditionally secure MACs like one-time MAC and Carter-Wegman MAC. Also, make sure to compare the purported tag to the evaluated one with a constant time function. This is so low level I'm not at all confident at your ability to implement this stuff so please take a course in cryptography before implementing anything and if you do, make sure to put a huge banner "This is a hobby project intended to learn about cryptography, do not use it in production". This is to protect you and others.
    - ljlolel 6y ago
      That's why I wrote "commitment scheme" of which there are many and which secure one you use doesn't really matter.
      - maqp 6y ago
        "That's why I wrote "commitment scheme" of which there are many and which secure one you use doesn't really matter." Please see https://en.wikipedia.org/wiki/Commitment_scheme https://en.wikipedia.org/wiki/Commitment_scheme It's a completely different thing. Authentication isn't about committing to something that's revealed later. Authentication is about detecting any changes in the plaintext content -- that would indicate the new message is from different author.
maqp 6y ago
"the threat model was looking at observing text, not changing it." Encryption aims to provide not just confidentiality but also integrity and authenticity. Three guesses what the integrity means. "I haven't heard about anybody making things tamper-proof from a government that has got your keys." Ok seriously reconsider taking a course or two on cryptography before venturing any further. The malleability of Vernam ciphers like stream ciphers and OTP -- even when the attacker is not in possession of the key -- is a well known thing. "if you have 3, 4, 5, horcruxes, then they would still all need to cooperate to get the messages in order to do this perfect XOR" Nope. It's enough they change one of the ciphertext parts if they can guess the plaintext for whatever reason. This is known as a known plaintext attack or KPA. You should address it as part of your scheme, look into one-time MACs and Carter-Wegman MACs.

lucb1e 6y ago

> Signal, of course if they get your keys by force, can do the same thing, just on a single client ... So there isn't any more security. What? Keys "by force"? So if they come to my house and threaten me? I doubt that any security scheme holds up under that, yours nor theirs. > Finally, if you have 3, 4, 5, horcruxes, then they would still all need to cooperate to get the messages in order to do this perfect XOR I won't spend another 30 minutes making another POC but I'm fairly sure that this is not true. Have you tried it? If I'm not mistaken: the third, fourth, and fifth OTP are xored together with the first and second, and are therefore the same as xoring messages 2..5 together into one value and xoring that with the first message. The result of {plaintext} xor {any of them} will match the value of {xor the others together}. Therefore any of them can decide to do the attack and they don't even need to know how many other messages/channels/OTPs/horcruxes there are.

ljlolel 6y ago
"by force" I mean force Signal to ship code to the end user to upload the private keys so they can give it to the government, as described in the doc.... Oh I see what you mean about modifying. Good point. That's not in the threat model, I haven't heard of people doing that, but if it is a worry and you want to add it to the threat model, it's not hard to add a hash to the messages that will be a commitment scheme to ensure that you have all horcruxes and they haven't been tampered with. That's pretty easy.
- maqp 6y ago
  "it's not hard to add a hash to the messages that will be a commitment scheme to ensure that you have all horcruxes and they haven't been tampered with" Oh dear god. No, hashes aren't to provide authenticity and integrity for messages under hostile conditions, look into Message Authentication Codes (effectively keyed hashes) like HMAC-SHA256, or use modern hash function (SHA3-256 or BLAKE2) in H(key+message), or since you're going for information theoretic security, look into unconditionally secure MACs like one-time MAC and Carter-Wegman MAC. Also, make sure to compare the purported tag to the evaluated one with a constant time function. This is so low level I'm not at all confident at your ability to implement this stuff so please take a course in cryptography before implementing anything and if you do, make sure to put a huge banner "This is a hobby project intended to learn about cryptography, do not use it in production". This is to protect you and others.
  - ljlolel 6y ago
    That's why I wrote "commitment scheme" of which there are many and which secure one you use doesn't really matter.
    - maqp 6y ago
      "That's why I wrote "commitment scheme" of which there are many and which secure one you use doesn't really matter." Please see https://en.wikipedia.org/wiki/Commitment_scheme https://en.wikipedia.org/wiki/Commitment_scheme It's a completely different thing. Authentication isn't about committing to something that's revealed later. Authentication is about detecting any changes in the plaintext content -- that would indicate the new message is from different author.

maqp 6y ago

"the threat model was looking at observing text, not changing it." Encryption aims to provide not just confidentiality but also integrity and authenticity. Three guesses what the integrity means. "I haven't heard about anybody making things tamper-proof from a government that has got your keys." Ok seriously reconsider taking a course or two on cryptography before venturing any further. The malleability of Vernam ciphers like stream ciphers and OTP -- even when the attacker is not in possession of the key -- is a well known thing. "if you have 3, 4, 5, horcruxes, then they would still all need to cooperate to get the messages in order to do this perfect XOR" Nope. It's enough they change one of the ciphertext parts if they can guess the plaintext for whatever reason. This is known as a known plaintext attack or KPA. You should address it as part of your scheme, look into one-time MACs and Carter-Wegman MACs.