3 ms·
"We equally distrust all channels a bit" The problem is you're proposing a scheme that's completely insecure if all channels are being watched by the same enti
by maqp 6y ago
"We equally distrust all channels a bit"
The problem is you're proposing a scheme that's completely insecure if all channels are being watched by the same entity. The fact you're not employing public key encryption to mitigate this issue is really weird.
"expect them to be exploitable by different non-overlapping parties (see Venn diagram)."
Don't. NSA knew about the Sony hacks because they had hacked the systems of North Korea's cyber army. There's no telling if they're inside e.g. WeChat's servers.
Cryptographic security is on so different level it's hard to emphasize it. Perhaps a comparison to computational effort would suffice:
Let's say a zero-day exploit to compromise one server costs 1,000,000 USD. Let's say brute forcing an 80-bit key also costs 1,000,000 USD. Let's say you're using two servers to deliver the alone unbreakable horcrux halves. It's costing exactly 2,000,000 USD to recover the message
This is the equivalent to brute forcing an 81-bit key. My point is, it's much cheaper to break the channels than it is to break the encryption keys that start from around 128 bits and go up to 256 bits.
"In old times you couldn't do this since there weren't so many ways to communicate, and they were all insecure except one very very expensive one."
In the old times there was no encryption whatsoever in Yahoo Messenger, MSN messenger etc. In the old times there was no E2EE so you only had to hack the servers to get access to massive amounts of user data (this still holds true for some shit services, e.g. Telegram).
"--except for some very specific vulnerabilities and state-sponsored attacks"
State sponsored attacks are about hacking endpoints, like Besos' WhatsApp. And Horcrux doesn't solve this in any way. Even if your magic wand is an airgapped device. See
https://ieeexplore.ieee.org/document/7122176 https://ieeexplore.ieee.org/document/7122176
and
https://www.computer.org/csdl/magazine/co/2015/07/mco2015070059/13rRUNvgyZk https://www.computer.org/csdl/magazine/co/2015/07/mco2015070...