4 ms·

>this is only as secure as a users password which 99% of the time is trivially crackable Are you talking about the WhatsApp backup scheme? I think the HSM shou

>this is only as secure as a users password which 99% of the time is trivially crackable Are you talking about the WhatsApp backup scheme? I think the HSM should theoretically make even a weak password mostly uncrackable.

Retric 5y ago
> even a weak password mostly uncrackable. That’s not what the HSM provides it’s based on this. OPAQUE: An Asymmetric PAKE Protocol Secure Against Pre-Computation Attacks: https://eprint.iacr.org/2018/163.pdf https://eprint.iacr.org/2018/163.pdf The point of end to end encryption is you don’t need to trust anyone else as long as you verified each parties public keys it’s safe. This fails that test, The threat model of government surveillance is both up front sniffing of the passwords provided to the server and copying the HSM and doing an offline check of every possible password. Both vulnerabilities are significant issues which allow hackers and state actors to read users backups and thus their messages.
- Thorrez 5y ago
  >up front sniffing of the passwords provided to the server I haven't read either pdfs fully, but it seems to me no password is provided to the server (though I'm actually not sure what you mean by password or server). The OPAQUE protocol means the HSM can verify the user has the password without ever seeing the password. So the password is never provided to the HSM or any other server. It's asymmetric. And for the encryption key, it's stored in the HSM yes, but when sending it to the HSM, it's unsniffable because it's encrypted with the HSM's public key. >doing an offline check of every possible The HSM should prevent that by limiting the number of attempts. From the WhatsApp pdf: >The HSM Backup Key Vault is responsible for enforcing password verification attempts Of course, if there's a hardware vuln in the HSM, then the verification attempts can be bypassed, and the backup is only secure if the password is quite high entropy. It comes down to how likely there is to be a hardware vuln in the HSM. I think in practice HSMs tend to have hardware vulns somewhat frequently, which is why I said "theoretically" in my previous comment. If we theorize the HSM has no hardware vuln, then it's safe with a weak password. We also have to assume there's no backdoor built into the HSM, or the HSM keypair computation or distribution process.

Retric 5y ago

> even a weak password mostly uncrackable. That’s not what the HSM provides it’s based on this. OPAQUE: An Asymmetric PAKE Protocol Secure Against Pre-Computation Attacks: https://eprint.iacr.org/2018/163.pdf https://eprint.iacr.org/2018/163.pdf The point of end to end encryption is you don’t need to trust anyone else as long as you verified each parties public keys it’s safe. This fails that test, The threat model of government surveillance is both up front sniffing of the passwords provided to the server and copying the HSM and doing an offline check of every possible password. Both vulnerabilities are significant issues which allow hackers and state actors to read users backups and thus their messages.

Thorrez 5y ago
>up front sniffing of the passwords provided to the server I haven't read either pdfs fully, but it seems to me no password is provided to the server (though I'm actually not sure what you mean by password or server). The OPAQUE protocol means the HSM can verify the user has the password without ever seeing the password. So the password is never provided to the HSM or any other server. It's asymmetric. And for the encryption key, it's stored in the HSM yes, but when sending it to the HSM, it's unsniffable because it's encrypted with the HSM's public key. >doing an offline check of every possible The HSM should prevent that by limiting the number of attempts. From the WhatsApp pdf: >The HSM Backup Key Vault is responsible for enforcing password verification attempts Of course, if there's a hardware vuln in the HSM, then the verification attempts can be bypassed, and the backup is only secure if the password is quite high entropy. It comes down to how likely there is to be a hardware vuln in the HSM. I think in practice HSMs tend to have hardware vulns somewhat frequently, which is why I said "theoretically" in my previous comment. If we theorize the HSM has no hardware vuln, then it's safe with a weak password. We also have to assume there's no backdoor built into the HSM, or the HSM keypair computation or distribution process.