6 ms·

The Plausibly Deniable DataBase (PDDB): It’s Real Now

95 points by sohkamyung 4y ago

unintendedcons 4y ago
Amazing! How can we start playing with it now?
- knewter 4y ago
  Clone xous, run a make command, you get an emulated precursor running it. Go to town.
alexvoda 4y ago
I wonder how secure this is against rubber hose cryptanalysis. I mean just having this installed is a giant red flag that you have additional secrets other than the ones you were willing to disclose after "convincing". If you are the kind of person that would actually need this, it may not be safe to use it until it becomes a standard feature.
- O__________O 4y ago
  Having a Precursor itself would be a huge red flag.
- deleted 4y ago
  [deleted]
- ajsnigrutin 4y ago
  Can you make multiple volumes/rings of "secrets"? First ring, personal data, family photos,.... First hidden "volume" - banking data, credit card info,... Second hidden "volume" - dick pics, some embarrasing porn Third hidden "volume" - atom bomb plans or whatever you're actually tryng to hide.
  - btilly 4y ago
    Atom bomb plans are actually readily available, and were publicly published over 40 years ago. A nuclear bomb just has to bring a critical mass of material together. For Uranium 235, that's about 104 pounds. You typically do it by splitting it into 4 pieces, and stick something like dynamite to each one so that when they go off it goes together and goes boom. A hydrogen bomb is an ellipsoid made of aluminum foil with a nuclear bomb at one focus and heavy water at the other. The flash from the nuclear bomb hits the foil, and refocuses on the water that makes for a substantially larger boom. This is all well-known. The trick is getting a sufficient supply of enriched uranium. The principles of how to do that are described in https://fas.org/issues/nonproliferation-counterproliferation/nuclear-fuel-cycle/uranium-enrichment-gas-centrifuge-technology/centrifuge-works/ https://fas.org/issues/nonproliferation-counterproliferation.... Note that operating with elemental fluorine is dangerous to your health, and the necessary centrifuges WILL be spotted by US satellites, who are unlikely to be sympathetic with your desire to build a nuclear arsenal.
    - SolarNet 4y ago
      Obviously why it's only in the third ring. The fourth ring or fifth ring is where it starts getting interesting.
    - bigiain 4y ago
      > A nuclear bomb just has to bring a critical mass of material together. I could build Twitter in a weekend! (It's never as simple as there executive-level "big picture" makes it sound...)
    - salawat 4y ago
      There are still massive ??? sections. Your "recipe" for a hydrogen bomb (or more specifically, and Ullam-Teller fusion boosted fission device) missed the gigantic hole of uncertainty that is FOGBANK. In theory, you have a rough design for an assembly. In practice, there is still more than enough knowledge missing to keep you blowing holes in/irradiating the countryside for quite sometime to come, and that's being generous, and granting no one actively interferes with your efforts at building a cache of recreational McNukes.
  - cgriswald 4y ago
    If I have a rubber hose, the existence of a second hidden volume implies an infinite amount of volumes.
- btilly 4y ago
  You need a bit of operational planning, then it is fine. "Oh that? I installed it after seeing an article on Hacker News. Here are credentials. There is nothing really there." They use your credentials, see extra data that shows you played around with it, and have no reason to suspect that there is a DIFFERENT set of credentials which would give your ACTUAL secrets. The more HN people actually download and try it out, the more plausible the deniability that I just offered becomes.
  - MauranKilom 4y ago
    That's not how rubber hose cryptanalysis works though. You think they would just go "oh ok cool, have a nice day" after your rehearsed lie?
    - olalonde 4y ago
      How does a rubber hose cryptanalyst know when to stop?
      - NateEag 4y ago
        When the target is dead. There is no actual safety from nation-states or other sufficiently-resourced attackers.
        brokenkebab2 4y ago
        First, it assumes that resources is the only dimension here which is incorrect. History is full of failures of well-resourced, and practically unrestrained security services. Second, safety is not a set of just "on", and "off" states. It's a game of probabilities.
        NateEag 4y ago
        That sounds accurate. My point is that if you're being subjected to the rubber-hose treatment, nothing's going to get you out of it. Any actor who will start down that path will likely take it all the way to the finish, extracting whatever value they can from you until there's none left to extract.
- garaetjjte 4y ago
  I think it is less conspicuous to stuff encrypted data into unallocated space of ordinary filesystem with copious amount of redundancy to handle corruption caused by unaware filesystem, like Artifice: https://www.usenix.org/system/files/foci19-paper_barker.pdf https://www.usenix.org/system/files/foci19-paper_barker.pdf
- r3trohack3r 4y ago
  I think the author does a pretty good job of describing the use case in the two articles. If they’ve already decided to use a couple of well placed jumper cables, you’re past the point this is likely to be helpful. It seems the purpose of this is to avoid it getting to that point. For me this is appealing going through airports and the like. The TSA is unlikely to jump straight to rubber hose analysis but, for a concrete real-world example, they will readily have the DEA intercept you on the way to your terminal if they suspect you’re carrying a financial instrument worth $10K+ on your person. And that’s just the US. As a US citizen traveling to China, there are plenty of use cases I could imagine for needing to move information that are only a problem once an official suspects you have something of value on the device. A concrete example that might resonate with the HN crowd: traveling between nation states with ssh credentials for your company’s infrastructure. I can see this being useful against nation states if the goal is to avoid initial suspicion. If they’re already interested in you the game may very well already be up.
  - m1gu3l 4y ago
    Safer to memorize the private key string.
- cyphar 4y ago
  This is the general flaw with plausible deniability cryptosystems. While it sounds like you could use it to still hide secrets when forced to hand over your keys, the flipside is that you can never convince any entity that you have actually given them all of the keys.
- im3w1l 4y ago
  I just came up with an idea that can resist rubber hose cryptanalysis: Quantum physics. Take a password, use some key stretching. Interpret the result: 0 indicates measure up-down. 1 indicates measure left-right. Measure qubits using this pattern. Get harddrive encryption key. If as a prisoner you lie to your captors and they fall for it, they will measure the wrong way and the harddrive key is destroyed forever. They way qubits work you only get one attempt.
doctor_eval 4y ago
Doesn’t the use of a PDDB make all subsequent denials implausible? Or am I missing something?
- nevinera 4y ago
  It's a little complex, but not really. It's depth-N secret-hiding; if you have a true secret that absolutely must be hidden, you hide a disk full of anime at the top level, a smaller disk of furry porn below that, and a hundred pages of terrible erotic fiction below that, as your "deepest darkest secret". And now you have a "good" justification for using a PDDB to keep your shame hidden, and the layer below _that_ holding the corporate secrets you're trying to auction off can't be proven in any reasonable way (from the disk. I'm sure it's obvious by this point that I'm no expert on corporate espionage, but there are plenty of other ways you'll get caught). I mean, if you're not the kind of person that would use something like this anyway, then people will always _suspect_ you have something deeper in there (even if you don't). But they won't be able to prove it - that's the goal.
  - doctor_eval 4y ago
    Yeah but the deniability will fall apart when they look in your browser history and find Wattpad :-)
- NateEag 4y ago
  I think you're right. Once a target has shown that they have hidden something at a lower level, which only they were able to demonstrate existed, the attacker knows the target has prepared an in-depth plausibly-deniable defense. They will therefore have no reason to trust the target's claims that "No really, that's the worst thing I have," and will have a very strong reason to doubt it.
  - doctor_eval 4y ago
    Right? I haven't looked into how it works (I have nothing plausible to deny :-) but the web page says it's a filesystem, so I guess it's software, it has to be installed or run from somewhere, and the moment any hint of that software is discovered (browser history to the github page?), then deniability becomes less plausible. At best, using it successfully would seem to require a level of secops that is really hard to achieve.
jancsika 4y ago
> Of course, nothing prevents a chat application from going out of its way to maintain a separate copy of the contact book, thus allowing it to leak the existence of Trent’s key/value pair after the secret Basis is closed. However, that is extra work on behalf of the application developer. Um, no? Don't app devs do stuff like this all the time? E.g., hm I'm in a hurry so why don't I just plunk down some JSON from the last known state of this super handy feature to disk so its ready at startup? Also, I wrote this a gazillion years before anyone even suggested the existence of plausibly-deniable anything. Also, I farted this pattern all over the whole app that is now somehow critical U.S. digital infrastructure, and I don't answer emails anymore after moving to Tahiti to build experimental percussion instruments out of driftwood...
aaron695 4y ago

95 points by sohkamyung 4y ago

unintendedcons 4y ago

Amazing! How can we start playing with it now?

knewter 4y ago
Clone xous, run a make command, you get an emulated precursor running it. Go to town.

alexvoda 4y ago

I wonder how secure this is against rubber hose cryptanalysis. I mean just having this installed is a giant red flag that you have additional secrets other than the ones you were willing to disclose after "convincing". If you are the kind of person that would actually need this, it may not be safe to use it until it becomes a standard feature.

O__________O 4y ago
Having a Precursor itself would be a huge red flag.
deleted 4y ago
[deleted]
ajsnigrutin 4y ago
Can you make multiple volumes/rings of "secrets"? First ring, personal data, family photos,.... First hidden "volume" - banking data, credit card info,... Second hidden "volume" - dick pics, some embarrasing porn Third hidden "volume" - atom bomb plans or whatever you're actually tryng to hide.
- btilly 4y ago
  Atom bomb plans are actually readily available, and were publicly published over 40 years ago. A nuclear bomb just has to bring a critical mass of material together. For Uranium 235, that's about 104 pounds. You typically do it by splitting it into 4 pieces, and stick something like dynamite to each one so that when they go off it goes together and goes boom. A hydrogen bomb is an ellipsoid made of aluminum foil with a nuclear bomb at one focus and heavy water at the other. The flash from the nuclear bomb hits the foil, and refocuses on the water that makes for a substantially larger boom. This is all well-known. The trick is getting a sufficient supply of enriched uranium. The principles of how to do that are described in https://fas.org/issues/nonproliferation-counterproliferation/nuclear-fuel-cycle/uranium-enrichment-gas-centrifuge-technology/centrifuge-works/ https://fas.org/issues/nonproliferation-counterproliferation.... Note that operating with elemental fluorine is dangerous to your health, and the necessary centrifuges WILL be spotted by US satellites, who are unlikely to be sympathetic with your desire to build a nuclear arsenal.
  - SolarNet 4y ago
    Obviously why it's only in the third ring. The fourth ring or fifth ring is where it starts getting interesting.
  - bigiain 4y ago
    > A nuclear bomb just has to bring a critical mass of material together. I could build Twitter in a weekend! (It's never as simple as there executive-level "big picture" makes it sound...)
  - salawat 4y ago
    There are still massive ??? sections. Your "recipe" for a hydrogen bomb (or more specifically, and Ullam-Teller fusion boosted fission device) missed the gigantic hole of uncertainty that is FOGBANK. In theory, you have a rough design for an assembly. In practice, there is still more than enough knowledge missing to keep you blowing holes in/irradiating the countryside for quite sometime to come, and that's being generous, and granting no one actively interferes with your efforts at building a cache of recreational McNukes.
- cgriswald 4y ago
  If I have a rubber hose, the existence of a second hidden volume implies an infinite amount of volumes.
btilly 4y ago
You need a bit of operational planning, then it is fine. "Oh that? I installed it after seeing an article on Hacker News. Here are credentials. There is nothing really there." They use your credentials, see extra data that shows you played around with it, and have no reason to suspect that there is a DIFFERENT set of credentials which would give your ACTUAL secrets. The more HN people actually download and try it out, the more plausible the deniability that I just offered becomes.
- MauranKilom 4y ago
  That's not how rubber hose cryptanalysis works though. You think they would just go "oh ok cool, have a nice day" after your rehearsed lie?
  - olalonde 4y ago
    How does a rubber hose cryptanalyst know when to stop?
    - NateEag 4y ago
      When the target is dead. There is no actual safety from nation-states or other sufficiently-resourced attackers.
      - brokenkebab2 4y ago
        First, it assumes that resources is the only dimension here which is incorrect. History is full of failures of well-resourced, and practically unrestrained security services. Second, safety is not a set of just "on", and "off" states. It's a game of probabilities.
        NateEag 4y ago
        That sounds accurate. My point is that if you're being subjected to the rubber-hose treatment, nothing's going to get you out of it. Any actor who will start down that path will likely take it all the way to the finish, extracting whatever value they can from you until there's none left to extract.
garaetjjte 4y ago
I think it is less conspicuous to stuff encrypted data into unallocated space of ordinary filesystem with copious amount of redundancy to handle corruption caused by unaware filesystem, like Artifice: https://www.usenix.org/system/files/foci19-paper_barker.pdf https://www.usenix.org/system/files/foci19-paper_barker.pdf
r3trohack3r 4y ago
I think the author does a pretty good job of describing the use case in the two articles. If they’ve already decided to use a couple of well placed jumper cables, you’re past the point this is likely to be helpful. It seems the purpose of this is to avoid it getting to that point. For me this is appealing going through airports and the like. The TSA is unlikely to jump straight to rubber hose analysis but, for a concrete real-world example, they will readily have the DEA intercept you on the way to your terminal if they suspect you’re carrying a financial instrument worth $10K+ on your person. And that’s just the US. As a US citizen traveling to China, there are plenty of use cases I could imagine for needing to move information that are only a problem once an official suspects you have something of value on the device. A concrete example that might resonate with the HN crowd: traveling between nation states with ssh credentials for your company’s infrastructure. I can see this being useful against nation states if the goal is to avoid initial suspicion. If they’re already interested in you the game may very well already be up.
- m1gu3l 4y ago
  Safer to memorize the private key string.
cyphar 4y ago
This is the general flaw with plausible deniability cryptosystems. While it sounds like you could use it to still hide secrets when forced to hand over your keys, the flipside is that you can never convince any entity that you have actually given them all of the keys.
im3w1l 4y ago
I just came up with an idea that can resist rubber hose cryptanalysis: Quantum physics. Take a password, use some key stretching. Interpret the result: 0 indicates measure up-down. 1 indicates measure left-right. Measure qubits using this pattern. Get harddrive encryption key. If as a prisoner you lie to your captors and they fall for it, they will measure the wrong way and the harddrive key is destroyed forever. They way qubits work you only get one attempt.

doctor_eval 4y ago

Doesn’t the use of a PDDB make all subsequent denials implausible? Or am I missing something?

nevinera 4y ago
It's a little complex, but not really. It's depth-N secret-hiding; if you have a true secret that absolutely must be hidden, you hide a disk full of anime at the top level, a smaller disk of furry porn below that, and a hundred pages of terrible erotic fiction below that, as your "deepest darkest secret". And now you have a "good" justification for using a PDDB to keep your shame hidden, and the layer below _that_ holding the corporate secrets you're trying to auction off can't be proven in any reasonable way (from the disk. I'm sure it's obvious by this point that I'm no expert on corporate espionage, but there are plenty of other ways you'll get caught). I mean, if you're not the kind of person that would use something like this anyway, then people will always _suspect_ you have something deeper in there (even if you don't). But they won't be able to prove it - that's the goal.
- doctor_eval 4y ago
  Yeah but the deniability will fall apart when they look in your browser history and find Wattpad :-)
NateEag 4y ago
I think you're right. Once a target has shown that they have hidden something at a lower level, which only they were able to demonstrate existed, the attacker knows the target has prepared an in-depth plausibly-deniable defense. They will therefore have no reason to trust the target's claims that "No really, that's the worst thing I have," and will have a very strong reason to doubt it.
- doctor_eval 4y ago
  Right? I haven't looked into how it works (I have nothing plausible to deny :-) but the web page says it's a filesystem, so I guess it's software, it has to be installed or run from somewhere, and the moment any hint of that software is discovered (browser history to the github page?), then deniability becomes less plausible. At best, using it successfully would seem to require a level of secops that is really hard to achieve.

jancsika 4y ago

> Of course, nothing prevents a chat application from going out of its way to maintain a separate copy of the contact book, thus allowing it to leak the existence of Trent’s key/value pair after the secret Basis is closed. However, that is extra work on behalf of the application developer. Um, no? Don't app devs do stuff like this all the time? E.g., hm I'm in a hurry so why don't I just plunk down some JSON from the last known state of this super handy feature to disk so its ready at startup? Also, I wrote this a gazillion years before anyone even suggested the existence of plausibly-deniable anything. Also, I farted this pattern all over the whole app that is now somehow critical U.S. digital infrastructure, and I don't answer emails anymore after moving to Tahiti to build experimental percussion instruments out of driftwood...

aaron695 4y ago