3 ms·

Informational Asymmetry (IA) is not the same as STO, and it’s a fundamental of Information Security That made reading the article worthwhile for me. I mean, w

Informational Asymmetry (IA) is not the same as STO, and it’s a fundamental of Information Security That made reading the article worthwhile for me. I mean, what else is a secret but informational asymmetry?

aidenn0 4y ago
Except the examples given of IA are so broad as to eliminate the distinction between IA and STO. Knowing a value that is in a space larger than 2^64 possibilities is qualitatively different than knowning something in a space of only millions of possibilities. The real difference with como is that it's a cat-and-mouse game (or Red Queens race as another commenter said). It's more like being able to teleport all the keys in all the houses from under the doormat to under a rock in the garden once you notice thieves are checking the doormat. This would, in fact, appreciably increase house security on average, while still being STO.
- aidenn0 4y ago
  Upon further reflection, the question is "how hard is it to find the needle in the haystack" If you use a 128 bit key, but use a non-time-constant compare somewhere, then it's pretty darn easy to find the needle. This is why the JPEG fingerprinting example from TFA doesn't qualify to be in the same category as a properly secured cryptographic key. They can notice that non-picture posts are not blocked, but picture posts are, which already greatly narrows it down. They could post a picture generated from the actual client, and see it go through, and narrow it down even more. That's not even that hard of a one for an attacker to figure out. It's much closer to "key under doormat" than "random key"
- alecmuffett 4y ago
  I kinda agree (and I wrote the cited article) but as soon as you pick a number (2^40? 2^64? 2^80? 2^128?) you are painting a huge target on your forehead, when it's better to teach people that the point is the asymmetries (plural) and how you use, combine and compose them.
- brudgers 4y ago
  The degree of nuance in the parent comment is why I find informational asymmetry a useful way of understanding my frequent uneasy intuitions in discussions of security. What I mean is informational asymmetry frames security within engineering practice, though perhaps at a price of winning the internet. YMMV.

aidenn0 4y ago

Except the examples given of IA are so broad as to eliminate the distinction between IA and STO. Knowing a value that is in a space larger than 2^64 possibilities is qualitatively different than knowning something in a space of only millions of possibilities. The real difference with como is that it's a cat-and-mouse game (or Red Queens race as another commenter said). It's more like being able to teleport all the keys in all the houses from under the doormat to under a rock in the garden once you notice thieves are checking the doormat. This would, in fact, appreciably increase house security on average, while still being STO.

aidenn0 4y ago
Upon further reflection, the question is "how hard is it to find the needle in the haystack" If you use a 128 bit key, but use a non-time-constant compare somewhere, then it's pretty darn easy to find the needle. This is why the JPEG fingerprinting example from TFA doesn't qualify to be in the same category as a properly secured cryptographic key. They can notice that non-picture posts are not blocked, but picture posts are, which already greatly narrows it down. They could post a picture generated from the actual client, and see it go through, and narrow it down even more. That's not even that hard of a one for an attacker to figure out. It's much closer to "key under doormat" than "random key"
alecmuffett 4y ago
I kinda agree (and I wrote the cited article) but as soon as you pick a number (2^40? 2^64? 2^80? 2^128?) you are painting a huge target on your forehead, when it's better to teach people that the point is the asymmetries (plural) and how you use, combine and compose them.
brudgers 4y ago
The degree of nuance in the parent comment is why I find informational asymmetry a useful way of understanding my frequent uneasy intuitions in discussions of security. What I mean is informational asymmetry frames security within engineering practice, though perhaps at a price of winning the internet. YMMV.