4 ms·

If you're trying to use brute force to break this system it's important to realise that the search space is not all possible hashes. The search space is all lik

by sjducb 4y ago

If you're trying to use brute force to break this system it's important to realise that the search space is not all possible hashes. The search space is all likely names. This makes it trivial to break, especially for the CIA case where there are really only a few hundred likely adversaries. The encryption/hashing doesn't really add anything beyond empty marketing. The trusted party who ppl report to could easily work out all of the names of they wanted to.

mattdesl 4y ago
Depends on how the database and application was set up. In a properly formed ZK application you cannot obtain any reasonable information by brute force hashing names. Edit: I realize you’re probably talking about Callisto which does seems like simple hashing of names, but I wanted to note that this is not always the case in apps using ZK proofs and FHE which the article touches on a bit later.
franknstein 4y ago
This is common misconception. The truth is that in HE every plaintext can be encrypted to (exponentially iirc) many different ciphertexts. During encryption one of those is chosen randomly. This makes dictionary attacks practically impossible. Edit: HE scheme (lwe) works on individual bits. Meaning there are only two plaintexts (0,1). Each has exponentially many ciphertexts, only one chosen at random. They also share ciphertext space, meaning each ciphertext could be either encrypted zero or one.
- sjducb 4y ago
  Maybe I'm missing something, but surely a dictionary based attack will work because you have to be able to know that your key has already been submitted by another user. That's the point of the application. 1) Initial report is filed. 2) Second report is filed by a user who only knows the attackers details. 3) Match is found Therefore you can just keep iterating through names till you get a match. Another way of saying it is that the application won't work if a second user can't tell that the first user has entered an attackers name. The vulnerability is in the application specification, not HE.

by sjducb 4y ago

mattdesl 4y ago

Depends on how the database and application was set up. In a properly formed ZK application you cannot obtain any reasonable information by brute force hashing names. Edit: I realize you’re probably talking about Callisto which does seems like simple hashing of names, but I wanted to note that this is not always the case in apps using ZK proofs and FHE which the article touches on a bit later.

franknstein 4y ago

This is common misconception. The truth is that in HE every plaintext can be encrypted to (exponentially iirc) many different ciphertexts. During encryption one of those is chosen randomly. This makes dictionary attacks practically impossible. Edit: HE scheme (lwe) works on individual bits. Meaning there are only two plaintexts (0,1). Each has exponentially many ciphertexts, only one chosen at random. They also share ciphertext space, meaning each ciphertext could be either encrypted zero or one.

sjducb 4y ago
Maybe I'm missing something, but surely a dictionary based attack will work because you have to be able to know that your key has already been submitted by another user. That's the point of the application. 1) Initial report is filed. 2) Second report is filed by a user who only knows the attackers details. 3) Match is found Therefore you can just keep iterating through names till you get a match. Another way of saying it is that the application won't work if a second user can't tell that the first user has entered an attackers name. The vulnerability is in the application specification, not HE.