4 ms·

Cyphers, the algorithms used to encrypt the secret file, become obsolete over time. We still need to solve for obsolescence. You can encrypt a file today using

Cyphers, the algorithms used to encrypt the secret file, become obsolete over time. We still need to solve for obsolescence. You can encrypt a file today using a cypher that will eventually be removed from all browsers, desktops, and phones.

theamk 4y ago
I guess this is a downside of the browsers. If I want to run ancient app (MS-DOS or even ZX Spectrum), there are plenty of well supported modern emulators. But a 5 year browser with feature removed for security reasons like Flash? That's much harder.
mprime1 4y ago
2 sides of obsolescence: - Too old, no software can decrypt it: not worried about this. These are NIST-standard algorithms, there built-in in most programming languages, they'll be around for a while - Too old, trivial to crack: this is a bit more concerning to me. It's possible that some entities around the world can already crack this encryption in minutes/hours days Regarding the second, I'm already working on an Elliptic Curve version of this.
- Kon-Peki 4y ago
  Well, your cipher text could decrypt to a non-published URL that has some cipher text which decrypts to another non-published URL (as many layers of indirection that you need), with the final non-published URL containing the actual cipher text you wanted to decrypt. You can check server logs to see if those URLs are ever hit. And if you ever need to, you can abandon the original link after changing what those non-published URLs point to (something "fun", like a rickroll perhaps). In fact, how about using the Wayback Machine to store a bunch of versions of the static page, each containing different versions of the cipher text. Only you know which date range contains the proper cipher text!
  - mprime1 4y ago
    Genius. As the old adage says 'any problem can be resolved by adding one more layer of indirection'.
falcolas 4y ago
I'd argue this isn't a cryptography problem, or at least not a purely cypto problem. Because we have the exact same issues with almost all file formats and storage mediums. It requires a maintenance toil task to make the occasional conversion from unsupported cyphers to supported cyphers. Maybe the page needs a second button and JS function - re-encrypt.
tomjen3 4y ago
The code uses AES. Likely that will remain for longer than most secrets are relevant.
maqp 4y ago
XChaCha20-Poly1305 will probably never go out of fashion. Argon2 is only making itself in, phasing it out will take decades. OTOH you have a point in that the author's implementation PBKDF2 is being used, and that should already have retired a decade ago.

theamk 4y ago

I guess this is a downside of the browsers. If I want to run ancient app (MS-DOS or even ZX Spectrum), there are plenty of well supported modern emulators. But a 5 year browser with feature removed for security reasons like Flash? That's much harder.

mprime1 4y ago

2 sides of obsolescence: - Too old, no software can decrypt it: not worried about this. These are NIST-standard algorithms, there built-in in most programming languages, they'll be around for a while - Too old, trivial to crack: this is a bit more concerning to me. It's possible that some entities around the world can already crack this encryption in minutes/hours days Regarding the second, I'm already working on an Elliptic Curve version of this.

Kon-Peki 4y ago
Well, your cipher text could decrypt to a non-published URL that has some cipher text which decrypts to another non-published URL (as many layers of indirection that you need), with the final non-published URL containing the actual cipher text you wanted to decrypt. You can check server logs to see if those URLs are ever hit. And if you ever need to, you can abandon the original link after changing what those non-published URLs point to (something "fun", like a rickroll perhaps). In fact, how about using the Wayback Machine to store a bunch of versions of the static page, each containing different versions of the cipher text. Only you know which date range contains the proper cipher text!
- mprime1 4y ago
  Genius. As the old adage says 'any problem can be resolved by adding one more layer of indirection'.

falcolas 4y ago

I'd argue this isn't a cryptography problem, or at least not a purely cypto problem. Because we have the exact same issues with almost all file formats and storage mediums. It requires a maintenance toil task to make the occasional conversion from unsupported cyphers to supported cyphers. Maybe the page needs a second button and JS function - re-encrypt.

tomjen3 4y ago

The code uses AES. Likely that will remain for longer than most secrets are relevant.

maqp 4y ago

XChaCha20-Poly1305 will probably never go out of fashion. Argon2 is only making itself in, phasing it out will take decades. OTOH you have a point in that the author's implementation PBKDF2 is being used, and that should already have retired a decade ago.