5 ms·

If you and your group chat friends can meet up in person once to input an agreed upon a ~1Gb one-time-pad then you can exchange uncrackable text messages for ye

If you and your group chat friends can meet up in person once to input an agreed upon a ~1Gb one-time-pad then you can exchange uncrackable text messages for years on any insecure channel I’ve long felt that this is the ideal solution for anything super super secret

layer8 4y ago
Everyone in that group also has to manage to keep that 1 GB secret.
- kragen 4y ago
  also how do you ensure the messages haven't been corrupted in transit
  - layer8 4y ago
    You can never ensure that your communication channel isn’t corrupted. But with a one time pad you’ll just receive unreadable garbage then. You‘re also free to sign messages before encryption.
    - kragen 4y ago
      if an adversary xors their guess of part of your message (a crib) and what they want it to say with the one-time-pad ciphertext, they can make it say what they want if the guess is right; this is a general vulnerability with unauthenticated stream ciphers if they guess wrong, there's a little unreadable garbage in the message, but in many scenarios they only have to guess right once so you need some kind of message authenticator like hmac or poly1305, but as i understand it, these lack the absolute security guarantee of a one-time pad
      - acc_297 4y ago
        Good point I guess that’s the same as the “heil h**er” vulnerability Maybe some kind of low density salting would make messages hard to guess but not too hard to read
  - jancsika 4y ago
    1. For each letter of the plaintext, concatenate "dontcorruptmebro" 2. Grab 17 letters from the pad (I'm assuming pad means the randomly chosen letters that make up the 1 gigabyte of shared secret among the participants) 3. Convert the first letter of the pad to a number (let's say 1-26) 4. Right-shift the message by that amount and let the letters wrap around: e.g., if the plaintext letter is g and we're shifting by 1 the plaintext becomes "ogdontcorruptmebr" 5. Encrypt with pad (not a cryptographer, but I'm assuming this means adding a character of the shared secret with a character of the plaintext, and wrapping around if it goes past the end) 6. Send 7. Decrypt with pad 8. Left-shift and wrap by $first_pad_letter_value (i.e., the same value we used to right-shift and wrap above) 9. Remove the "dontcorruptmebro" part to concatenate the plaintext letters to reveal the original message 10. Rinse and repeat, and do whatever secure messengers do if/when you receive a part of the "dontcorruptmebro" that isn't "dontcorruptmebro" I only thought about this for a few minutes, and I'm not a cryptographer. So I'm honestly asking-- did I solve the corruption-in-transit problem without screwing up anything? Edit: just to be clear-- I'm not trying to be efficient, or to authenticate, or do anything whatsoever other than a dead simple thing that can be implemented easily. Edit 2: clarification
    - kragen 4y ago
      not sure; i think this just means the attacker has to guess one letter of the pad in addition to the crib, so (with your example alphabet) they need 26× as many tries to get a corrupted message through
- acc_297 4y ago
  I mean if a Roman general could…
  - layer8 4y ago
    1 GB?
    - SamBam 4y ago
      The size is fairly irrelevant. 1 GB fits on a microSD card many times smaller than a Roman General's hand-written cypher.
      - aardvark179 4y ago
        True, but it can be copied and returned quickly without the victim knowing, and you have to trust every device you put that SD card into to read the pad.
      - layer8 4y ago
        How do you handle that SD card in practice to do your communication? My point is, if anyone is on to you and can physically get to you (or anyone else in the group), there is a high risk they can get hold of the data.
        orangepurple 4y ago
        That's why you put it behind a secret menu in an iPod https://tidbits.com/2020/08/17/the-case-of-the-top-secret-ipod/ https://tidbits.com/2020/08/17/the-case-of-the-top-secret-ip...
lostmsu 4y ago
That actually makes a lot of sense. Matrix should add it as a feature.
- wkat4242 4y ago
  There's too many practical drawbacks. For example you have to send the OTP without getting it intercepted. How do you do that? It also has to be truly random. You can't pick a page from a book or anything, that undermines the whole model and makes cryptanalysis possible. It's useful but only in very specific cases. Mostly it's just a paradigm in cryptography. Note that for all its fame as unbreakable it does lack perfect forward secrecy so anyone getting a hold of it from any of the participants can read their intercepts from all the way back.
  - lostmsu 4y ago
    Sitting in a cafe almost an entire week later: oh, but it does have perfect forward secrecy, as long as you discard the beginning of the pad as soon as you use it (which is actually strictly better than passing a temporary key over a potentially decryptable channel, and then discarding it after session ends). If I correctly understand what perfect forward secrecy is.

layer8 4y ago

Everyone in that group also has to manage to keep that 1 GB secret.

kragen 4y ago
also how do you ensure the messages haven't been corrupted in transit
- layer8 4y ago
  You can never ensure that your communication channel isn’t corrupted. But with a one time pad you’ll just receive unreadable garbage then. You‘re also free to sign messages before encryption.
  - kragen 4y ago
    if an adversary xors their guess of part of your message (a crib) and what they want it to say with the one-time-pad ciphertext, they can make it say what they want if the guess is right; this is a general vulnerability with unauthenticated stream ciphers if they guess wrong, there's a little unreadable garbage in the message, but in many scenarios they only have to guess right once so you need some kind of message authenticator like hmac or poly1305, but as i understand it, these lack the absolute security guarantee of a one-time pad
    - acc_297 4y ago
      Good point I guess that’s the same as the “heil h**er” vulnerability Maybe some kind of low density salting would make messages hard to guess but not too hard to read
- jancsika 4y ago
  1. For each letter of the plaintext, concatenate "dontcorruptmebro" 2. Grab 17 letters from the pad (I'm assuming pad means the randomly chosen letters that make up the 1 gigabyte of shared secret among the participants) 3. Convert the first letter of the pad to a number (let's say 1-26) 4. Right-shift the message by that amount and let the letters wrap around: e.g., if the plaintext letter is g and we're shifting by 1 the plaintext becomes "ogdontcorruptmebr" 5. Encrypt with pad (not a cryptographer, but I'm assuming this means adding a character of the shared secret with a character of the plaintext, and wrapping around if it goes past the end) 6. Send 7. Decrypt with pad 8. Left-shift and wrap by $first_pad_letter_value (i.e., the same value we used to right-shift and wrap above) 9. Remove the "dontcorruptmebro" part to concatenate the plaintext letters to reveal the original message 10. Rinse and repeat, and do whatever secure messengers do if/when you receive a part of the "dontcorruptmebro" that isn't "dontcorruptmebro" I only thought about this for a few minutes, and I'm not a cryptographer. So I'm honestly asking-- did I solve the corruption-in-transit problem without screwing up anything? Edit: just to be clear-- I'm not trying to be efficient, or to authenticate, or do anything whatsoever other than a dead simple thing that can be implemented easily. Edit 2: clarification
  - kragen 4y ago
    not sure; i think this just means the attacker has to guess one letter of the pad in addition to the crib, so (with your example alphabet) they need 26× as many tries to get a corrupted message through
acc_297 4y ago
I mean if a Roman general could…
- layer8 4y ago
  1 GB?
  - SamBam 4y ago
    The size is fairly irrelevant. 1 GB fits on a microSD card many times smaller than a Roman General's hand-written cypher.
    - aardvark179 4y ago
      True, but it can be copied and returned quickly without the victim knowing, and you have to trust every device you put that SD card into to read the pad.
    - layer8 4y ago
      How do you handle that SD card in practice to do your communication? My point is, if anyone is on to you and can physically get to you (or anyone else in the group), there is a high risk they can get hold of the data.
      - orangepurple 4y ago
        That's why you put it behind a secret menu in an iPod https://tidbits.com/2020/08/17/the-case-of-the-top-secret-ipod/ https://tidbits.com/2020/08/17/the-case-of-the-top-secret-ip...

lostmsu 4y ago

That actually makes a lot of sense. Matrix should add it as a feature.

wkat4242 4y ago
There's too many practical drawbacks. For example you have to send the OTP without getting it intercepted. How do you do that? It also has to be truly random. You can't pick a page from a book or anything, that undermines the whole model and makes cryptanalysis possible. It's useful but only in very specific cases. Mostly it's just a paradigm in cryptography. Note that for all its fame as unbreakable it does lack perfect forward secrecy so anyone getting a hold of it from any of the participants can read their intercepts from all the way back.
- lostmsu 4y ago
  Sitting in a cafe almost an entire week later: oh, but it does have perfect forward secrecy, as long as you discard the beginning of the pad as soon as you use it (which is actually strictly better than passing a temporary key over a potentially decryptable channel, and then discarding it after session ends). If I correctly understand what perfect forward secrecy is.