5 ms·

Okay, here I go on a tangent: If I buy two 5-bay DROBOs, 10 2 TB HDs, and a hardware random number generator, I could make a multi-TB One Time Pad, and copy it

Okay, here I go on a tangent: If I buy two 5-bay DROBOs, 10 2 TB HDs, and a hardware random number generator, I could make a multi-TB One Time Pad, and copy it onto the second DROBO. I keep DROBO one, and physically carry DROBO two to my intended recipient. What are the problems with this? It's cheap. It's as secure as any communication could possibly be. It provides for a whole lot of communication, with relatively little physical effort.

tjoff 15y ago
You can't prove that you can trust the carrier. And with trust I not only mean that the carrier has good intentions but also that the carrier is physically unable to do any mistakes. Also you can't prove that someone doesn't sniff the traffic when you copy it to your second DROBO and you can't prove that none of the drives have been copied afterwards. Not saying that your approach isn't "secure enough" (I'd guess that's what they do on submarines?), but compared to (the theory of) quantum cryptography it has many flaws.
- VikingCoder 15y ago
  Thanks for the reply! > You can't prove that you can trust the carrier. I said that I physically carry DROBO two to my intended recipient. I can trust myself. > Also you can't prove that someone doesn't sniff the traffic when you copy it to your second DROBO and you can't prove that none of the drives have been copied afterwards. There is no such thing as secure communication. Copying data from one DROBO to another DROBO is about as secure as I could possibly imagine. Physical security is a failure point in any system. As much as I can trust my sending location, and my receiving location, I can trust this system. > compared to (the theory of) quantum cryptography it has many flaws. Compared to quantum cryptography: I can't prove that I trust the person who set up the quantum cryptography system. I can't prove that someone doesn't sniff my connection to my quantum key system. I can't prove that someone doesn't sniff the data coming out on the receiving end. I think this all boils down to physical security - which is a problem in any secure communication system. And I think my two DROBO, ten HD, one hardware random number generator, one round-trip plane ticket, system is about - mmm - 4 to 6 orders of magnitude cheaper.
  - ThomPete 15y ago
    Even if you carry it yourself then you don't necessarily know if it was used right?
    - VikingCoder 15y ago
      ...true of all cryptography systems. Meaning: my proposed system is no more or less vulnerable than any other, in this regard.
  - tjoff 15y ago
    True, if I'm allowed to treat the quantum crypto system as a black box mirroring the DROBOs should be considered a black box as well. But can you trust yourself to not take a large enough bribe? What if someone hold someone special in hostage? If you only have to convince yourself (quite limiting scenario) I see no, major, problem with your setup. This of course assuming you have eye-contact with the DROBO at all times etc. etc. Most scenarios however you can't have as much trust in the carrier as you have in yourself. But I agree. When reading quantum cryptography and its issues I often get the feeling that its all a bit silly. But I totally get the motivation about it, it's extremely enticing. However, I see why some likes to claim that quantum cryptography is just a way for physicists to get paid :P But there seems to be a market for it and I have no idea how far it can go.
junkbit 15y ago
If either side is compromised it is difficult to reissue (e.g. if they are undercover in another country). The beauty of public keys is that they can be revoked and the other side can use your new key without you having to transport/transmit a private key in peril.
- VikingCoder 15y ago
  This is a good point. A problem with public keys is that they rely on math that we presume is hard. One Time Pads do not depend on that.
mindslight 15y ago
I know it's right up there with the "Caesar Cipher" on the cuteness sale, but the "One Time Pad" shouldn't even be considered cryptography. The only thing it does is shift the secret in time, against a passive attacker.
aidenn0 15y ago
1) Your random number generator could be broken 2) I can flip bits in your message without you detecting it. 3) I can send random messages and get your receiver out of sync with you.
- VikingCoder 15y ago
  1) True. Buy a few of them, and XOR them all together. 2) I can always have a Message Digest of my message included. 3) If the Message Digest doesn't match, the message will not be accepted as valid. The receiver will not be out of sync.
  - tptacek 15y ago
    An encrypted SHA1 hash isn't a MAC. The protocol you outlined would be trivially breakable. You seem pretty smart; give it a few minutes thought and see if you can grok why.
    - VikingCoder 15y ago
      If it's trivially breakable, it should be trivial for you to explain how. Magic token, protocol identifier Location in key to use Length of message + salt MESSAGE - XORed against OTP Some salt is taken from the next bit of OTP. Hash of plaintext message If any of that portion of the OTP has been previously used, the message is invalid. If the hash doesn't match, the message is invalid. Under no circumstances is a new message valid if it uses a portion of the OTP that has been used before. I can't guarantee a message will arrive. I believe I am correct in thinking that all messages that arrive and pass these tests, have not been tampered with. If the keys are physically secure, the message is secure.
      - tptacek 15y ago
        If you found this protocol being used in an application you were testing, how would you go about tinkering with it to find attacks? I'm serious, not messing with you. What would be some things you would try to do to get the protocol to misbehave?
tptacek 15y ago
The problem with this is that it is unlikely to be in practical terms better than using two slips of paper to write down a 256 bit random number and using that to establish a long-lived AES-256-CTR session. (This is without getting into the fact that a single keystream is not a secure message exchange protocol, and that conventional cryptography has well-tested ways of linking confidentiality secrets to integrity secrets and of marshalling and canonicalizing messages; I'm just answering your question on its own terms). None of this has much to do with QC, by the way; as I understand it, QC replaces conventional number-theoretic public key crypto, not block and stream ciphers.
- VikingCoder 15y ago
  > a single keystream is not a secure message exchange protocol I have to build protocols around making sure to not re-use parts of my One Time Pad. Around making sure that I validate messages. Asking for a re-send of a message. Destroy the One Time Pad because it's been compromised, etc. But at it's core, using a One Time Pad is a secure message exchange protocol. I'm surprised to see you contradict that. > and that conventional cryptography has well-tested ways of linking confidentiality secrets to integrity secrets and of marshalling and canonicalizing messages I'm sorry - I don't know what you mean. Can you explain it to me more simply? Cryptotext = Plaintext XOR OneTimePad. Plaintext = Cryptotext XOR OneTimePad. As I said, I have a lot of work to do to handle my One Time Pad... But the fundamental mathematics are secure. And you seem to be saying they are not. What do you mean? > None of this has much to do with QC, Agreed - that's why I called it a tangent.
  - tptacek 15y ago
    The difference between a stream of bytes and a "message" is crucial, and if you don't understand it, the best reason you shouldn't do your Drobo OTP scheme is that you don't understand crypto well enough to implement any cryptosystem. Just use TLS. (I don't mean to be offensive. I don't understand bioinformatics, for instance, and probably shouldn't build mission critical things that rely on it.)
    - 15y ago

tjoff 15y ago

You can't prove that you can trust the carrier. And with trust I not only mean that the carrier has good intentions but also that the carrier is physically unable to do any mistakes. Also you can't prove that someone doesn't sniff the traffic when you copy it to your second DROBO and you can't prove that none of the drives have been copied afterwards. Not saying that your approach isn't "secure enough" (I'd guess that's what they do on submarines?), but compared to (the theory of) quantum cryptography it has many flaws.

VikingCoder 15y ago
Thanks for the reply! > You can't prove that you can trust the carrier. I said that I physically carry DROBO two to my intended recipient. I can trust myself. > Also you can't prove that someone doesn't sniff the traffic when you copy it to your second DROBO and you can't prove that none of the drives have been copied afterwards. There is no such thing as secure communication. Copying data from one DROBO to another DROBO is about as secure as I could possibly imagine. Physical security is a failure point in any system. As much as I can trust my sending location, and my receiving location, I can trust this system. > compared to (the theory of) quantum cryptography it has many flaws. Compared to quantum cryptography: I can't prove that I trust the person who set up the quantum cryptography system. I can't prove that someone doesn't sniff my connection to my quantum key system. I can't prove that someone doesn't sniff the data coming out on the receiving end. I think this all boils down to physical security - which is a problem in any secure communication system. And I think my two DROBO, ten HD, one hardware random number generator, one round-trip plane ticket, system is about - mmm - 4 to 6 orders of magnitude cheaper.
- ThomPete 15y ago
  Even if you carry it yourself then you don't necessarily know if it was used right?
  - VikingCoder 15y ago
    ...true of all cryptography systems. Meaning: my proposed system is no more or less vulnerable than any other, in this regard.
- tjoff 15y ago
  True, if I'm allowed to treat the quantum crypto system as a black box mirroring the DROBOs should be considered a black box as well. But can you trust yourself to not take a large enough bribe? What if someone hold someone special in hostage? If you only have to convince yourself (quite limiting scenario) I see no, major, problem with your setup. This of course assuming you have eye-contact with the DROBO at all times etc. etc. Most scenarios however you can't have as much trust in the carrier as you have in yourself. But I agree. When reading quantum cryptography and its issues I often get the feeling that its all a bit silly. But I totally get the motivation about it, it's extremely enticing. However, I see why some likes to claim that quantum cryptography is just a way for physicists to get paid :P But there seems to be a market for it and I have no idea how far it can go.

junkbit 15y ago

If either side is compromised it is difficult to reissue (e.g. if they are undercover in another country). The beauty of public keys is that they can be revoked and the other side can use your new key without you having to transport/transmit a private key in peril.

VikingCoder 15y ago
This is a good point. A problem with public keys is that they rely on math that we presume is hard. One Time Pads do not depend on that.

mindslight 15y ago

I know it's right up there with the "Caesar Cipher" on the cuteness sale, but the "One Time Pad" shouldn't even be considered cryptography. The only thing it does is shift the secret in time, against a passive attacker.

aidenn0 15y ago

1) Your random number generator could be broken 2) I can flip bits in your message without you detecting it. 3) I can send random messages and get your receiver out of sync with you.

VikingCoder 15y ago
1) True. Buy a few of them, and XOR them all together. 2) I can always have a Message Digest of my message included. 3) If the Message Digest doesn't match, the message will not be accepted as valid. The receiver will not be out of sync.
- tptacek 15y ago
  An encrypted SHA1 hash isn't a MAC. The protocol you outlined would be trivially breakable. You seem pretty smart; give it a few minutes thought and see if you can grok why.
  - VikingCoder 15y ago
    If it's trivially breakable, it should be trivial for you to explain how. Magic token, protocol identifier Location in key to use Length of message + salt MESSAGE - XORed against OTP Some salt is taken from the next bit of OTP. Hash of plaintext message If any of that portion of the OTP has been previously used, the message is invalid. If the hash doesn't match, the message is invalid. Under no circumstances is a new message valid if it uses a portion of the OTP that has been used before. I can't guarantee a message will arrive. I believe I am correct in thinking that all messages that arrive and pass these tests, have not been tampered with. If the keys are physically secure, the message is secure.
    - tptacek 15y ago
      If you found this protocol being used in an application you were testing, how would you go about tinkering with it to find attacks? I'm serious, not messing with you. What would be some things you would try to do to get the protocol to misbehave?

tptacek 15y ago

The problem with this is that it is unlikely to be in practical terms better than using two slips of paper to write down a 256 bit random number and using that to establish a long-lived AES-256-CTR session. (This is without getting into the fact that a single keystream is not a secure message exchange protocol, and that conventional cryptography has well-tested ways of linking confidentiality secrets to integrity secrets and of marshalling and canonicalizing messages; I'm just answering your question on its own terms). None of this has much to do with QC, by the way; as I understand it, QC replaces conventional number-theoretic public key crypto, not block and stream ciphers.

VikingCoder 15y ago
> a single keystream is not a secure message exchange protocol I have to build protocols around making sure to not re-use parts of my One Time Pad. Around making sure that I validate messages. Asking for a re-send of a message. Destroy the One Time Pad because it's been compromised, etc. But at it's core, using a One Time Pad is a secure message exchange protocol. I'm surprised to see you contradict that. > and that conventional cryptography has well-tested ways of linking confidentiality secrets to integrity secrets and of marshalling and canonicalizing messages I'm sorry - I don't know what you mean. Can you explain it to me more simply? Cryptotext = Plaintext XOR OneTimePad. Plaintext = Cryptotext XOR OneTimePad. As I said, I have a lot of work to do to handle my One Time Pad... But the fundamental mathematics are secure. And you seem to be saying they are not. What do you mean? > None of this has much to do with QC, Agreed - that's why I called it a tangent.
- tptacek 15y ago
  The difference between a stream of bytes and a "message" is crucial, and if you don't understand it, the best reason you shouldn't do your Drobo OTP scheme is that you don't understand crypto well enough to implement any cryptosystem. Just use TLS. (I don't mean to be offensive. I don't understand bioinformatics, for instance, and probably shouldn't build mission critical things that rely on it.)
  - 15y ago