6 ms·

You're right; I misread your construct as KC(CC(P)). Your construct [CC(KC(P))] shouldn't be weaker than KC, unless information or resources are shared by CC an

by kelson 11y ago

You're right; I misread your construct as KC(CC(P)). Your construct [CC(KC(P))] shouldn't be weaker than KC, unless information or resources are shared by CC and KC (such as keys). Shared information or resources may introduce side channel attacks. Per the previous link, this is likely only practicable on entirely separate machines. Any entity that can break AES at-scale will undoubtedly find any unreviewed cryptographic protocol trivial to break. Any such at-scale effort would already include attacks against typical bad-custom-crypto (because they're extremely easy and common), in addition to the AES attacks. Cascading ciphers, particularly weak ones, will not stop the NSA. edit: addressed information leak if CC & KC share keys/resources

madez 11y ago
Thanks for agreeing that we don't lose security when using my construct. > Any entity that can break AES at-scale will undoubtedly find any unreviewed cryptographic protocol trivial to break. Yes, but it would involve highly paid cryptoanalysts. The reason for my first comment is first of all to disprove the root of this thread. Secondly, it makes surveillance more expensive while it's free for us.
- kelson 11y ago
  > Thanks for agreeing that we don't lose security when using my construct. I don't agree. The construct may not degrade security under several caveats. Most implementations are extremely likely to share resources, which will introduce weaknesses. I'd wager those weaknesses would degrade security much more than the composition would enhance it, but it'd depend on the exact situation. > Yes but it would involve highly paid cryptoanalysts. My proposal is first of all to disprove the root of this thread. Secondly, it makes surveillance more expensive while it's free for us. That what's cryptography all about. Making their life harder while not so much for us. My exact point was that those cryptographers would already need to develop generic attacks for all the non-standard (read: non-secure) cryptosystems out there. Composing a homegrown cipher with a peer-reviewed secure cipher will not make their lives harder. It will make maintaining and improving the system harder. The net result is overwhelmingly likely to be detrimental.
  - madez 11y ago
    We don't agree on the effectiveness of security through obscurity.
  - angry_octet 11y ago
    And it has the added benefit from the NSA's point of view that your connection/data is precisely fingerprinted as 'homebrew-crypto-1629: refer to analysis cell 2865JQ'. Then the computer is sub basement 19 goes 'ding!' and sends an automated SWAT team to your house.
    - madez 11y ago
      To fingerprint the connection/data by the used cipher they would need to break KC. If they are able to break KC they can fingerprint you also when you only use KC.
      - im3w1l 11y ago
        The output of KC is not necessarily completely random. It can contain some metadata. Like "encrypted with KC4096bits, initialization vector is 490282348992489, length of ciphertext is 26728 bytes". When you pass this through a bad cipher it may create a characteristic fingerprint.
        madez 11y ago
        I think you confuse cipher with protocol. To make it clear: for me a cipher is a bijective function on arrays of a predefined length.
        im3w1l 11y ago
        What do you propose doing with the initialization vectors then? Afaik, all commonly used encryption algorithms have those, for good reason too.
      - angry_octet 11y ago

by kelson 11y ago

madez 11y ago

Thanks for agreeing that we don't lose security when using my construct. > Any entity that can break AES at-scale will undoubtedly find any unreviewed cryptographic protocol trivial to break. Yes, but it would involve highly paid cryptoanalysts. The reason for my first comment is first of all to disprove the root of this thread. Secondly, it makes surveillance more expensive while it's free for us.

kelson 11y ago
> Thanks for agreeing that we don't lose security when using my construct. I don't agree. The construct may not degrade security under several caveats. Most implementations are extremely likely to share resources, which will introduce weaknesses. I'd wager those weaknesses would degrade security much more than the composition would enhance it, but it'd depend on the exact situation. > Yes but it would involve highly paid cryptoanalysts. My proposal is first of all to disprove the root of this thread. Secondly, it makes surveillance more expensive while it's free for us. That what's cryptography all about. Making their life harder while not so much for us. My exact point was that those cryptographers would already need to develop generic attacks for all the non-standard (read: non-secure) cryptosystems out there. Composing a homegrown cipher with a peer-reviewed secure cipher will not make their lives harder. It will make maintaining and improving the system harder. The net result is overwhelmingly likely to be detrimental.
- madez 11y ago
  We don't agree on the effectiveness of security through obscurity.
- angry_octet 11y ago
  And it has the added benefit from the NSA's point of view that your connection/data is precisely fingerprinted as 'homebrew-crypto-1629: refer to analysis cell 2865JQ'. Then the computer is sub basement 19 goes 'ding!' and sends an automated SWAT team to your house.
  - madez 11y ago
    To fingerprint the connection/data by the used cipher they would need to break KC. If they are able to break KC they can fingerprint you also when you only use KC.
    - im3w1l 11y ago
      The output of KC is not necessarily completely random. It can contain some metadata. Like "encrypted with KC4096bits, initialization vector is 490282348992489, length of ciphertext is 26728 bytes". When you pass this through a bad cipher it may create a characteristic fingerprint.
      - madez 11y ago
        I think you confuse cipher with protocol. To make it clear: for me a cipher is a bijective function on arrays of a predefined length.
        im3w1l 11y ago
        What do you propose doing with the initialization vectors then? Afaik, all commonly used encryption algorithms have those, for good reason too.
    - angry_octet 11y ago