The DMZ

AviD

20:00

not quite airborne, but still....

Scott Pack

Wow, I guess.

I feel like I should say something, but I can't possibly imagine what.

AviD

@ScottPack i know, right?

nealmcb

@Iszi I figure the question makes sense if it is about capture-the-flag or the like

this.josh

plausable deniability is often used for, how should I put it, legal matters. Plausible deniability is a logical argument that prevents the assignment of blame or consequences.

AviD

@thisjosh right. basically, its the flip side of non-repudiation.

very semantically so.

though perhaps one is more technical, and the other is more legal/argument

Stefano Palazzo

20:04

mh. that got me thinking

this.josh

Plausible deniability is not going to convince the mob boss that you didn't steal his money regardless of how well the logic is explained.

Stefano Palazzo

I'm using OTR to communicate with someone. It'd be nice to have a special message that you can send that triggers a distress alarm on the other end, like "I'm being coerced into sending this message, don't trust its content"

AviD

@thisjosh good point.

@StefanoPalazzo how bout... "HELP!!!"

ahh, thats what you mean.

Scott Pack

Or, 'See the violence inherent in the system!'

this.josh

@Stefano you are looking for covert communication

AviD

20:06

someone a while ago (I think it may have been @nealmcb?) suggested using a different private key, used only for distress situations.

Stefano Palazzo

Mh I can't find anything related there

just this, seems to be unrelated:

> Steganography is the science of hidden writing, or using a covert communications channel that is totally visible — yet “unseen” — by a third party.

this.josh

interesting problem, signaling coerced communication. I would think that you would want the signal to be in-band

Stefano Palazzo

yes

as normal as possible. Only the client software at the other end should be able to detect the signal

I suppose :)

this.josh

I assume that the trigger mechanism must be subtle such that an observer would not be able to detect it, but require an overt action such that the sender does not accidently trip the mechanism

Stefano Palazzo

Shouldn't that be just as simple as sending a hash of your secret distress message to the other party, at the start of the conversation?

this.josh

20:11

quite contradictory

Stefano Palazzo

@thisjosh I'm thinking of a specified message that you know. Such as "Hello may I talk to you at this time" ← which would be an example of something I'm unlikely to type

this.josh

That might work as long as you are the only one who has access to the transmitter and a coercer is not dictating the message.

Stefano Palazzo

true, It'd be useless then.

I will ask a question on the site, why not

this.josh

No, you want a mechanism that you can trigger even if the coercer dictates the message.

Stefano Palazzo

yeah that's what I was responding to :)

the big flaw in my idea

this.josh

20:16

Something like typing the third word incorrectly and then deleting it and retyping it correctly.

Stefano Palazzo

thats a good call, but also fairly easy to do by mistake

AviD

@thisjosh sounds like a violation of kerkchoff's law.

Stefano Palazzo

then you'd have to go through the whole business of authenticating again (which would defeat the point of OTR being so easy to use)

this.josh

Yes @AviD, but the problem is the perform a signaling action while being observed without the observer detecting the signaling.

@AviD notice where I said 'the trigger mechanism must be subtle such that an observer would not be able to detect it, but require an overt action such that the sender does not accidently trip the mechanism'

AviD

@thisjosh of course. but I'm sure we should be able to figure out a protocol, that is secure even in the face of the attacker knowing the protocol

this.josh

20:21

btw how do you link to a previous chat line?

AviD

@thisjosh agree that

@thisjosh link == reply or quote?

this.josh

either

AviD

reply: theres a little arrow on the right corner, when you hover over a message.

this.josh

@AviD like this?

AviD

quote: you just paste the permalink.
like so:

1 min ago, by this.josh

btw how do you link to a previous chat line?

@thisjosh by jove I think she's got it!

for quoting it needs to be on its own line, for onebox effect.

for either, you can get it from the little popup menu for the message...

this.josh

20:23

testing permalink: chat.stackexchange.com/transcript/message/1346060#1346060

Iszi

Just in case anyone's interested, the Amateur Radio proposal on Area 51 is finally in the Commitment phase.

area51.stackexchange.com/proposals/1795/…

Scott Pack

@thisjosh One-Boxing must be on it's own line

Iszi

@thisjosh It only works if you post only the link.

this.josh

test

1 min ago, by AviD

quote: you just paste the permalink.
like so:

AviD

@RebeccaChernoff any response to my owasp meta q?

Stefano Palazzo

20:24

Mh.. there could be a protocol that triggers a signal when you fail to do something (well, it'd have to be unique so that the attacker doesn't know what it is, not the best idea I guess)

Iszi

@HendrikBrummermann Huh? I'm not quite sure what you're referring to.

AviD

@StefanoPalazzo but if they know the protocol, they can force you to do it.

Stefano Palazzo

absolutely, yeah.

this.josh

or not do it

AviD

that's why I like @nealmcb's idea, e.g. they force you to sign it with your private key, but they dont know which is the real one.

Stefano Palazzo

20:26

also, the usability people would not like it :)

Rebecca Chernoff

@AviD I'll raise it on our weekly call.

AviD

though, I suppose even that could be overcome by examining previous communications....

@RebeccaChernoff thanks!

Stefano Palazzo

I suppose you could have a hidden distress button, just like they have in banks - but that's hard to do in software :P

Iszi

@HendrikBrummermann Nevermind. I think I got it now. Sometimes it's just tricky to parse references to parts of a conversation that happened hours ago.

this.josh

@AviD are you propoing that the trigger is part of the protocol

Iszi

20:29

...and, while I'm catching up on my Inbox, it seems I'm missing some interesting discussion...?

AviD

@thisjosh protocol, I meant "security protocol", not "network protocol".

@Iszi strange, right? security talks are only 4th or 5th on our list of preferred topics!

Iszi

@AviD Exactly. That's why this was totally unexpected!

Scott Pack

@AviD We haven't talked about food or drink since yesterday (that I can think of)

AviD

@ScottPack speaking of which, I am quite hungry. I think its dinner time.

this.josh

@AviD Yea I understand that, but I don't think that a trigger is necessarily part of a protocol. Clicking a send button on a web page isn't part of http.

AviD

20:31

and just to round it out, I'm gonna need a whiskey to get me through the piles of fortify crap I have waiting for me tonight...

Scott Pack

@AviD Getting pretty close for me too. I don't know what I'm having for dinner, but I do know that I'm taking a 5L keg to the gaming table tonight.

Hendrik Brummermann

@Iszi Sorry, i was not able to reply to your message. I saw it in the drop down notification list, but it opened another window without chat box and without reply arrow.

AviD

@thisjosh um Im not sure I'm understanding you? the trigger is the protocol.

@ScottPack oo niiice

what flavor?

Stefano Palazzo

> I could dispatch a distress call through the computer... Lynn glanced at her
screen from afar and saw that her backup had been completed, immedi-
ately embarrassed that she had cared about the backup at all. Always the
scientist. Some strange loony in your room and you think about your data.
Clever. Darwin Award, here I come. (from 'Schemata', by Michael Markefka)

Scott Pack

@AviD Newcastle. Nothing fancy, but for the kegerator our host has it's either that or Heineken.

AviD

20:34

@ScottPack ehh. Dont know newcastle, but I'm sure its better than heineken.

this.josh

@AviD I don't see it that way

Iszi

@HendrikBrummermann There's a trick to that. Copy the permalink, nuke everything but the last string of numbers, put a colon in front of it and then a space and your reply behind it.

AviD

not that its bad, per se, but not my favorite....

Scott Pack

@AviD It's a mass produced English brown ale.

AviD

wouldnt that make it a lager?

Scott Pack

20:35

@Iszi Or you hover over the message, and click the 'reply' arrow on the right hand side

@AviD No, because it's an ale :)

Iszi

@HendrikBrummermann Example...
For permalink: `http://chat.stackexchange.com/transcript/message/1346182#1346182`
Reply like so: `:1346182 This is my reply`

this.josh

I think of a protocol as a set of rules regarding the passing of messages and the setting of states after receiving messages.

Iszi

@ScottPack Doesn't work if you're trying to reply to a message from an older log.

Odd. MarkDown didn't parse my back-ticks there.

Scott Pack

@Iszi From the transcripts? I could believe that, I haven't tried that before.

AviD

@thisjosh okay, right... so, isnt the "trigger" just a definition of what messages to pass?

Iszi

20:36

@ScottPack It's an annoyance.

AviD

or did you mean an actual trigger??

Stefano Palazzo

the protocol without any trigger is pretty trivial :)

this.josh

I meant overt action taken by the message sender to invoke the part of the protocol that sends the message 'I'm being coerced' within the normal message passing.

nealmcb

Japan beats Sweden, so it's US-Japan on Sunday....

Stefano Palazzo

you just have to make the distress-message look like any other message, so that a MITM can't filter it (if we're thinking of unlikely scenarios anyway)

this.josh

20:39

Not so unlikely @Stefano

AviD

@thisjosh ah now I see - we are talking about different things. In my mind, the protocol may not require a special message - but a different form of message. e.g. different signage.

anyway, the overt action would have to be part of the protocol, thats what its defining, no?

Stefano Palazzo

the distress-protocol, whatever trigger it uses, it has to be designed to be easy to trigger

this.josh

It is quite easy to add a protocol analyzer to most common communications channels.

Stefano Palazzo

so maybe it's really more of a user-interface question

this.josh

Yes, I'm separating the problem into parts. I assume that the coercer is observing the sender. The sender is sending a message using a method known well to the coercer.

AviD

20:43

@thisjosh and, the coercer is familiar with the protocol ;)

this.josh

The sender must perform an action to invoke a protocol which signals to the message receiver that the sender is being coerced.

AviD

dont forget kerckoff...

@thisjosh without the coercer knowing, even though he's looking for it.

this.josh

precisely!

AviD

hmm... can we assume greenfield?

this.josh

Think of a coercer forcing someone to phone their bank to transfer a large sum of money.

AviD

20:45

no, that wouldnt make sense...

e.g. calling from the wrong phone number.

this.josh

Greenfield?

AviD

i.e. no prior history of communications.

Stefano Palazzo

@AviD I'd rather not, let's assume we design an add-on to the OTR plugin

oh I misunderstood, never mind

this.josh

Do you think that is out of band?

AviD

like e.g. with the bank, someone can peruse the phone records, to see if the wrong # was used before.

@thisjosh no, I think it defines the band.

this.josh

20:47

Yes, the coercer is going to be looking for the sender to signal distress

AviD

@thisjosh not only that, the coercer knows how the sender is supposed to signal distress.

this.josh

So a sophisticated coercer who is analyzing the message must not be able to detect the message

Iszi

Holy crap, the chat is busy today. And on-topic. Who knew this would happen just from the site graduating?

AviD

@Iszi LOL!!

I blame @StefanoPalazzo

i.e. the protocol encapsulates down to a small secret, or key.

Stefano Palazzo

I'll not take credit for that :-) It's your awesome design and, more importantly, the content it's makes me want to look at

AviD

20:49

i.e. Kerchkoff's Law! :)

this.josh

i.e. If the coercer has a network analyzer of the cat5e coming out of your computer they better not see 'I'm being coerced' in the plaintext

AviD

@thisjosh and, if you suddenly start talking about "popcorn" or "bananas" it better be ontopic.

Stefano Palazzo

if you put it like this, it's very hard indeed.

this.josh

Yes, and the smaller it is the less detectable it is, but the smaller it is the more error prone it may be.

Stefano Palazzo

you could imagine something like ending a sentence with the letter Q. but that doesn't work when the attacker is looking for a distress signal, even though there are millions of variations on that method, of which you could negotiate one at the start of the conversation

this.josh

20:51

@AviD bingo! The coercer is expecting the sender to send a covert signal.

So the coercer can not observe the sender initiating the signal, i.e pressing some complicated keyboard sequence you would not normally see

AviD

i think now you have the basis for a meaty question. why dont you pop it up, see who throws a cat at the flagpole?

there might already be answers to this.

Stefano Palazzo

It's a bit open ended but I will, yes

AviD

my money is on either @ThomasPornin or @bethlakshmi...

nealmcb

@AviD [hmm - which is this link?]

AviD

@nealmcb no? what?

this.josh

20:54

Verry difficult, preventing the coercer from noticing the 'triggering', hiding the message in the transmission, preventing accidental triggering, and preventing error from destroying the message before getting to the sender.

nealmcb

I wish there was an easier workflow while reading a long backlog for keeping track of what I want to reply to (but not replying until I learn whether others ahve replied....)

AviD

@nealmcb oh yeah. I usually read only during the day, and answer (wall o' text) at night...

@thisjosh throw in a log of previous communications for comparison, if we're talking APT.

nealmcb

@AviD That may refer to some technique in steganography and file encryption where you have multiple options, or hidden files within hidden files

Stefano Palazzo

uhm, what are good tags for this?

intrusion and authentication?

AviD

@nealmcb ah, yeah, that could be it...

this.josh

20:57

@AviD Yes, but I was thinking more generally. I am sure another carrier protocol could be used it it worked better with that.

AviD

@StefanoPalazzo i would say more physical than intrusion.

this.josh

[confidentiality]

AviD

privacy?

Stefano Palazzo

I can't create tags despite my blue username :)

AviD

@thisjosh put in a [tag: ...

Stefano Palazzo

20:58

People will find the edit button :)

0

Q: What's a good way to trigger a hidden 'distress signal' in instant messaging?

Here's the scenario: Alice and bob use Off-the-record messaging to communicate over IM. The have: Encryption Authentication Deniability Perfect forward secrecy They communicate after authenticating, being reasonably sure of each others identity. Now a rouge party breaks into Alice's house. ...

also, add your possible problems and things to consider to the question

AviD

@StefanoPalazzo wait, what does blue mean??

Stefano Palazzo

you never noticed? :D

this.josh

humm.. no tag for confidential or confidentiality

Stefano Palazzo

means you are a moderator "somewhere" (and therefore a mod of the chat system)

AviD

@StefanoPalazzo why dont you copy (and filter) most of this discussion? better yet, just link to it, and copy the important points.

@StefanoPalazzo huh. no, never looked.

cool!

@thisjosh how bout government.... ? ;)

this.josh

21:02

coercer-self?

[tag:this-tag-means-I'm-being-coerced]

and where is [tag: recursive] ?

Rory Alsop

@AviD Cheers - but Benjamins? Charlies? What on earth?

Stefano Palazzo

I linked a bookmark of the transcript. but I don't expect anyone to read it, it's massive

AviD

@RoryAlsop heh... no. 6 and 7 on our list of favorite topics, no...? ;)

for the record, I read the whole conversation. well, most of it.

Stefano Palazzo

quick question: If I am having an encrypted conversation (with all the stuff I mentioned in the distress question), can I use that channel to then exchange a shared secret, in order to make the next authentication easier?

(you can authenticate each other by asking a question of the other person, a zero knowledge proof of a shared secret, or by accepting a fingerprint like SSH)

AviD

i dont follow the connection?

maybe cuz I'm already thinking about food.

Stefano Palazzo

21:12

I explained it badly

this.josh

We need a place to collect quotes, I just found this one "Cryptography is nothing more than a mathematical framework for discussing the implications of various paranoid delusions" — Don Alvarez

Rory Alsop

@AviD nope - I went through that huge conversation, but don't get them

Stefano Palazzo

After the encrypted communication channel is established, you have to authenticate the other party. You normally do that by asking a question of them ("where have you been last week at eight?"). But you can also use a shared secret or a system fingerprint

But now I guess I've answered my own question.

AviD

@thisjosh luvvit!

Stefano Palazzo

If I use that channel to share a secret, I will for ever trust the first authentication

AviD

21:14

@RoryAlsop ah, maybe these be americanisms....

Rory Alsop

googled to no avail

AviD

benjamin franklin is on the front of some bills... i.e. money, cash, greens...

charlies are on the front of females.

this.josh

@Stefano 'forever'? Err I don't think so

sounds like we're going to need a glossary too...

Stefano Palazzo

@thisjosh Say the first authenticator was an imposter that happened to know the answer to the question

then I could always be talking to the imposter, I'd have no way of knowing

(not like "perfect forward authentication"?) ;)

this.josh

No like perfect, always, never, every, complete, final, etc.

Stefano Palazzo

21:19

probably best to meet them in person to share a secret though, right?

These authentication questions are really annoying...

this.josh

Yes. I don't know of any authentication scheme which doesn't require bootstraping.

Rory Alsop

@AviD - ahhhh

Stefano Palazzo

this is what I'm on about, by the way

this.josh

Yes otherwise the answer could be discovered or intercepted and replaced.

How do you get the initial shared secret on which you base all other trust?

Do you just hope that noone is observing while you transfer it across various public networks?

Stefano Palazzo

that's a big problem..

but, consider that the whole conversation that follows basically validates this trust

hopefully

this.josh

21:28

Err Not quite, unless you were using some method of analyzing the remote person's messaging style.

You get some measure of trust by validating that the remote person knows the shared secret, but you have no assurance that the received messages are comming from the remote person without some type of periodic authentication.

Stefano Palazzo

right I understand. What I meant was: a conversation between two (real) people is usually a series of shared secrets itself

(unless they're being coerced of course)

this.josh

No. If I tell you that it is hot today, that is not a shared secret.

In order for me to use a shared secret with you, you must already know it. Thus I can not tell you anything you do not already know and use it as a shared secret.

Which would pretty much defeat the purpose of talking, if all I said were things you already knew.

Stefano Palazzo

let me put it another way: I can get a very weak confirmation of your identity by talking to you for a few minutes

weak or very weak, depending on the person I'm talking to and how well I know them

this.josh

Err not really, unless you have some model of my speach patterns and language use that you can check for consistancy.

Stefano Palazzo

I can check if the contents of the conversation make sense

I know it gets more preposterous the more I try to validate it

this.josh

21:41

Not that either I'm afraid. Look, think aboit it this way. Your friend Bob is also friends with Charlie, but Charlie happens to be your adversay.

Stefano Palazzo

it's ridiculously weak, and not very useful - but you do have "some" idea of the identity

this.josh

Most of what Bob discusses with you he also discusses with Charlie. If you are using a text communication media then Charlie can impersonate Bob because he knows Bob and he knows what Bob talks about and even how Bob uses language.

Stefano Palazzo

yeah I can agree with that

consider my idea smashed :-D

this.josh

Even if you were using sound it is possible for Charlie to use a technical mechanism to make himself sound like Bob or even tape record parts of Bob's speach and stitch it together.

Thats why a shared secret used for identification can only be shared between two people. If a third person knows the secret then they can inpersonate either of the two original sharers.

Stefano Palazzo

and so can everyone else I guess, if the third person isn't considered trustworthy

this.josh

21:47

Well, its not totally smashed. Like I said you could construct a model of the way the remote person uses language, syntax, and grammer.

Stefano Palazzo

you must have a fancy name for this concept: Don't trust a model that you don't fully understand

I.e. it's hard to estimate how hard it is to fake these clues, speech patterns and so on

this.josh

Thats what happened with Paul Ceglia's fake e-mails from Mark Zukerberg.

looking for the link...

googlelivesearch.com/web-news/…

Stefano Palazzo

my word

this.josh

No fancy name. The first rule of security is you don't invent security protocols. The second rule of security is you don't invent security protocols. The third rule of security is that if this is your first time at security you have to fight. Humm rule three could use work...

4

See you have a piece of the idea, but still it provides weak assurance.

Stefano Palazzo

It could even fool you into a false sense of security

if the importer was reasonably skilled

or the imposter even

this.josh

22:05

Yes. A false sense of security is actually one of the greatest threats to real security. i.e. You assume since you have fraud detection on your web browser that the site you are visiting is legitimate and you overlook obvious warning signs.

Stefano Palazzo

Just heard bruce schneier talking about that

on and on and on... :-)

Another random question

AviD

@StefanoPalazzo he does tend to drive his point home, doesnt he?

then drive it to the mall, crosscountry, wherever....

Stefano Palazzo

Does it make sense to add a random number of bytes to my message to disguise it's length, or is padding it to mod 16 length enough?

@AviD yeah indeed - but he's too smart for me not to listen to him :-)

AviD

@thisjosh rule three: The third rule of security is that if this is your first time at security you don't invent security protocols.

3

@StefanoPalazzo very much depends on scenario.

this.josh

Oww good one @AviD

Stefano Palazzo

22:16

@AviD It's to encrypt short messages between 10 and 200 bytes, which contain natural language

AviD

what message? to whom? what context? Who or what is trying to do what to your message?

Stefano Palazzo

a length of five would very much reduce the possible contents of the encrypted message

this.josh

Whats the protocol?

Stefano Palazzo

the message is then sent to the eavesdropper, who delivers it to the intended recipient ;-)

AviD

@StefanoPalazzo e.g. if his message to you is, do you approve this transaction, then whether your response is 2 or 3 letters makes a big difference.

Stefano Palazzo

22:18

yeah

let's assume the message length reveals more of the content than it normally would, because there is a restricted set of messages

(this also works for large messages: there aren't many files with exactly 38242339 bytes in my company's intranet, for instance)

AviD

@StefanoPalazzo ah, okay, so you're saying that length is important, but you ask is it better to pad equally or randomly. is that right?

Stefano Palazzo

yeah. In the past I used to just add some random number of random bytes to my message (os.urandom(random() * 100)), I'm wondering if that adds any security at all

this.josh

What kind of security?

AviD

are all possible messages within a given range?

e.g. would pad to same length / # of blocks?

@thisjosh oo good point. right back where we started ;)

this.josh

Its not integrity, its not availability, its not access control, its not non-repudiation...

Stefano Palazzo

22:24

let's say this was a secure terminal transmission, and I want to protect against an attacker guessing the command I just typed

AviD

well, I assume you're talking about confidentiality, from a determined attacker with access to the encrypted message.

Stefano Palazzo

if I type 10 commands, and they have a specific length, even with minor variations, that might reveal "the sort of thing I'm doing"

this.josh

Stefano didn't say it was encrypted

Stefano Palazzo

Oh yes, it's encrypted

When I said "pad to mod 16" I was thinking of AES in CBC mode, sorry

this.josh

With a block cipher?

AviD

22:26

I really dont have any knowledge on it.... BUT I would refer you to josh's 3rd rule of security.

@StefanoPalazzo funny, I assumed that.

the existing algorithms require a standard padding. e.g. PKCS7, I think....

so just go along with what the cryptolgositicianists say

Stefano Palazzo

I never bothered to find out what PKCS7 is

does that now

this.josh

@AviD actually it was your third rule, I just have 1 and 2

Stefano Palazzo

I don't understand it :\

in simple terms, what does the 'Cryptographic Message Syntax' thing do?

just a way to write down your encrypted messages?

this.josh

Yes, a standard for storing, exporting, and importing, confidential keys and cryptovariables

AviD

@thisjosh naw, its all yours - I just helped clarify it.

this.josh

22:35

Why isn't my new Gravitar appearing in the chat log?

Stefano Palazzo

let me get it right. the thing I'm doing now is returning "iv + salt + bla bla + message", just concatenated. And then split it apart when decrypting, which makes my crypto incompatible with any other software does PKCS7 solve this particular problem?

AviD

@thisjosh takes a while to refresh. or maybe try a hard refresh

this.josh

Whoa thats some funky stuff you have going on, but no PKCS7 will not solve that problem

Stefano Palazzo

@thisjosh what's the proper way to do it?

AviD

@thisjosh yeah, that doesnt look quite right.

whats blablba?

Stefano Palazzo

22:37

let me take a look

it's: iv, salt, rounds of PBKDF, aes key-size, original length of the message, message.

AviD

and you concat that, and send it off?

Stefano Palazzo

yes

and then, on the receiving end, I split off the first 16 bytes and call that "IV", split of the next 64 bytes and call that salt, and so on

until I'm left with the message, which I decrypt and then cut down to the original length

this.josh

The proper way is to use openssl.

AviD

so when you said message, you meant encrypted message, right?

this.josh

or NSS

Stefano Palazzo

22:42

yes

AviD

anyway, with pkcs padding, you dont need the length of the message, its builtin.

Stefano Palazzo

I didn't know OpenSSL did symmetric cyphers... :(

AviD

also, the key size is extraneous.

and if you're doing aes, whats the salt for?

Stefano Palazzo

the salt is for PBKDF2

AviD

@StefanoPalazzo openssl is a big honkin library of all things crypto

@StefanoPalazzo ok, and why do you need that? you have aes...

this.josh

22:43

or System.Security.Cryptography.Pkcs namespace in System.Security.dll

Stefano Palazzo

@AviD how else should I derive the key from the passphrase? I'm told this is a good method

AviD

you should trim it down to: iv + encrypted_message

Stefano Palazzo

previously, I was using my own key stretching algorithm (don't shout) :-)

AviD

@StefanoPalazzo ah, see, theres more info missing here...

you dont actually have the key, you have a passphrase from which you need to derive the key?

thats different.

Stefano Palazzo

I'll show you the code

(I've just simplified it a little bit)

AviD

22:45

nah, too late at night....

if you need to, pop it up as a question...

this.josh

PBKDF2 implementations are available in many languages

Stefano Palazzo

    key = PBKDF2(password, salt, iterations=20000).read(32)
    obj = AES.new(key, AES.MODE_CBC, iv)
    ciph = obj.encrypt(plain_text)
    return salt + iv + orig_len + ciph

this is the meat of the matter (part of encrypt())

AviD

@StefanoPalazzo and the password is the only thing pre-shared, right?

Stefano Palazzo

yes

AviD

and the message structure.

this.josh

22:47

probably better on stackoverflow

AviD

@thisjosh no, sounds more like a question for here.

wait, what was the question??

Stefano Palazzo

@AviD Am I making a horrible mistake :-)

or rather: can I do a better job; is there a standard for the output format of my encrypt function?

if some piece of software says it can do "AES", is there any standard that'll make sure it can read my encrypted data?

this.josh

For what application or protocol?

Stefano Palazzo

I don't really know :-)

AviD

@StefanoPalazzo generally you'll just need to provide the iv, key, and data. everything else is wrapping.

Stefano Palazzo

22:52

was thinking along the lines of a spec like "all AES encrypt function should concatenate these things in that order ..."

this.josh

Then no :)

AviD

you wanna replace key with passphrase + PBKDF, fine, but thats seperate.

@StefanoPalazzo youre trying to concat the output with some of the input. wouldnt work as standard...

Stefano Palazzo

good to know

I just want to be sure people aren't going to laugh at my code ;-)

(there may come a situation where I will depend on it being taken seriously, so simple crypto errors are a big problem)

Even if it's secure

AviD

2 rules: there are no "simple" crypto errors, and if there are crypto errors it is not secure.

this.josh

If there is one crypto error then there is an error, and thus it is wrong.

Stefano Palazzo

22:57

I heard a talk where the speaker was pointing out things like "using incorrect terminology" as a warning sing

that I need to avoid, also, failing to use any well known standard and rolling my own instead would look pretty bad

this.josh

Incorrect terminology is a warning sign, but correct termonolgy doesn't guarantee correct understanding.

AviD

@thisjosh absolutely.

this.josh

Yes rolling your own is bad, see rules 1, 2, and 3.

Stefano Palazzo

this is what I was doing just yesterday, before I remembered this site :-)

        key = hash(password + salt)
        for i in range(2**16):
            key = hash(key + password + salt)
        return key, salt

AviD

my favorite example: I've discussed and explained rainbow tables for several years. Turns out, I didnt know what it was....

@StefanoPalazzo I wont berate you for that, because you've seen the error in your ways. And, I've done much worse.

okay, not much, but still...

Stefano Palazzo

23:01

I blame wikipedia for this one actually

Key stretching

In cryptography, key stretching refers to techniques used to make a possibly weak key, typically a password or passphrase, more secure against a brute force attack by increasing the time it takes to test each possible key. Passwords or passphrases created by humans are often short or predictable enough to allow password cracking. Key stretching makes such attacks more difficult. Key stretching is sometimes referred to as "key strengthening", although the latter term originally referred to another technique with significantly different security and performance properties (see section 6 of f...

they blatantly label this an "Even better method"

:-)

this.josh

Does it tell you that you need good secondary data to make key stretching valuable?

Stefano Palazzo

"secondary data": is that the salt?

this.josh

Yes. Any deterministic algorithm applied to easily guessable data will not make the output 'stronger' without a seconday input which is not easily guessable.

Stefano Palazzo

well, I'm using /dev/urandom

I'm not sure, I've read it's okay for this kind of thing

this.josh

Yep.

Transcript for