The Side Channel - 2018-12-12

« first day (2709 days earlier) ← previous day next day → last day (1961 days later) »

Future Security

12:00 AM

I appreciate your assistance as well. I found one of your questions about X3DH, HMQV, and OPAQUE, @SEJPM. A few days ago I was wondering "What's the benefit to HMQV that triple DH doesn't provide? And why did it take so long to 'discover' triple DH?"

I've gotten as far as DH-OPRF. Which I understand to be the way the client queries a user's salt. And it shouldn't be possible to query the correct key without knowing the unsalted password hash.

Future Security

12:32 AM

Looks like in the ietf draft the author may not have fully understood how Argon2 worked.

> For this purpose we re-define DH-OPRF as F(k;x) = I^n( H(x, v, H'(x)^k) ) where I is a specialized hash function designed for hashing passwords such as Argon2 scrypt The symbol I^n denotes n iterations of function I.

If interpreted literally. Which I might interpret as Argon2(Argon2(Argon2(...(password)...)

Future Security

12:49 AM

I wonder what security properties you lose if you stop with simply a one-way function, Argon2, and a OPRF. The key-exchange part isn't necessary for ordinary website logins.

^ Query the correct salt, above. Not key.

4 hours later…

Future Security

5:10 AM

> [The cost] is just 1/6 of an exponentiation with HMQV

Does that mean one sixth of one exponentiation? What would that even mean?

1 hour later…

6:38 AM

I read that the number of rounds for Rijndael was chosen due to a 6-round attack that was found on an early version, resulting in the team adding an extra 4 rounds as a security margin. It mentions this in The Design of Rijndael, but doesn't say anything further about it. Is there a paper out which describes that old attack?

9 hours later…

3:27 PM

https://crypto.stackexchange.com/questions/64753/aes-256-encrypt-ctrkey-sha-1plaintextplaintext-vs-aes-gcm-which-is-more-s

So, did the author just make their question off-topic with their last edit by making it about attacking a given ciphertext? :D

3:37 PM

@forest There's notes from Daemen-Rijmen in 1998 about a square attack on 5 rounds. Is that what you are looking for?

4:03 PM

@Maeher Yes, yes they did! That question is leading to nothing but further denial by the OP. Once they asserted that CTR mode is not malleable, it became abundantly clear they will simply deny all analysis of the scheme.

I would vote to close, but I can't anymore: I had voted "unclear what you're asking" before they edited the Q to make it more clear, so I had to retract that vote and now cannot vote on it again

@EllaRose I was considering a close vote. It's a bit stupid. But the only options I see is close as "off-topic" or edit the question against the explicit intent of the author.

editing it will not help anything

they already have a bunch of thorough answers that they are simply screaming "NooooOO!!1!!" against

(figuratively, of course)

editing would also be against the rules since your not supposed to change a question's intent against the author's wishes.

so then the only right course of action must be vote-to-close

that user should probably get a basic understanding of standard security notions before trying to cobble together constructions anyways

I started a close vote, let's see what others are thinking.

The weird arrogance of assuming that the only question is "How much better" their cobbled together mess is than a well thought out accepted construction...

4:16 PM

I know right, I found that particularly humorous

as if there was no question of the security, other than how much better it is than other constructions

Uhhh, new question just made for an answer by Paul.

Why we don't have some listing on off-topic this question belongs to some other ....

stackoverflow has

it may be because there are a limited quantity of close vote options available

@kelalaka I'm not sure what you mean.

Go on the stackoverflow. pick a question, flaging-> closing -> off-topic->migration

There you will see, sites other than meta of the stackoverflow

4:20 PM

Oh, yeah... we had that with math some time in the past I think.

@kelalaka Might be worth asking on meta?

I think so, let me

I think the problem is that we need to apply for that with SE admins and the site questions are being migrated to would need to agree. Which apparently isn't happening.

5

Q: Migration Paths for Crypto.SE

We were told in chat that we should open a meta thread to ask for the migration paths. This is this thread. For everyone not knowing what a migration path is: Question can be migrated between different sites on the StackExchange Network and usually this can only be done by moderators. So only a...

feature-request migration

So, you can try but it's likely that SE admins will not agree on necessity.

We need migration for mainly Security, Math, Stackoverflow. Less often server, CS.

We'd be lucky to get one migration path.

4:36 PM

> What a great implementation of AES-GCM!! Now as we understand the AES-GCM, in a simple and convincing way; we can stay in peace of mind for using AES-GCM, as long as AES-256 is not broken.

Wow.

They are now claiming that their construction is AES-GCM

(as well as being equally secure)

Is "quantum cryptography" supposed to encompass quantum cryptanalysis methods? I thought Shor's algorithm and the like fit under the tag of "quantum computing" rather than "quantum cryptography"

The tag description for quantum cryptography states "Quantum cryptography describes the use of quantum mechanical effects to perform cryptographic tasks or to break cryptographic systems." as well as "not to be confused with quantum computing", which seem to be conflicting statements to me

@EllaRose Definitely not.

@EllaRose Yeah... breaking crypto with "quantum mechanical effects" is not quantum cryptography.

@EllaRose Where are they claiming that now?

It was in the tag info for quantum cryptography. I just submitted a change for it, you might still be able to see the incorrect version as it has to be approved.

The last comment referred to the GCM thing.

In their question they're now confidently claiming that encryption of a hash is a secure Mac. -.-

Oh, it's the closing statement in their answer

5:01 PM

Question posted on Meta, feel free to edit.

About migrating request

We would probably need to demonstrate a large number of concrete examples for each single migration target. Which is why this will not happen.

We can do it slowly. But if there is a method for query for off-topic questions it will be nicer.

Should we collect them in an answer?

5:19 PM

0

Q: Off-topic migration requests Cryptography

In this answer JNat told on Grace Notes: Just make a meta thread demonstrating the need, anyone can do it. We'll then review it and then enable the path if it seems appropriate. In Cryptography, we often see questions related to Math, Security, and StackOverflow. We can say off-topic by s...

support feature-request

5:49 PM

It's remarkable how strongly a lack of knowledge and conviction in one's flawed ideas are correlated.

2

6:36 PM

There was a winter bash for every year?

I feel like I'm in runescape

6:55 PM

@FutureSecurity yes, that's the same thought I arrived at earlier today

@Maeher I'm pretty sure we didn't

@EllaRose I think the latest consensus was "quantum cryptography" = "crypto that uses quantum computers"

It seems that the winter bash slows the browser? I feel it

@kelalaka more JS = bigger page load = slower (depending on your internet speed)

you should always be able to disable it by clicking "I hate hats"

ALready did

@SEJPM other what was it?

@kelalaka "We even don't have blatantly off-topic in Cryptography. Adding this also will be helpful. "

@SEJPM I may be misremembering. But I thought we had some migration target other than meta back when the site was still in beta.

7:07 PM

@kelalaka also give the mods some time, the legendre question was just migrated

and for the NTL case clearly sushi decided that this question wouldn't be a good fit neither on SW-Recs nor on SO, so immediately closed it

No, you are an AI, I know it, you failed the Turing test :P, sorry thanks for your time.

The frobenius one is border-line I'd say which is why it stayed

I looked only one person that I remember, immediately.

7:22 PM

0

Q: How an underlying cipher suite effects security of MAC functions? Example: MACX = aes-ctr(sha1);

The MACX = aes-ctr(sha1) is defined as follows: Inputs: iv: Initialization Vector used for ctr. key: Key used to encrypt the generated sha-1. data: Data for which the MAC need to be generated. Outputs: MAC: Generated MAC of the data. iv_used: used_iv. data:used data. Then, MAC = aes-ctr(s...

guess who that is...

Any clue?

Wow, seriously?

@kelalaka read the transcript?

I missed the duplicate.

@EllaRose I told them to ask a new question about his claim that it is a MAC, since the discussion was completely off topic in the comments of the other questions.

7:37 PM

ah ok, I missed that

But they failed (again) to actually fully specify the supposed MAC.

It still seems awfully similar to the last Q, which means it might be voted to be closed as a duplicate

Part of their confusion is clearly that they don't understand that the IV is part of the ciphertext/MAC. Which I hoped they might realize if they have to specify the verification algorithm.

@Maeher actually it doesn' t matter for the attack whether the IV is known or not

it's not even included in the hash

I know.

7:41 PM

so my current theory is either a) somebody needs to clearly communicate them what the formal definition and security definition of a MAC looks like

or b) explain very carefully and step-by-step, preferably using a real-world scenario how this gets broken

but in either case they will probably find a way to dismiss the point being made

But they think that the verifier will somehow know which IV to use without including it. Which they're thinking means that the verifier will not use the same IV when verifying the new tag.

I was hoping that the source of their confusion would become clear when they need to formally specify the scheme.

which assumes though they know the proper formalisms

True

I will taken a shot at adding it tomorrow. ( Unless it's closed in the meantime) although they seem very unwilling to accept any answer that doesn't confirm their feeling.

-2

Q: Elliptical Curve Cryptography - Point doubling help

I have a defined curve $E: y^2 = x^3+2x+2(\text{mod}17)$ Given the generator point $P = (5,1)$ And I have to work out each individual point exactly from $2P$ to $19P$. I have completed, using the standard formulas, $2P$ to $5P$ where: $2P = (5,1)+(5,1)=(6,3)$ $3P = 2P+P = (10,6)$ $4P = (3,1)$ $5P...

elliptic-curves cryptography elliptic-equations

They even didn't give an answer :)

1 hour later…

9:03 PM

Poncho now said the same thing and suddenly they accept it.

yeah, I noticed that... facepalm

And, old question updated

Can I please have opinions on whether people now think if the old question should be re-opened?

(I see no longer a strong reason to keep it closed)

-3

Q: AES_256_ENCRYPT_CTR(key, sha-1(plainText)+plainText) VS AES-GCM, which is more secure?

What if we encrypt sha-1 hash of the plain text, along with the plain text using AES-256 in CTR mode? How much future proof the above method would be in comparison to AES-GCM or any other method where auth tag is made public? Ultimately the question comes down to which has higher chance of gett...

aes collision-resistance

Well, they did accept my answer, and I can't see what benefit any new answers would provide

and it still kind of is a question asking for review of a cryptographic design, which is supposed to be off-topic

@sejpm why do you think it should be re-opened?

Maarten Bodewes

9:57 PM

@SEJPM I think it should be reopened. This is a very simply scheme where a hash is used instead of a HMAC. I don't count it as a complete design as in a block cipher. In doubt we should leave it open. I don't think it would have been closed if we didn't have the shenanigans of the poster (adding to the question, answering himself, putting the other answers in doubt, asking for a challenge to be solved etc.).

And continuing, until he finds out that I'm no longer commenting, as I've now indicated twice that he should ask a different question.

I meant "another question".

@EllaRose this phrasing is supposed to catch complicated constructions.

this is plain hash then encrypt

28

Q: Why is plain-hash-then-encrypt not a secure MAC?

It seems that even in MAC-then-encrypt systems like SSL, something like HMAC is used rather than a plain hash. Why? Suppose we use some stream cipher; then why can't we use $Encrypt(m | H(m))$ as the MAC-then-encrypted version of the message? Assuming no bad relations between $Encrypt$ and $H$,...

hash protocol-design mac

Maarten Bodewes

Yeah, that could count as a dupe.

Well, that's a very short re-opening of the question :)

@MaartenBodewes at least it now won't be auto-deleted by the bot

anyway, time to sleep o/

Maarten Bodewes

G'nite!

@Maeher @EllaRose The author of the question does not always get a final say. In particular, once a question has been answered (excluding low-quality or off-topic answers), nobody should edit the question in a way that invalidates the answer, not even the original asker.

So in the case of crypto.stackexchange.com/questions/64753/… I think the best course of action is to roll back the latest edit. Which the asker themselves has now done.

I voted to reopen. There's no reason to close this question (except maybe as a dupe). Closing a question (except as a duplicate) means that you think it should be deleted. I don't think it should be deleted: it has two good answers.

Even if the asker was not cooperating, keep in mind that questions are not just for the one asker. They're also for future visitors.

@forest If you think OAEP is overkill, there must be something you don't know about RSA decryption. Asymmetric decryption is surprisingly tricky. Search keywords: Bleichenbacher, oracle. For attackers, it's a gift that keeps giving.

10:23 PM

ah, I didn't realize that closing implied deletion

that is a good reason to not close it then

it's not automatic (for an answered, positive-scoring question — it is automatic in some cases, it's documented on Meta Stack Exchange somewhere)

but a closed question is not useful and ideally should be either edited and reopened, or deleted

if it's worth answering it shouldn't be closed, and if it isn't worth answering then it shouldn't be on a Q&A site

I don't know of any SE site that's made a serious effort to weed out closed questions

@Gilles I've put the cat here.

it's a lot of effort

speaking of deletion: should we flag this as naa or allow them to delete it? crypto.stackexchange.com/a/64821/29554

I'm not sure if having a post deleted for being not an answer counts against them somehow

@sejpm

@EllaRose having an answer deleted counts towards the answer ban, but the reason for deletion doesn't matter (except if it's deleted as spam or offensive)

the lower the score on deletion, the more weight it has towards the ban

10:32 PM

Ok, I'll give them a bit to delete it on their own then. Thanks!

so deleting early is better for them than waiting for downvotes

but it takes really hard work to reach an answer ban

hmm, so maybe it is better to flag it now. But I suspect the potato may be in bed

the exact formula is secret, but it takes multiple very-poorly-received answers to reach an answer ban, and only a few upvotes to get out of it

oh, actually, I guess that's a good point

the question ban is easier to reach, but it's only active on a few active sites (Stack Overflow, Mathematics and a couple others I think)

10:34 PM

Even Uszak has never hit the answer ban

and he has tons of hugely downvoted answers

the automatic ban is for extreme cases

Uszak writes well, and knows enough to write good answers sometimes

I'm not sure I can agree on the first point - he has a tendency to use lots of jargon that is frequently completely inappropriate, but some of his answers aren't horribly wrong.

crypto.stackexchange.com/questions/64820/… is evidently someone who asked a question then lost access to that account and posted an answer because they couldn't edit the question

I suspected they may have lost access to the account, but they managed to lose that access really really quickly

I don't think they knew to edit the question, I suspect they thought it was a forum and posted it as a reply

since they have the same avatar, they're using the same credentials, so they should be able to regain access easily

10:37 PM

(could be wrong though)

as a new user, they wouldn't have been able to answer their own question with the same account

oh, it is a different account

I hadn't noticed that

sharp eyes!

same avatar, same username → looks like it's the same account

but 1-rep and answer posted soon after the question → it can't be the same account

it's a common problem with new users

You've created a new account, that's why you couldn't edit your question. To regain access to your question, please follow the steps in the help center. — Gilles 1 min ago

And CG Dominator might be the same person with different credentials

Actually the Unknown12 accounts are unregistered. This means they're only identified by a browser cookie. It's very easy to lose access. CG Dominator is registered, meaning that they can log in with a password or with OAuth, so they should be good now.

you're getting mod training!

on a site like this which doesn't have a lot of problems, this is probably a non-negligible part of mod activity

Say, @EllaRose, speaking of quantum-cryptography, I wondered how to tag crypto.stackexchange.com/questions/64810/… . It's about using quantum mechanics for cryptography, but it doesn't exactly fit what the tag wiki describes.

Maarten Bodewes

11:10 PM

@Gilles I was thinking to expand the description in the tag. But just relying on quantum effects for randomness, is that enough? We could also introduce quantum-randomness. I've a slight preference for the latter, even though it is yet another tag related to quantum-something.

It should of course be quantum-induced-randomness, but yeah...

@EllaRose What's your opinion on that?

@Gilles OT: 979K rep. sheesh!

Sorry to barge in like that, I happily will try and learn too.

@MaartenBodewes when I was more active I calculated that it would take me, I think about decade, to catch up with Jon Skeet

(he's only really active on one site, so he's limited by the rep cap)

Maarten Bodewes

And then you found out that you really didn't care about it that much, been there :)

Strangely enough, that's when you focus even more on quality, and rep may go up even faster.

1M would be cool though.

11:29 PM

:I've never really cared, and I've always focused on quality

Maarten Bodewes

11:54 PM

I've fought quite a few battles on SO with high rep users w.r.t. cryptography, including John. Nowadays they take me a bit more seriously. All my answers except possibly a few are crypto related. Quite tricky to get to 60K that way, unless you are lucky and create e.g. a crypto related answer on Git that gets loads of upvotes. You can see lots of upvotes on very early answers of SO (including very bad answers, by the way).

I was almost tempted to delete my user account because of how SE works nowadays; it would remove over 10% of the crypto related answers.

@Gilles I think that random-number-generator and randomness are good tags for it, it's not really exceptional to try and use quantum mechanics and whatnot for generating random numbers. The "quantum-cryptography" tag doesn't seem to fit well.

@MaartenBodewes It seems like such a tag might see very little use

Maarten Bodewes

Agreed on that. Agreed on your tag edits too btw.

Review queue

thanks ^.^

« first day (2709 days earlier) ← previous day next day → last day (1961 days later) »

Transcript for

Dec '1812

The Side Channel

Mostly randomly generated noise. – crypto.stackexchange.com

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile