thanks @kelalaka, sounds like this was all not much to worry about really..

on 3), for a tag error oracle, does that type of oracle need to know the key or not?

(i.e. in my example of encryption tool that doesn't keep the key around after encryption, is that type of tool outside of scope for this attack)?

@Woodstock I've not finished yet. Needed to go out.

Well, it reduces the number of oracle calls and that is hugely like 2^20 for GCM. The problem is that we cannot really force the users to have good passwords.

Nicely, Microsoft built a service for checking your password whether it is pwned or not without revealing. You can build one, too!

The server has the password to correctly decrypt the message if the message is encrypted with the correct password ( KDF...)

The partition just groups candidate passwords so that if the password is one of them then the tag will be valid.

I see your hurdle; again repeating, the problem is the password's strength. I think I've seen an AI that tests the strength of the password ( lost the link before reading !). With this AI or similar tools you can test the strength of the passwords.

The huge parameters of Argon can only decrease the setting up the partition time that doesn't effect the number of oracle calls.

I hope the key destroy is proper. There are securely deleting libraries.

Thanks @kelalaka, yep key destruction is proper, overwriting the buffer.

> the problem is the password's strength

I understand, this makes sense to use strong passwords

one thing I'm still unclear on, for a tool that destroys the key derived from a normal password (not really strong), and just stores encrypted blob, does this attack apply?

thanks for all your help on this

Wait, I did not finished yet to answer all in the first comment :)

ah sorry!

@Woodstock so the question what is the service that you have?

@kelalaka, I don't have a service, just a tool (executable) that takes a human entered password, derives a key using Argon, encrypts using Salsa20, stores the ciphertext and destroys the key/password completely. All the attacker would have is the encrypted blob and the tool itself.

I thought maybe the partition oracle attack doesn't need an oracle that knows the key, to test if tag is valid

but as you say, if partition oracle relies/needs oracle that knows the key, then my tool should be immune to this attack, right?

Yes, there is no partition oracle there.

wow, so this really is a lot of hype over nothing, this doesn't break most implementations of chacha or slasa

its such a small subset I would say that have an oracle,

most are just offline tools

that don't store the key

probably the most interesting find here, (that I didn't know before) is that there are many keys that will give the correct tag, but decrypt to nonsense. I find that amazing

thanks again for all the help

It is important since they applied some protocols.

The grouping was known before as you can see in the article, even poncho wrote an answer here how to find one (AFAIK).

> since they applied some protocols.

How'd you mean?

The attack is applied in the wild to some known protocols.

This attack requires an oracle that returns a value like the padding oracle attacks. If there is no return, then there is not a test even for a normal online password guessing attack k=1.

Shadowsocks, OPAQUE

> I'll keep this brief. I'm a maths teacher in the UK looking at a career change into cryptography, especially the mathematical side of it - I've studied analytic number theory recently and really enjoyed it. Unfortunately I have essentially 0 coding experience, so what would be a good place to start if I'd like to start looking at grad schemes soon? Many thanks. (sorry, didn't know what tag to use so I put number theory as that's what I've been studying)

If any one wants to answer this question crypto.stackexchange.com/q/89031/18298