[tahoe-dev] Question about convergence keys

[zooko]

Jeremy:

I'm glad to hear that you are experimenting with Tahoe.  Please do
keep us informed of your impressions of it.  Your concern seems valid
if I understand it correctly.  Let me see if I understand: you're
concerned that if the symmetric encryption key is just the secure hash
of the file (in the case that the added convergence secret is not used
or is the empty string), then there might be people who know the
secure hash of the file but who oughtn't be allowed to get the
plaintext of the file.  For example, users may have published the
SHA-256 hashes of their files even though the files are private.

I think this is a valid concern, and this is why we use a "tagged
hash" instead of a normal hash of the file.  A "tagged hash" is just
that we use some unambiguous prefix when hashing the file to separate
hash values which are used for this purpose from hash values which are
used for other purposes.  Your concern can be seen as an example of
the "chosen protocol attack" [1], and tagging your hashes is one
defense against that attack.

This practice of ours is lightly documented in architecture.txt [2],
and you can see the actual implementation and which tags we use for
which purposes and so on in hashutil.py [3].

Regards,

Zooko

P.S.  In a distantly related story I'm interested to see that this
program claims that SHA-256 is less secure than Tiger-192: [4].

I've added a link and some notes about that to the Tahoe Bibliography
page: [5].

I like Tiger-192 because it is so efficient -- one third as much CPU
load as SHA-256 on these benchmarks [6] -- and because it emits
24-byte outputs instead of 32-byte outputs, which would fit better
into nice small caps.

[1] http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.35.5994
[2] http://allmydata.org/trac/tahoe/browser/docs/architecture.txt? 
rev=2618#L106
[3] http://allmydata.org/trac/tahoe/browser/src/allmydata/util/ 
hashutil.py
[4] http://defectoscopy.com/results.html
[5] http://allmydata.org/trac/tahoe/wiki/Bibliography
[6] http://cryptopp.com/benchmarks-amd64.html