Changes between Version 1 and Version 2 of OneHundredYearCryptography


Ignore:
Timestamp:
2010-06-23T00:03:02Z (14 years ago)
Author:
zooko
Comment:

some updates

Legend:

Unmodified
Added
Removed
Modified

  • OneHundredYearCryptography

    v1 v2  
    11
    2 This describes a project to enhance Tahoe's cryptographic system so that Tahoe shipped today/next year might remain safe from cryptographic attacks for a 100 years. The initial ideas were presented on a post by Zooko to his klog (since lost, apparently).
     2This describes a project to enhance Tahoe-LAFS's cryptographic system so that Tahoe shipped today/next year might remain safe from cryptographic attacks for a 100 years. The initial ideas were presented on a [http://pubgrid.tahoe-lafs.org/uri/URI:DIR2-RO:ixqhc4kdbjxc7o65xjnveoewym:5x6lwoxghrd5rxhwunzavft2qygfkt27oj3fbxlq4c6p45z5uneq/blog.html#%5B%5Bcan%20we%20build%20a%20crypto%20system%20to%20last%20for%20a%20hundred%20years%3F%5D%5D post by Zooko on his klog].
    33
    4 The basic idea is to combine two primitives, both thought to be safe, such that even if one of them fails catastrophically Tahoe remains secure.
     4The basic idea is to combine two primitives, both thought to be safe, such that even if one of them fails catastrophically Tahoe-LAFS remains secure.
    55
    66== Bulk Encryption ==
    … …  
    88Convert from AES/CTR to using AES/CTR combined (by XOR) with XSalsa20. This has the advantage of being fully parallel, since you can compute both the AES and XSalsa20 keystreams in parallel and before the plaintext or ciphertext is known.
    99
    10 It's worth noting that AES is being retained more for political/name brand reasons than actual security. If this wasn't a factor we might well be better of instead using a design that is safe against timing attacks, such as Serpent or Noekeon. On the other hand, CTR mode probably makes timing attacks rather more difficult because the attacker can't choose inputs. And, I believe, in Tahoe's case, the initial CTR IV will be secret and chosen via a cryptographic KDF.
     10It's worth noting that AES is being retained more for political/name brand reasons than actual security. If this wasn't a factor we might well be better of instead using a design that is safe against timing attacks, such as Serpent or Noekeon. On the other hand, CTR mode probably makes timing attacks rather more difficult because the attacker can't choose inputs. And, I believe, in Tahoe-LAFS's case, the initial CTR IV will be secret and chosen via a cryptographic KDF.
    1111
    1212Open questions:
    13   * Should we use AES-128, AES-192, or AES-256?
    14   * What KDF is used to generate the keys/IVs? I think Zooko suggested using XSalsa20, but I haven't seen a concrete proposal.
     13  * Should we use AES-128, AES-192, or AES-256? //Zooko says: maybe AES-128 because it wastes fewer CPU cycles and is plenty secure. Indeed, if you worry too much about the related key model (which I don't since we never use related keys in Tahoe-LAFS) then AES-128 is arguably safer than AES-256! //
     14  * What KDF is used to generate the keys/IVs? I think Zooko suggested using XSalsa20, but I haven't seen a concrete proposal. //Zooko says: per [http://tahoe-lafs.org/pipermail/tahoe-dev/2010-June/004424.html this mailing list thread] HKDF might be a good choice for KDF.//
    1515
    1616== Hashing ==
    … …  
    2020== Signatures ==
    2121
    22 I think Zooko has a plan. I don't know what it is.
     22David-Sarah has proposed to use hash-based digital signatures. Zooko summarized David-Sarah's proposal here:
     23http://tahoe-lafs.org/pipermail/tahoe-dev/2010-June/004439.html