Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

TAHOE-LAFS uses a form of "key-dependent encryption", in that a private key SK is encrypted with the truncated hash of the private key:

ENC(Htrunc(SK), SK)

Where Htrunc(X) is the result of SHA256(SHA256(X)), truncated to 16 bytes.

The TAHOE-LAFS paper states:

This somewhat unusual arrangement means that the RSA signing key is encrypted with the truncation of the secure hash of itself. This is an instance key-dependent encryption, which is not as well-studied as we would like. However, we think that it would be surprising if there were a weakness in this construction which did not imply a weakness in the underlying standard primitives – RSA, AES-128, and SHA256.

What are the practical consequences of the use of this construction? Is the paper right in saying that if the underlying primitives are secure, this scheme should be secure as well?

share|improve this question
    
What is ENC, specifically? How is it instantiated? –  D.W. Apr 3 at 10:52
    
I'm not sure about TAHOE-LAFS, but for my uses I am considering AES CCM. (Edit: TAHOE-LAFS uses AES-CTR) –  louism Apr 3 at 14:08

1 Answer 1

up vote 2 down vote accepted

There are no known dangers or attacks from this construction. I agree with the quote from the TAHOE-LFS paper. I would find it quite surprising if this use of the key material introduced some special weakness. I can't prove it, but based upon my professional judgement, this is probably far from the biggest risk to your security -- it is very unlikely that this is the weakest link in the system. It is far more likely that the weakest link is something else (e.g., endpoint security, the human processes, social engineering). So, personally I wouldn't worry about this.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.