Timeline for Is Convergent Encryption really secure?
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 24, 2019 at 5:23 | comment | added | Dan | @DavidSchwartz: what are the properties of the key which encourage using an HMAC (as opposed to other hashing functions)? | |
| May 19, 2014 at 13:09 | comment | added | rmalayter | @DavidSchwartz: most of these systems use a fixed IV (perhaps all zeros) because the key is unique to each block. And because the locator is a hash of the plaintext, it can be checked to ensure the data wasn't tampered with. So even though they use CBC or CTR mode, there is zero overhead for IV or authentication tag storage and transmission. | |
| Feb 9, 2013 at 7:10 | comment | added | David Schwartz | @PeterDolberg: You are correct. If you use AES-CBC, the IV has to be derived the same way as the key. | |
| Feb 9, 2013 at 7:05 | comment | added | Peter Dolberg | If you use AES-CBC in step 3 then typically you would use a random initialization vector. Then the whole system is not 100% deterministic. | |
| Sep 20, 2011 at 20:46 | vote | accept | Justin King | ||
| Sep 20, 2011 at 13:25 | comment | added | David Schwartz | Actually, I realized there's a fairly simple solution to that problem: Every once in a while, the system randomly gives a group of locators to randomly-selected users (and does not track which it gave or who to). And every once in a while, a user randomly requests the contents corresponding to a locator he actually doesn't have the key to. (This causes issues with knowing how long to keep data and how to bill for storage, but it proves that the attack is not "totally unavoidable" or "inherent in the technology"!) | |
| Sep 20, 2011 at 13:03 | comment | added | Thomas Pornin | @Nakedible: this attack is totally unavoidable in the case of Bitcasa, because it is a feature of the system to detect files with identical contents, so that storage can be optimized. | |
| Sep 20, 2011 at 10:33 | history | edited | David Schwartz | CC BY-SA 3.0 |
added 53 characters in body
|
| Sep 20, 2011 at 10:23 | comment | added | David Schwartz | Thanks. That's really another way of phrasing the same attack. But the different phrasing does suggest other ways the 'weakness' could be exploited. (The most obvious way would be if you had something you weren't supposed to have, such as taking classified material home with you.) | |
| Sep 20, 2011 at 10:16 | comment | added | Nakedible | Great answer. However, one more attack: an attacker can guess plaintexts and test if you have that file. This attack will reveal passwords in configuration files that haven't been modified otherwise, for example. | |
| Sep 20, 2011 at 9:01 | history | answered | David Schwartz | CC BY-SA 3.0 |