1
$\begingroup$

I'm in need of an algorithm that can perform a very specific task: take a short string, encrypt it using an algorithm which can be scaled to keep up with Moore's Law/has a proof-of-work factor/is unusually slow, and then, later, decrypt it at the same time cost.

The use case is a list of email addresses being stored for a mailing list by a security-conscious client, to be decrypted one at a time for each email; the goal is to make brute-forcing as time-consuming as possible. I've looked into some of the likely candidates (AES-256, mcrypt, twofish, scrypt), but it's unclear which would be best suited.

$\endgroup$
9
  • 2
    $\begingroup$ Go for AES-256-GCM or xChaCha20-Poly1305. $\endgroup$
    – kelalaka
    Oct 17 at 16:02
  • $\begingroup$ "decrypt it at the same time cost"; do you mean "the same time cost as encryption"? Or, do you mean "at a time cost which is the same independent of the encryption cost factor"? $\endgroup$
    – poncho
    Oct 17 at 16:02
  • $\begingroup$ @kelalaka: how does AES-GCM or ChaCha have a "proof of work" factor? $\endgroup$
    – poncho
    Oct 17 at 16:03
  • 1
    $\begingroup$ @poncho I don't think that the OP really wants slow encryption, rather the goal is to make brute-forcing as time-consuming as possible. 256-bit encryption is enough with a good password and a PBKDF. AES-GCM or ChaCha doesn't have proof of work factor and they don't need, too. $\endgroup$
    – kelalaka
    Oct 17 at 16:10
  • $\begingroup$ Note that, scrypt is a password-based key derivation function created by Colin Percival,. Do you actually want a slow PBKDF and a fast encryption that is secure enough bruteforce? $\endgroup$
    – kelalaka
    Oct 17 at 16:48
0
$\begingroup$

For what you hope to do, the choice of block cipher is probably not as important as the mode of operation. What you need is a mode of operation where both encryption and decryption are non-parallelisable and then to iterate a number of times that is troublesome, but not infeasible.

My recommendation is to use Output Feedback (OFB) mode. Generate a unique Initial Value; feed this into the (e.g.) AES block cipher; then feed the output back into the cipher and repeat, say, $2^{35}$ times depending on exactly how much time you want to require of the client. Then XOR future outputs onto the e-mail address. The encryption/decryption time will decrease with Moore's law, but there is no benefit in buying more hardware.

Now, after decrypting once, the client could simply save off the last output value prior to XORing, but equally they could save off the address once decrypted.

Another option would be to use Propagating Cipher-Block Chaining (PCBC) mode, but this would involve the generation of as many unguessable inputs as the number of iterations which feels unnecessary.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.