2
$\begingroup$

I am wondering which of these two solutions is better for security on the long run. The problem is:

Alice and Bob exchange a secret key/private key. Then they go far away from each other and never have the opportunity to exchange a private key again. They will use the private key to exchange messages intensively (let's say 1 per 20 minutes for years).

Which option is the best secured?

  • Just let the private key as it is, for all the time, with the risk that a brute force attack succeds at some time: example: the private key is 1234
  • Regularly change with a pre-set manner the private key, using today's date: example: 107212320422 on 07/12/2022, 108212320422 on 08/12/2022: thus the keychanges reguarly so brute force attacks could not work, but is the part that is still the same (the 1xx2xx3xx4 template) a vulnerability?

Of course, I am also interested in a better solution than those two :)

$\endgroup$
1
  • 1
    $\begingroup$ There is WPA-PSK protocol that you might be interested. $\endgroup$
    – kelalaka
    Commented Jan 9, 2022 at 18:01

2 Answers 2

2
$\begingroup$

Brute-force attacks are irrelevant. All remotely modern methods of cryptography, apart from the uses of passwords that can be memorized by humans, are way beyond reach of brute force. With a 128-bit key, if you could afford to set a billion computers to brute-forcing a key, and each computer could try a billion keys per second, and you were prepared to wait until the universe is twice the age it is now (about 30 billion years), you'd still have barely a 1% chance of success.

If large quantum computers are possible (which is not certain), they will effectively halve the key size for symmetric encryption, which makes 128-bit keys brute-forceable. But there is a very simple solution, which is to use 256-bit keys instead. Anyway the amount of data exchanged with the key is not relevant here.

Things change if you consider the risk of side channel attacks. Many side channels give the attacker only a little bit of information at a time about the key, and it takes repeated use of the key to make the side channel exploitable. So for this reason, you may want to limit the use of a key.

Another reason to limit the use of a key is that each message requires a nonce. Repeating nonces can be catastrophic. Depending on the algorithm, the size of the nonce may be somewhat limited. If you can ensure that nonces are sequential, the limit is so high as to be practically unlimited. But that can make it difficult not to repeat nonces, for example if the sender's hard disk fails immediately after sending a message and they have to restore data from a backup. To avoid this difficulty, it's common to use random nonces, but then you run into the birthday problem: an $n$-bit nonce is likely to repeat after as little as about $2^{n/2}$ messages. To avoid this kind of difficulties, communication protocols typically don't reuse the same message encryption key between sessions. Each session derives a new key from the original shared key. The original shared key is used as a key derivation secret, not as an encryption key.

Deriving a new key for each session is similar to your idea of varying the key based on the date. But there are two major differences. One difference is that there's no point in using the date, which is problematic because clocks aren't very reliable so you could end up with a disagreement about the date, or the date being repeated because a device has run out of battery and rebooted to “blinking 12:00”. Instead, just use a random nonce for each session, long enough that it's practically guaranteed to be unique, and send the nonce together with the data. The other difference is that key derivation doesn't just change a few bits of the result when one of the parameters changes. A key derivation function (KDF) ensures that if even a single bit changes in one of the inputs, the outputs are completely different. Given the output of a KDF, there's no way to find the inputs, or to find the output of the same KDF for a different nonce with the same master secret.

Furthermore many protocols use ratcheting: rather than keeping a long-term master secret and deriving all session keys from it, they calculate a new master key each time. This protects against attackers who record encrypted conversations in the hope to discover the key one day. If a participant erases old keys regularly and their key gets compromised one day, the attacker will be able to decrypt future conversations, but not past conversations, since it's impossible to find older keys from the current master key, only newer keys.

$\endgroup$
1
$\begingroup$

The classic One Time Pad is actually viable for such a scenario. If they can keep it safe, and ensure they never re-use any part of it, they could just exchange 8TB hard drives full of pad material. With one pad per direction, if messages are 10kiB, that gives them 29 years worth of pad material. They'd have to occasionally copy the pad material to new drives, and would likely need some redundancy in practice, and would have to securely destroy the old drives as they wear out (a shredder is best), but it's perfectly secure otherwise.

The "meet once, exchange data, then never have a trusted channel again" scenario is exactly what One-Time pads are useful for. It's also why they're so rare in real use, because that's a very rare scenario.

$\endgroup$
6
  • $\begingroup$ Thank you for the answer but that does not fit my need, since they don't plan to meet again $\endgroup$ Commented Jan 9, 2022 at 20:30
  • 1
    $\begingroup$ That's the point of the OTP. If 29 years of 10kiB messages isn't enough, use bigger pads. $\endgroup$ Commented Jan 10, 2022 at 13:46
  • $\begingroup$ Yes I understand but I would like to find a solution to generate the key instead of stocking it somewhere before $\endgroup$ Commented Jan 10, 2022 at 13:56
  • 1
    $\begingroup$ The "never exchange keys again" is the hard part. It's quite easy to use something like the Signal protocol to get a good forward-secure key ratchet, but as stated the puzzle is much more difficult. Real-world protocols tend not to have such a restriction on the contents of communications. $\endgroup$ Commented Jan 11, 2022 at 18:39
  • 1
    $\begingroup$ en.wikipedia.org/wiki/Signal_Protocol and signal.org/docs $\endgroup$ Commented Jan 12, 2022 at 15:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.