<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>On 2/26/2018 3:40 PM, Viktor Dukhovni wrote:
</p>
<blockquote type="cite"
cite="mid:455CA4E0-5E4B-4CC7-9F19-187D31CC59ED@dukhovni.org">
<blockquote type="cite" style="color: #000000;">
<pre wrap="">On Feb 26, 2018, at 6:23 PM, Jimmy Hess <a class="moz-txt-link-rfc2396E" href="mailto:mysidia@gmail.com" moz-do-not-send="true"><mysidia@gmail.com></a> wrote:
</pre>
<blockquote type="cite" style="color: #000000;">
<pre wrap="">Another easy to describe approach, be it at a higher memory cost, is a
random permutation of 2<sup class="moz-txt-sup"><span style="display:inline-block;width:0;height:0;overflow:hidden">^</span>32</sup> 4 byte elements requires just 16GB of storage.
</pre>
</blockquote>
<pre wrap="">1* Arguably "bespoke 32-bit block cipher".... and "In-Place
Scrambling" are questionable.
I would have some doubts about the strength of the cipher.</pre>
</blockquote>
</blockquote>
<br>
The filter that they use is IPCrypt
(<a class="moz-txt-link-freetext" href="https://github.com/veorq/ipcrypt">https://github.com/veorq/ipcrypt</a>) designed by Jean-Philippe
Aumasson. It takes a 128 bit key, splits it into 4 32 bit words, and
combines it with the input as follow:<br>
<br>
input -> XOR(Key1) -> Permutation -> XOR(key2)
->Permutation -> XOR(key3) -> Permutation-> XOR(key4)
-> output<br>
<br>
The permutation is effected by splitting the 32 bit word in 4
octets, and then doing a series of rotations, additions and XOR
combination of these octets.<br>
<br>
The design has limitations, such as not being robust to some related
key attacks, but is seems otherwise to be fairly natural.<br>
<br>
<blockquote type="cite"
cite="mid:455CA4E0-5E4B-4CC7-9F19-187D31CC59ED@dukhovni.org">
<blockquote type="cite" style="color: #000000;">
<pre wrap="">
</pre>
</blockquote>
<pre wrap="">Keyed ciphers try to be indistinguishable from a random permutation, an
actual random permutation is about as strong as it gets.
What is unavoidably problematic is that the same input needs to
produce the same output each time. But this, IIRC, is a requirement,
the mapping should keep distinct inputs distinct and identical inputs
identical. That is a permutation (random or secret-keyed) is required.</pre>
</blockquote>
<br>
I understand that when collecting logs they are rotating keys very
frequently, in part for that reason. In any case, the working set of
IP addresses seen by a DNS resolver is well below 4 billions. I
would be surprised if it was more than a few millions, maybe a few
tens of millions for very large providers.<br>
<br>
-- Christian Huitema<br>
</body>
</html>