<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<p style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;vertical-align:baseline">
<span style="mso-ascii-font-family:
Calibri;mso-fareast-font-family:"Times New Roman";mso-hansi-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";color:black">Hello Memory Vandal,<o:p></o:p></span></p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;vertical-align:baseline">
<span style="mso-ascii-font-family:
Calibri;mso-fareast-font-family:"Times New Roman";mso-hansi-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";color:black"><o:p> </o:p></span></p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;vertical-align:baseline">
<span style="mso-ascii-font-family:
Calibri;mso-fareast-font-family:"Times New Roman";mso-hansi-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";color:black">Greetings!!<o:p></o:p></span></p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;vertical-align:baseline">
<span style="mso-ascii-font-family:
Calibri;mso-fareast-font-family:"Times New Roman";mso-hansi-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";color:black"><o:p> </o:p></span></p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;vertical-align:baseline">
<span style="mso-ascii-font-family:
Calibri;mso-fareast-font-family:"Times New Roman";mso-hansi-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";color:black">Thank you for taking out the time to read the paper and providing your valuable feedback
which brings to forefront a point which was low on the radar all this while. <o:p></o:p></span></p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;vertical-align:baseline">
<span style="mso-ascii-font-family:
Calibri;mso-fareast-font-family:"Times New Roman";mso-hansi-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";color:black"><o:p> </o:p></span></p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;vertical-align:baseline">
<span style="mso-ascii-font-family:
Calibri;mso-fareast-font-family:"Times New Roman";mso-hansi-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";color:black">You are absolutely right that the hackers can write their own code, crack private key via
QC and decrypt the data and ignore Device ID<o:p></o:p></span></p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;vertical-align:baseline">
<span style="mso-ascii-font-family:
Calibri;mso-fareast-font-family:"Times New Roman";mso-hansi-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";color:black">The ultimate solution to this problem is that instead of application, embed Device ID technology
directly into the encryption algorithm - there is no other way out. Then the Algo, along with usual crypto operations, will also check Device ID as described in the paper and stop the process if device is found to be rouge.
<o:p></o:p></span></p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;vertical-align:baseline">
<span style="mso-ascii-font-family:
Calibri;mso-fareast-font-family:"Times New Roman";mso-hansi-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";color:black"><o:p> </o:p></span></p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;vertical-align:baseline">
<span style="mso-ascii-font-family:
Calibri;mso-fareast-font-family:"Times New Roman";mso-hansi-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";color:black">And when we do that, it essentially means that we develop a new crypto!! Since we will modify
RSA and ECC, let’s call them RSA+/ECC+ for now. The bad guys cannot bypass the Algo. Right? Applications vendors can then embed this crypto algo into their application instead of integrating directly with such a DeviceID. <o:p></o:p></span></p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;vertical-align:baseline">
<span style="mso-ascii-font-family:
Calibri;mso-fareast-font-family:"Times New Roman";mso-hansi-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";color:black"><o:p> </o:p></span></p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;vertical-align:baseline">
<span style="mso-ascii-font-family:
Calibri;mso-fareast-font-family:"Times New Roman";mso-hansi-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";color:black">I agree this sounds over simplistic and honestly, at this stage I am not sure
<o:p></o:p></span></p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;vertical-align:baseline">
<span style="mso-ascii-font-family:
Calibri;mso-fareast-font-family:"Times New Roman";mso-hansi-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";color:black">A) Exactly where in the encryption/decryption process should Device ID technique be embeded
and <o:p></o:p></span></p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;vertical-align:baseline">
<span style="mso-ascii-font-family:
Calibri;mso-fareast-font-family:"Times New Roman";mso-hansi-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";color:black">B) Whether apart from the Algo itself, will we require a code snippet. If so, it will impact
integration with applications. <o:p></o:p></span></p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;vertical-align:baseline">
<span style="mso-ascii-font-family:
Calibri;mso-fareast-font-family:"Times New Roman";mso-hansi-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";color:black">Clearly there is lot more to be done. But at a conceptual level, I think we have a soluiton.
I will revert back with modified approach and concept document hopefully with some illustrations/diagrams.
<o:p></o:p></span></p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;vertical-align:baseline">
<span style="mso-ascii-font-family:
Calibri;mso-fareast-font-family:"Times New Roman";mso-hansi-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";color:black"><o:p> </o:p></span></p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;vertical-align:baseline">
<span style="mso-ascii-font-family:
Calibri;mso-fareast-font-family:"Times New Roman";mso-hansi-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";color:black">What was and still is fundamental, is to ensure that the Device ID technique is fool proof.
I know few Device ID techniques which are prone to MITM or some form of Malware. Once we have a robust Device ID (which I think we have now), its half the battle won.
<o:p></o:p></span></p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<o:p> </o:p></p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
Have a nice weekend all!!<o:p></o:p></p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<o:p> </o:p></p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
Regards<o:p></o:p></p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
Govind<o:p></o:p></p>
<br>
</div>
<div id="signature">
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Memory Vandal <memvandal@gmail.com><br>
<b>Sent:</b> Thursday, June 7, 2018 6:45 AM<br>
<b>To:</b> Govind Yadav<br>
<b>Cc:</b> cryptography@metzdowd.com; Natasha Aidinyantz<br>
<b>Subject:</b> Re: [Cryptography] Data Protection Against Quantum Computing Brute Force via Device ID</font>
<div> </div>
</div>
<meta content="text/html; charset=utf-8">
<div>
<div dir="ltr">
<div>Hi Govind,</div>
<div><br>
</div>
<div>Your paper is not clearly describing the Device ID technology that you propose.
<br>
</div>
<div><br>
</div>
<div>From what it looks from the description, the Device ID is used only for authentication and its not really used to encrypt the actual data. This is considering the fact the Device ID is getting added to the digital certificate and can be read by anyone
since its in plain text.</div>
<div><br>
</div>
<div>You seem to make assumption that an adversary who has access to quantum computing will use only the official software application (e.g. text editor with embedded support for Device ID) and that the software will deny access to data even with correct private
key that has been cracked.</div>
<div><br>
</div>
<div>Have you considered that the adversary will use its own code to crack the keys and also to decrypt the data and totally ignore the Device ID?</div>
<div><br>
</div>
<div>Regards,</div>
<div>
<div class="x_gmail_extra"><br clear="all">
<div>
<div class="x_gmail_signature">MemoryVandal<br>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>