<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Jul 28, 2020, at 4:05 PM, Ben Laurie <<a href="mailto:ben@links.org" class="">ben@links.org</a>> wrote:</div><div class=""><div dir="ltr" class=""><div dir="ltr" class=""><br class=""></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, 28 Jul 2020 at 00:49, Arnold Reinhold via cryptography <<a href="mailto:cryptography@metzdowd.com" class="">cryptography@metzdowd.com</a>> wrote:</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
Thanks for your comments. What I am doing is quite similar to the additive books you describe, with the important difference that because mass storage has gotten so cheap, we can afford to make the “book” tens of millions of times bigger than what was possible in WW II. Most of the security of Terakey is based on this fact alone.<br class=""></blockquote><div class=""><br class=""></div><div class="">Tens of million times bigger means you can do 3s of thousands times as much traffic. I suspect we do a lot more than that, relative to WWII.</div><div class=""><br class=""></div></div></div>
</div></blockquote></div><br class=""><div class="">I am not proposing Terakey as a replacement for all current encryption. You wouldn’t use it to directly encrypt a 4K video stream. I envision it being used for high value communications on relatively small networks, an international bank, say, or as a backup system for coordinating response to a cyber attack where the PKI infrastructure is in doubt. A one terabyte key can comfortably protect a gigabyte of data. That is a lot of text messages. Terakey can also be used to exchange symmetric keys, similarly to Quantum Key Distribution. in that mode a one terabyte key can protect one AES key exchanged per second for a year, a speed comparable to current QKD systems over long distances. And even that limitation is based on the very conservative assumption that an attacker has acquired the key used to encrypt most previous messages, not just the plaintext.</div><div class=""><br class=""></div><div class="">Current public key systems rely on mathematical problems whose difficulty is conjectured, not proven. This is a single point of failure with a probability that is not quantifiable. Progress in mathematics is extremely sporadic. Problems that have stymied great mathematicians for centuries have been solved in recent memory. I’m not saying a breakthrough is likely any time soon, just that having some backup might be a good idea.</div><div class=""><br class=""></div><div class="">On 28 Jul 2020 12:11 +0100 Peter Fairbrother wrote:</div><div class=""><br class=""></div><div class=""><blockquote type="cite" class=""><blockquote type="cite" class=""><br class="">The security analysis then consists of estimating the likelihood of a cypherbyte already known to the attacker <br class=""></blockquote><br class="">Oh no no no. That might be your analysis, but it isn't the only analysis.<br class=""><br class="">Suppose I am the NSA and manage to tweak the PRNG to my nefarious means.<br class=""><br class="">Perhaps I can arrange that 1 in 3 selections is to a limited set of <br class="">terabyte bytes. After getting some known plain/cyphertext traffic I can <br class="">read 1/3 of the plaintext characters - enough to do serious damage.<br class=""></blockquote><br class=""></div><div class="">If the NSA can tweak my algorithm, they can make it emit rot13, or an apparently strong PRNG stream where they know most of the seed. That is true of any crypto system. If I have somehow created the impression that I am proposing the PRNG be something that is negotiated between the parties, my fault for not being clear. I did not specify a specific PRNG because I wanted to consider ones that were reversible vs ones that were based on security primitives. A Terakey system fielded would have a fixed PRNG. If you like, the one specified in NIST SP 800-90A Rev 1, section 10.2, using a block cipher such as AES-256 or whichever block cipher is being used with key exchange mode.</div><div class=""><br class=""></div><div class="">Arnold Reinhold</div><div class=""><br class=""></div><div class=""><br class=""></div></body></html>