<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">On Sat, 29 Aug 2020 04:32 +0100 Peter Fairbrother wrote:<div class=""><br class=""></div><div class=""><blockquote type="cite" class="">On 28/08/2020 23:30, Arnold Reinhold via cryptography wrote:<br class=""><br class=""><blockquote type="cite" class="">The first-principle security proof I do claim is for confidentiality <br class="">from people who do not have access to the current Terakey. In particular <br class="">they would not be able to mount the active attacks we have been <br class="">discussing. <br class=""></blockquote><br class="">Why do you say that? Of course an attacker could mount these attacks. <br class="">That is the entire point.<br class=""><br class="">While active chosen-key attacks are not straightforward to execute, they <br class="">are in the armamentarium of at least some potential attackers. They are <br class="">part of the literature. And more important, they are something which any <br class="">proof of confidentiality must take into account - ignoring them is like <br class="">building a huge strong gate but leaving holes in the fence for people to <br class="">walk through.<br class=""><br class=""><br class=""><br class="">Step 1, Mallory, who does not have access to the terakey, wants to <br class="">cryptanalyse a message ciphertext. First he breaks the PRNG.<br class=""><br class="">Mallory then knows the indicators for the terakey bytes used in the <br class="">message he wants to break, though he doesn't know the actual terakey <br class="">byte values.<br class=""><br class="">Step 2, he then finds a PRNG key which generates some of the same <br class="">indicators, and does a chosen-key known-plaintext attack, or two, or <br class="">seventy thousand. He gets someone who does know the terakey to encrypt a <br class="">known message with his chosen key. He then calculates the relevant <br class="">terakey byte values by comparing the known plaintext with the ciphertext.<br class=""><br class="">Step 3, he then uses his knowledge of the terakey bytes to break the <br class="">original message.<br class=""><br class=""><br class="">If you are talking in terms of _proof_, you cannot prove that Mallory <br class="">cannot do any or all of these steps. If he does them, he gets the <br class="">plaintext of any message he wants.<br class=""><br class=""><br class=""><br class=""><blockquote type="cite" class="">I appreciate your thoughts on Terakey, but at this point we don?t seem <br class="">to disagree so much about what Terakey does, <br class=""></blockquote><br class="">I strongly disagree.<br class=""><br class="">In terms of proof, it simply does not do what you say it does - it does <br class="">not provably protect 99.9% of the traffic. It does not provably protect <br class="">*ANY* of the traffic.<br class=""><br class="">To claim terakey provides provable security you have to prove that the <br class="">attack above is impossible. Nothing else will do.</blockquote></div><div class=""><br class=""></div><div class=""><div class="">What you are describing is a variant of standard attacks on stream ciphers (which Terakey is). And yes, they are well known in the literature and there are standard defenses that have been known since before World War II. I describe them in my paper[1] as an essential part of Terakey, as follows:</div><div class=""><p class="MsoBodyText">"Terakey consists of three major elements: ...</p><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>2. A method for assigning each message a unique message indicator v, which can be determined by a transmitted nonce, by hashing the message, by hashing just its header, from a prearranged list, communicated using a separate mechanism, such as conventional public key cryptography, or some combination of these methods”</div></div></div><div class=""><br class=""></div><div class="">These measures can prevent an attacker from getting "someone who does know the terakey to encrypt a </div>known message with his chosen key.” In particular, including an automatically generated random nonce, which is standard practice with modern stream ciphers, completely foils such an attack.<div class=""><br class=""></div><div class="">If you want to posit an insider with the necessary permissions to modify the Terakey software to inject a chosen PRNG seed, they can just as well read out the Terakey directly. No encryption system can survive an attack by someone who can modify the encryption software at will.</div><div class=""><br class=""></div><div class=""><div class="">Arnold Reinhold</div><div class=""><div class=""><br class=""></div><div class=""><div class="">[1] <a href="https://www.researchgate.net/publication/342697247" class="">https://www.researchgate.net/publication/342697247</a></div><ol style="margin-top:0in" start="1" type="1" class=""><li class="MsoNormal"><o:p class=""></o:p></li>
</ol>
<!--EndFragment--></div></div></div></body></html>