[messaging] Peerio

[Michael Hamburg]

Perhaps you should use oblivious function evaluation with a user-specific secret at the server.  So for example, server has a per-user secret key e, and user has a (salted, scrypted) password p.  Let h = hash(p) on some curve.

client chooses a uniformly random scalar r.
client -> server: Q = h^r
server -> client: P = Q^e = h^er
client computers P^1/r = h^e, and uses the hash of that point as part of the secret key derivation.

You can gate this interaction by the PIN code.  But even if an attacker can query it, under the one-more-DH assumption he needs N queries to check N passwords.

Cheers,
— Mike

> On Feb 28, 2015, at 11:57 AM, Nadim Kobeissi <nadim at nadim.computer> wrote:
> 
> Re. Trevor and dkg,
> I easily concede that further study is required. If it turns out our current passphrase model is not expensive enough, I'll hold myself to updating the Peerio client to have more stringent parameters on how generation is handled. I'm also open to improving derived-key storage in the near future. Again, I think this is overwhelmingly a threat-model issue. But the questions you raise are reasonable and I think it would be fruitful to work on improving the current model, preferably while Peerio is still in public beta.
> 
> On Sat, Feb 28, 2015 at 8:46 PM, Trevor Perrin <trevp at trevp.net <mailto:trevp at trevp.net>> wrote:
> On Fri, Feb 27, 2015 at 7:26 AM, Daniel Kahn Gillmor
> <dkg at fifthhorseman.net <mailto:dkg at fifthhorseman.net>> wrote:
> > On Fri 2015-02-27 04:50:19 -0500, Nadim Kobeissi wrote:
> >> On Thu, Feb 26, 2015 at 11:55 PM, Daniel Kahn Gillmor <dkg at fifthhorseman.net <mailto:dkg at fifthhorseman.net>> wrote:
> >>
> >>> I agree that this part of the peerio/minilock approach is pretty
> >>> disconcerting, and not just because it goes against years of practice
> >>> and convention.  it opens an obvious hole (offline dictionary attacks
> >>> for high-value key material) and i'd love to see some more analysis of
> >>> the underlying tradeoffs involved.
> >>
> >> My understanding is that any search would be currently simply too expensive.
> >
> > I'm glad to hear that.  Do you have pointers to details of your
> > analysis?  I'd love to read those thoughts.
> 
> 
> I echo dkg - I'd really like to see more analysis, it's not obvious
> the attack cost is that high.
> 
> Back of envelope:
> 
> The peerio scrypt parameters (N=2^14, r=8) have been estimated to take
> < 100 milliseconds on a single core of a 2009 Intel processor [1].
> Assuming I can rent cores at ~$0.04/hr [2] = $1/day, that means:
>  - about $1 per 2^20 (~1 million) guesses
>  - about $1K per 2^30 guesses
>  - about $1M per 2^40 guesses
> 
> How much entropy is in peerio passphrases?  The tutorial video [3]
> suggests choosing a sentence "that is unique to you, like moments
> shared with friends, or childhood memories", and gives a couple
> examples:
>  "My mother makes the best cheesecake." (36 chars)
>  "Waffles the cat had blue eyes" (29 chars)
> 
> You'll find various estimates for entropy-per-English character, but 1
> to 1.5 bits per character seems common [4].  This is very crude, but
> that would put sentences like above in the 30-50 bit range.  So it
> seems plausible that a million-dollar 2^40 attacker might have a good
> chance of success targeting a single account.
> 
> (I guess the zxcvbn password-strength-checker is estimating these as
> >100 bits entropy?  That seems high.  Maybe zxcvbn is tuned for
> passwords, not sentences?).
> 
> If the attacker spread his bets he'd do better.  For example, the
> milllion-dollar attacker could try a billion common phrases against a
> thousand accounts.  Specialized hardware would be even more efficient.
> 
> Note also that this is a powerful attack - if it succeeds, the
> attacker can log in as you and read your old messages, without needing
> server compromise or traffic interception.
> 
> Anyways, these numbers are so rough there's huge uncertainty - maybe
> people will do a good job choosing weird, high-entropy sentences.  Or
> maybe they'll just choose song lyrics, or simple facts about their
> life well known to their estranged spouse / family members.  I don't
> know what data exists for this, it would be a great M-Turk study.
> 
> 
> Trevor
> 
> 
> [1] http://www.tarsnap.com/scrypt/scrypt.pdf <http://www.tarsnap.com/scrypt/scrypt.pdf>
> [2] https://cloud.google.com/compute/#pricing <https://cloud.google.com/compute/#pricing>
> [3] https://www.youtube.com/watch?v=1jrtAnwHU14 <https://www.youtube.com/watch?v=1jrtAnwHU14>
> [4] http://en.wikipedia.org/wiki/Entropy_(information_theory) <http://en.wikipedia.org/wiki/Entropy_(information_theory)>
> 
> _______________________________________________
> Messaging mailing list
> Messaging at moderncrypto.org
> https://moderncrypto.org/mailman/listinfo/messaging

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://moderncrypto.org/mail-archive/messaging/attachments/20150228/a5330fa2/attachment.html>