đź“… Original date posted:2015-02-05
📝 Original message:On 02/05/2015 04:04 PM, MⒶrtin HⒶboⓋštiak wrote:
> That's exactly what I though when seeing the RedPhone code, but after
> I studied the commit protocol I realized it's actually secure and
> convenient way to do it. You should do that too. :)
I was analyzing the model as you described it to me. A formal analysis
of the security model of a particular implementation, based on inference
from source code, is a bit beyond what I signed up for. But I'm
perfectly willing to comment on your description of the model if you are
willing to indulge me.
> Shortly, how it works:
> The initiator of the connection sends commit message containing the
> hash of his temporary public ECDH part, second party sends back their
> public ECDH part and then initiator sends his public ECDH part in
> open. All three messages are hashed together and the first two bytes
> are used to select two words from a shared dictionary which are
> displayed on the screen of both the initiator and the second party.
> The parties communicate those two words and verify they match.
How do they compare words if they haven't yet established a secure channel?
> If an attacker wants to do MITM, he has a chance of choosing right
> public parts 1:65536. There is no way to brute-force it, since that
> would be noticed immediately. If instead of two words based on the
> first two bytes, four words from BIP39 wordlist were chosen, it would
> provide entropy of 44 bits which I believe should be enough even for
> paranoid people.
>
> How this would work in Bitcoin payment scenario: user's phone
> broadcasts his name, merchant inputs amount and selects the name from
> the list, commit message is sent (and then the remaining two
> messages), merchant spells four words he sees on the screen and buyer
> confirms transaction after verifying that words match.
So the assumption is that there exists a secure (as in proximity-based)
communication channel?
e
> 2015-02-06 0:46 GMT+01:00 Eric Voskuil <eric at voskuil.org>:
>> On 02/05/2015 03:36 PM, MⒶrtin HⒶboⓋštiak wrote:
>>>> A BIP-70 signed payment request in the initial broadcast can resolve the
>>>> integrity issues, but because of the public nature of the broadcast
>>>> coupled with strong public identity, the privacy compromise is much
>>>> worse. Now transactions are cryptographically tainted.
>>>>
>>>> This is also the problem with BIP-70 over the web. TLS and other
>>>> security precautions aside, an interloper on the communication, desktop,
>>>> datacenter, etc., can capture payment requests and strongly correlate
>>>> transactions to identities in an automated manner. The payment request
>>>> must be kept private between the parties, and that's hard to do.
>>>
>>> What about using encryption with forward secrecy? Merchant would
>>> generate signed request containing public ECDH part, buyer would send
>>> back transaction encrypted with ECDH and his public ECDH part. If
>>> receiving address/amount is meant to be private, use commit protocol
>>> (see ZRTP/RedPhone) and short authentication phrase (which is hard to
>>> spoof thanks to commit protocol - see RedPhone)?
>>
>> Hi Martin,
>>
>> The problem is that you need to verify the ownership of the public key.
>> A MITM can substitute the key. If you don't have verifiable identity
>> associated with the public key (PKI/WoT), you need a shared secret (such
>> as a secret phrase). But the problem is then establishing that secret
>> over a public channel.
>>
>> You can bootstrap a private session over the untrusted network using a
>> trusted public key (PKI/WoT). But the presumption is that you are
>> already doing this over the web (using TLS). That process is subject to
>> attack at the CA. WoT is not subject to a CA attack, because it's
>> decentralized. But it's also not sufficiently deployed for some scenarios.
>>
>> e
>>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: OpenPGP digital signature
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20150205/bcba6fb2/attachment.sig>;
Eric Voskuil [ARCHIVE] /
npub1sg…ppx3c
2023-06-07 15:29:47
in reply to nevent1q…rnm3
Author Public Key
npub1sgs97fe0n9wehe6zw7drcxdz4cy9yt9pfqjv8gasz5jlk4zezc0quppx3cPublished at
2023-06-07 15:29:47Event JSON
{
"id": "f2667ec50839a57c2f25ce3cdcc09c65c6e8dd64591d672587bcf48456789744",
"pubkey": "82205f272f995d9be742779a3c19a2ae08522ca14824c3a3b01525fb5459161e",
"created_at": 1686151787,
"kind": 1,
"tags": [
[
"e",
"5faa01afc6e1169d2a086249776b02fde5bfa851fa5197990b9cbcbf92c53f4a",
"",
"root"
],
[
"e",
"3a5713ebcfda905c4039cfc74c21c6f1d87c3d4248388c0b868f223265810427",
"",
"reply"
],
[
"p",
"8e86fc16ba0a39c10614cf22b657d2bd0244999b590ae5f82344a361ed4121f2"
]
],
"content": "📅 Original date posted:2015-02-05\n📝 Original message:On 02/05/2015 04:04 PM, MⒶrtin HⒶboⓋštiak wrote:\n\u003e That's exactly what I though when seeing the RedPhone code, but after\n\u003e I studied the commit protocol I realized it's actually secure and\n\u003e convenient way to do it. You should do that too. :)\n\nI was analyzing the model as you described it to me. A formal analysis\nof the security model of a particular implementation, based on inference\nfrom source code, is a bit beyond what I signed up for. But I'm\nperfectly willing to comment on your description of the model if you are\nwilling to indulge me.\n\n\u003e Shortly, how it works:\n\u003e The initiator of the connection sends commit message containing the\n\u003e hash of his temporary public ECDH part, second party sends back their\n\u003e public ECDH part and then initiator sends his public ECDH part in\n\u003e open. All three messages are hashed together and the first two bytes\n\u003e are used to select two words from a shared dictionary which are\n\u003e displayed on the screen of both the initiator and the second party.\n\n\u003e The parties communicate those two words and verify they match.\n\nHow do they compare words if they haven't yet established a secure channel?\n\n\u003e If an attacker wants to do MITM, he has a chance of choosing right\n\u003e public parts 1:65536. There is no way to brute-force it, since that\n\u003e would be noticed immediately. If instead of two words based on the\n\u003e first two bytes, four words from BIP39 wordlist were chosen, it would\n\u003e provide entropy of 44 bits which I believe should be enough even for\n\u003e paranoid people.\n\u003e \n\u003e How this would work in Bitcoin payment scenario: user's phone\n\u003e broadcasts his name, merchant inputs amount and selects the name from\n\u003e the list, commit message is sent (and then the remaining two\n\u003e messages), merchant spells four words he sees on the screen and buyer\n\u003e confirms transaction after verifying that words match.\n\nSo the assumption is that there exists a secure (as in proximity-based)\ncommunication channel?\n\ne\n\n\u003e 2015-02-06 0:46 GMT+01:00 Eric Voskuil \u003ceric at voskuil.org\u003e:\n\u003e\u003e On 02/05/2015 03:36 PM, MⒶrtin HⒶboⓋštiak wrote:\n\u003e\u003e\u003e\u003e A BIP-70 signed payment request in the initial broadcast can resolve the\n\u003e\u003e\u003e\u003e integrity issues, but because of the public nature of the broadcast\n\u003e\u003e\u003e\u003e coupled with strong public identity, the privacy compromise is much\n\u003e\u003e\u003e\u003e worse. Now transactions are cryptographically tainted.\n\u003e\u003e\u003e\u003e\n\u003e\u003e\u003e\u003e This is also the problem with BIP-70 over the web. TLS and other\n\u003e\u003e\u003e\u003e security precautions aside, an interloper on the communication, desktop,\n\u003e\u003e\u003e\u003e datacenter, etc., can capture payment requests and strongly correlate\n\u003e\u003e\u003e\u003e transactions to identities in an automated manner. The payment request\n\u003e\u003e\u003e\u003e must be kept private between the parties, and that's hard to do.\n\u003e\u003e\u003e\n\u003e\u003e\u003e What about using encryption with forward secrecy? Merchant would\n\u003e\u003e\u003e generate signed request containing public ECDH part, buyer would send\n\u003e\u003e\u003e back transaction encrypted with ECDH and his public ECDH part. If\n\u003e\u003e\u003e receiving address/amount is meant to be private, use commit protocol\n\u003e\u003e\u003e (see ZRTP/RedPhone) and short authentication phrase (which is hard to\n\u003e\u003e\u003e spoof thanks to commit protocol - see RedPhone)?\n\u003e\u003e\n\u003e\u003e Hi Martin,\n\u003e\u003e\n\u003e\u003e The problem is that you need to verify the ownership of the public key.\n\u003e\u003e A MITM can substitute the key. If you don't have verifiable identity\n\u003e\u003e associated with the public key (PKI/WoT), you need a shared secret (such\n\u003e\u003e as a secret phrase). But the problem is then establishing that secret\n\u003e\u003e over a public channel.\n\u003e\u003e\n\u003e\u003e You can bootstrap a private session over the untrusted network using a\n\u003e\u003e trusted public key (PKI/WoT). But the presumption is that you are\n\u003e\u003e already doing this over the web (using TLS). That process is subject to\n\u003e\u003e attack at the CA. WoT is not subject to a CA attack, because it's\n\u003e\u003e decentralized. But it's also not sufficiently deployed for some scenarios.\n\u003e\u003e\n\u003e\u003e e\n\u003e\u003e\n\n-------------- next part --------------\nA non-text attachment was scrubbed...\nName: signature.asc\nType: application/pgp-signature\nSize: 473 bytes\nDesc: OpenPGP digital signature\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20150205/bcba6fb2/attachment.sig\u003e",
"sig": "558a4829e34e61e5fe7bca57f4b27de739e7c3368f5bcbd23cd8d014acc47ea2e5b3c3c734eef02114e78e4dd6112d5e5941728da81a91f6ff8cfd7f7d73893c"
}