📅 Original date posted:2021-02-12
📝 Original message:If HUMAN_READABLE_TITLE is the additional secret, the user would need
to enter it on the device in addition to the nonce, wouldn't it defeat
the advantage in UX that was gained by using (relatively) short nonce ?
Is 64 bit nonce not enough ?
It seems that to crack this with fixed Pwd and 64 bit nonce, the
attacker will need to be about 10^15 more powerful than 80Mhz MCU:
(2^64)/(0.3*10^15)/3600 = 17 hours. I don't know if 10^15 is realistic
scale. Average desktop cpu seems to be about 10^3 more powerful than
the mentioned MCU for this task.
Maybe for the UX it would be better to choose the number of rounds to
use in PBKDF2, instead of using variable Pwd. Number of rounds will be
easier to enter on the device (or just choose it from a set of
pre-defined values). The more money is at stake, the higher number of
rounds could the coordinator choose (taking into account the
characteristics of the participant devices)
В Fri, 12 Feb 2021 08:55:55 -0800
Hugo Nguyen <hugo at nunchuk.io> wrote:
> Thanks everyone who has provided inputs so far!
>
> This is the new proposal for the encryption aspect of the scheme,
> based on all the feedback.
>
> The key derivation function would be PBKDF2, with PRF = SHA512. This
> should be readily available on today's hardware already, as they are
> used for BIP39.
>
> DK = PBKDF2(PRF, Password, Salt, c, dkLen)
> PRF = SHA512
> Pwd = HUMAN_READABLE_TITLE
> Salt = NONCE
> c = 2048
> dkLen = 256
>
> HUMAN_READABLE_TITLE is in ASCII format, minimum length = 8, maximum
> length = 20.
> NONCE is a 64-bit number.
>
> Reason for going with SHA512 is due to legacy support on some
> hardware. c=2048 also mimics BIP39. It takes about ~3 seconds to
> derive the encryption key on a 80Mhz MCU. We feel like this is a good
> enough tradeoff for this use case. The assumption here is that the
> secure session is only needed temporarily for a few hours, maybe up
> to one day.
>
> The Coordinator and Signers agree and exchange these 2 secrets prior
> to the setup. The NONCE can be converted to either:
> (a) a 6-word phrase using BIP39 wordlist
> (b) a 20-digit decimal number
> (c) a QR code
>
> Depending on the vendor. This flexibility in the data format allows
> each vendor to customize the UX based on their respective device
> capabilities.
>
> Best,
> Hugo
>
> On Thu, Feb 11, 2021 at 8:25 AM Dmitry Petukhov via bitcoin-dev <
> bitcoin-dev at lists.linuxfoundation.org> wrote:
>
> > В Thu, 11 Feb 2021 05:45:33 -0800
> > Hugo Nguyen via bitcoin-dev <bitcoin-dev at lists.linuxfoundation.org>
> > wrote:
> >
> > > > > ENCRYPTION_KEY = SHA256(SHA256(TOKEN))
> > > >
> > > > This scheme might be vulnerable to rainbow table attack.
> > > >
> > >
> > > Thank you for pointing this out! Incidentally, Dmitry Petukhov
> > > also told me the same privately.
> >
> > My thought was that if TOKEN has the characteristics of a password
> > (short ASCII string), then it would be better to use key derivation
> > function designed for passwords, like PBKDF2.
> >
> > The counter-argument to this is that this adds another code
> > dependency for vendors, if the device firmware does not already
> > have the required key derivation function.
> >
> > Maybe this could be solved by going into opposite direction - make
> > the "token" even longer, use the mnemoic.
> >
> > The issue is that entering long data of the shared key into the
> > device manually is difficult UX-wise.
> >
> > Hww vendors that allow to enter custom keys into their device
> > already have to face this issue, and those who allow to enter
> > custom keys via mnemonic probably tackled this somehow.
> >
> > Maybe the shared key for multisig setup can be entered in the same
> > way ? (with maybe additional visual check via some fingerprint).
> >
> > Although we would then have another issue of potential confusion
> > between two procedures (entering the main key and entering the
> > shared key for multisig setup), and the measures has to be taken to
> > prevent such confusion.
> >
> > The approaches can be combined - specify a key derivation function
> > suitable for passwords; via secure channel, share a password and/or
> > the derived key. If hww supports derivation function, it can derive
> > the key from password. If hww supports only keys, the key can be
> > entered raw or via mnemonic.
> > _______________________________________________
> > bitcoin-dev mailing list
> > bitcoin-dev at lists.linuxfoundation.org
> > https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
> >
Dmitry Petukhov [ARCHIVE] /
npub10r…9afdw
2023-06-07 18:28:36
in reply to nevent1q…6v05
Author Public Key
npub10r66s2stvnancx9axwnfc5a34asjkwkgmkq7ztm5hf30x7fa4szsv9afdwPublished at
2023-06-07 18:28:36Event JSON
{
"id": "d63ddb377600cc91302bc28ea9ef53874d0458c9540efcadda2e44e4698680b8",
"pubkey": "78f5a82a0b64fb3c18bd33a69c53b1af612b3ac8dd81e12f74ba62f3793dac05",
"created_at": 1686162516,
"kind": 1,
"tags": [
[
"e",
"86ad6c37ed92954d8359f9dbcd43bb8becf51e4b072d4e707f08909fe0306de5",
"",
"root"
],
[
"e",
"96bfea1c443efdf3946d27efdf44a064dd7d8ddaf79be6280fbbb31efa3fb0eb",
"",
"reply"
],
[
"p",
"900d0aa57c9ef670488e2c0efb871d265d6926e13726d517e503044f1806ab78"
]
],
"content": "📅 Original date posted:2021-02-12\n📝 Original message:If HUMAN_READABLE_TITLE is the additional secret, the user would need\nto enter it on the device in addition to the nonce, wouldn't it defeat\nthe advantage in UX that was gained by using (relatively) short nonce ?\n\nIs 64 bit nonce not enough ?\n\nIt seems that to crack this with fixed Pwd and 64 bit nonce, the\nattacker will need to be about 10^15 more powerful than 80Mhz MCU:\n(2^64)/(0.3*10^15)/3600 = 17 hours. I don't know if 10^15 is realistic\nscale. Average desktop cpu seems to be about 10^3 more powerful than\nthe mentioned MCU for this task.\n\nMaybe for the UX it would be better to choose the number of rounds to\nuse in PBKDF2, instead of using variable Pwd. Number of rounds will be\neasier to enter on the device (or just choose it from a set of\npre-defined values). The more money is at stake, the higher number of\nrounds could the coordinator choose (taking into account the\ncharacteristics of the participant devices)\n\nВ Fri, 12 Feb 2021 08:55:55 -0800\nHugo Nguyen \u003chugo at nunchuk.io\u003e wrote:\n\n\u003e Thanks everyone who has provided inputs so far!\n\u003e \n\u003e This is the new proposal for the encryption aspect of the scheme,\n\u003e based on all the feedback.\n\u003e \n\u003e The key derivation function would be PBKDF2, with PRF = SHA512. This\n\u003e should be readily available on today's hardware already, as they are\n\u003e used for BIP39.\n\u003e \n\u003e DK = PBKDF2(PRF, Password, Salt, c, dkLen)\n\u003e PRF = SHA512\n\u003e Pwd = HUMAN_READABLE_TITLE\n\u003e Salt = NONCE\n\u003e c = 2048\n\u003e dkLen = 256\n\u003e \n\u003e HUMAN_READABLE_TITLE is in ASCII format, minimum length = 8, maximum\n\u003e length = 20.\n\u003e NONCE is a 64-bit number.\n\u003e \n\u003e Reason for going with SHA512 is due to legacy support on some\n\u003e hardware. c=2048 also mimics BIP39. It takes about ~3 seconds to\n\u003e derive the encryption key on a 80Mhz MCU. We feel like this is a good\n\u003e enough tradeoff for this use case. The assumption here is that the\n\u003e secure session is only needed temporarily for a few hours, maybe up\n\u003e to one day.\n\u003e \n\u003e The Coordinator and Signers agree and exchange these 2 secrets prior\n\u003e to the setup. The NONCE can be converted to either:\n\u003e (a) a 6-word phrase using BIP39 wordlist\n\u003e (b) a 20-digit decimal number\n\u003e (c) a QR code\n\u003e \n\u003e Depending on the vendor. This flexibility in the data format allows\n\u003e each vendor to customize the UX based on their respective device\n\u003e capabilities.\n\u003e \n\u003e Best,\n\u003e Hugo\n\u003e \n\u003e On Thu, Feb 11, 2021 at 8:25 AM Dmitry Petukhov via bitcoin-dev \u003c\n\u003e bitcoin-dev at lists.linuxfoundation.org\u003e wrote:\n\u003e \n\u003e \u003e В Thu, 11 Feb 2021 05:45:33 -0800\n\u003e \u003e Hugo Nguyen via bitcoin-dev \u003cbitcoin-dev at lists.linuxfoundation.org\u003e\n\u003e \u003e wrote:\n\u003e \u003e \n\u003e \u003e \u003e \u003e \u003e ENCRYPTION_KEY = SHA256(SHA256(TOKEN)) \n\u003e \u003e \u003e \u003e\n\u003e \u003e \u003e \u003e This scheme might be vulnerable to rainbow table attack.\n\u003e \u003e \u003e \u003e \n\u003e \u003e \u003e\n\u003e \u003e \u003e Thank you for pointing this out! Incidentally, Dmitry Petukhov\n\u003e \u003e \u003e also told me the same privately. \n\u003e \u003e\n\u003e \u003e My thought was that if TOKEN has the characteristics of a password\n\u003e \u003e (short ASCII string), then it would be better to use key derivation\n\u003e \u003e function designed for passwords, like PBKDF2.\n\u003e \u003e\n\u003e \u003e The counter-argument to this is that this adds another code\n\u003e \u003e dependency for vendors, if the device firmware does not already\n\u003e \u003e have the required key derivation function.\n\u003e \u003e\n\u003e \u003e Maybe this could be solved by going into opposite direction - make\n\u003e \u003e the \"token\" even longer, use the mnemoic.\n\u003e \u003e\n\u003e \u003e The issue is that entering long data of the shared key into the\n\u003e \u003e device manually is difficult UX-wise.\n\u003e \u003e\n\u003e \u003e Hww vendors that allow to enter custom keys into their device\n\u003e \u003e already have to face this issue, and those who allow to enter\n\u003e \u003e custom keys via mnemonic probably tackled this somehow.\n\u003e \u003e\n\u003e \u003e Maybe the shared key for multisig setup can be entered in the same\n\u003e \u003e way ? (with maybe additional visual check via some fingerprint).\n\u003e \u003e\n\u003e \u003e Although we would then have another issue of potential confusion\n\u003e \u003e between two procedures (entering the main key and entering the\n\u003e \u003e shared key for multisig setup), and the measures has to be taken to\n\u003e \u003e prevent such confusion.\n\u003e \u003e\n\u003e \u003e The approaches can be combined - specify a key derivation function\n\u003e \u003e suitable for passwords; via secure channel, share a password and/or\n\u003e \u003e the derived key. If hww supports derivation function, it can derive\n\u003e \u003e the key from password. If hww supports only keys, the key can be\n\u003e \u003e entered raw or via mnemonic.\n\u003e \u003e _______________________________________________\n\u003e \u003e bitcoin-dev mailing list\n\u003e \u003e bitcoin-dev at lists.linuxfoundation.org\n\u003e \u003e https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev\n\u003e \u003e",
"sig": "0b83032be90c0bb66e7050f03742c0254e4aeef7f04d8ed862cd8c5e65e0fd7c5e73de1f2647047a7da0d73c3a7ce1f9f540b7d3cfbd1337e353a153ba8b7006"
}