๐
Original date posted:2021-02-11
๐ Original message:ะ Thu, 11 Feb 2021 05:45:33 -0800
Hugo Nguyen via bitcoin-dev <bitcoin-dev at lists.linuxfoundation.org>
wrote:
> > > ENCRYPTION_KEY = SHA256(SHA256(TOKEN))
> >
> > This scheme might be vulnerable to rainbow table attack.
> >
>
> Thank you for pointing this out! Incidentally, Dmitry Petukhov also
> told me the same privately.
My thought was that if TOKEN has the characteristics of a password
(short ASCII string), then it would be better to use key derivation
function designed for passwords, like PBKDF2.
The counter-argument to this is that this adds another code dependency
for vendors, if the device firmware does not already have the required
key derivation function.
Maybe this could be solved by going into opposite direction - make the
"token" even longer, use the mnemoic.
The issue is that entering long data of the shared key into the device
manually is difficult UX-wise.
Hww vendors that allow to enter custom keys into their device already
have to face this issue, and those who allow to enter custom keys via
mnemonic probably tackled this somehow.
Maybe the shared key for multisig setup can be entered in the same way
? (with maybe additional visual check via some fingerprint).
Although we would then have another issue of potential confusion
between two procedures (entering the main key and entering the shared
key for multisig setup), and the measures has to be taken to prevent
such confusion.
The approaches can be combined - specify a key derivation function
suitable for passwords; via secure channel, share a password and/or the
derived key. If hww supports derivation function, it can derive the key
from password. If hww supports only keys, the key can be entered raw or
via mnemonic.
Dmitry Petukhov [ARCHIVE] /
npub10rโฆ9afdw
2023-06-07 18:28:34
in reply to nevent1qโฆntfr
Author Public Key
npub10r66s2stvnancx9axwnfc5a34asjkwkgmkq7ztm5hf30x7fa4szsv9afdwPublished at
2023-06-07 18:28:34Event JSON
{
"id": "17f473b7f3152db78f286010e339dcb826730ad80d3609959ee77513145da30a",
"pubkey": "78f5a82a0b64fb3c18bd33a69c53b1af612b3ac8dd81e12f74ba62f3793dac05",
"created_at": 1686162514,
"kind": 1,
"tags": [
[
"e",
"86ad6c37ed92954d8359f9dbcd43bb8becf51e4b072d4e707f08909fe0306de5",
"",
"root"
],
[
"e",
"840c38478e145f3edcd91e16f5ee9c7af37b107e67216a4627542a670006a2c4",
"",
"reply"
],
[
"p",
"900d0aa57c9ef670488e2c0efb871d265d6926e13726d517e503044f1806ab78"
]
],
"content": "๐
Original date posted:2021-02-11\n๐ Original message:ะ Thu, 11 Feb 2021 05:45:33 -0800\nHugo Nguyen via bitcoin-dev \u003cbitcoin-dev at lists.linuxfoundation.org\u003e\nwrote:\n\n\u003e \u003e \u003e ENCRYPTION_KEY = SHA256(SHA256(TOKEN)) \n\u003e \u003e\n\u003e \u003e This scheme might be vulnerable to rainbow table attack.\n\u003e \u003e \n\u003e \n\u003e Thank you for pointing this out! Incidentally, Dmitry Petukhov also\n\u003e told me the same privately.\n\nMy thought was that if TOKEN has the characteristics of a password\n(short ASCII string), then it would be better to use key derivation\nfunction designed for passwords, like PBKDF2.\n\nThe counter-argument to this is that this adds another code dependency\nfor vendors, if the device firmware does not already have the required\nkey derivation function.\n\nMaybe this could be solved by going into opposite direction - make the\n\"token\" even longer, use the mnemoic.\n\nThe issue is that entering long data of the shared key into the device\nmanually is difficult UX-wise.\n\nHww vendors that allow to enter custom keys into their device already\nhave to face this issue, and those who allow to enter custom keys via\nmnemonic probably tackled this somehow.\n\nMaybe the shared key for multisig setup can be entered in the same way\n? (with maybe additional visual check via some fingerprint).\n\nAlthough we would then have another issue of potential confusion\nbetween two procedures (entering the main key and entering the shared\nkey for multisig setup), and the measures has to be taken to prevent\nsuch confusion.\n\nThe approaches can be combined - specify a key derivation function\nsuitable for passwords; via secure channel, share a password and/or the\nderived key. If hww supports derivation function, it can derive the key\nfrom password. If hww supports only keys, the key can be entered raw or\nvia mnemonic.",
"sig": "9e2f42592445f0fb91e55021a253da43089a1134c3452662f148d4a10c64d03c92af26c8f987565e047b2dbf0edc98309e6b78c803b088c847d2b6d165cf476b"
}