Re: [Cfrg] [Ext] Re: Analysis of ipcrypt?

["David McGrew (mcgrew)" <[e-mail]>]

Hi Paul,

Besides the particulars of the cipher, it is important to realize that deterministic encryption of addresses, or any other identifier, provides a limited amount of security against a dedicated attacker.  You surely know this already, but it is a point worth raising in this thread.  Deterministic encryption of addresses is worth using, in my opinion, but it is important that end users understand the limitations.

The best example of the security limitation is the following.   Suppose that you have a set of (source address, destination address, port, protocol, time) tuples for a corporation, where source addresses (but not destination addresses) have been anonymized through deterministic encryption of addresses.  Your goal is to find the traffic of the CEO, and you start by gathering intelligence about that individual (alma mater, state of origin, etc.) then construct a set of server addresses that the target is likely to visit.  With this data, you now have enough to achieve “robust deanonymization of large, sparse datasets” (as per Narayanan and Shmatikov).   If, on the other hand, the destination addresses are anonymized, the deanonymization challenge is harder (and the data set is less useful).  

For the record, I’ve used deterministic encryption of IPv4 addresses using a single AES-128 invocation, using the simple approach of padding out the 32-bit address to a 128-bit plaintext, then making room for the ciphertext.  In my application, the addresses are stored as JSON, so the expansion is not hard to accomodate.

best

David


On 2/22/18, 7:19 PM, "Cfrg on behalf of Paul Hoffman" <[e-mail] on behalf of [e-mail]> wrote:

>On Feb 22, 2018, at 4:14 PM, Greg Rose <[e-mail]> wrote:
>> Anyone who wants to do 32-bit encryption with a key longer than 80 bits already needs to have their threat model reviewed ;-).
>
>OK, so please review what I said at the top of the thread:
>
>For a project I'm on, ipcrypt is attractive if an attacker cannot derive the 128-bit random key without a lot (maybe 2^80ish) effort. For cases in common use, assume that the attacker has 2^24 known plaintext/ciphertext pairs under a single 128-bit random key. For additional ciphertexts, how much effort must the attacker expend to get the key in order to decrypt additional unknown ciphertexts?
>
>The threat model then is that an attacker with 2^24 known plaintext/ciphertext pairs wants to determine the 128-bit random key that was used so that the attacker can de-anonymize addresses that are not in their current set.
>
>Why is that threat model worth a smiley?
>
>--Paul Hoffman