Re: [Cfrg] Big-key cryptography

[Natanael <[e-mail]>]

Den 7 dec 2015 01:28 skrev "Aaron Zauner" <[e-mail]>:
>
> People that have read Rogaway's recent IACR Distinguished Lecture [0]
> might have noticed (besides an amazing essay on crypto, ethics and
> politics of course) that there's new work mentioned on something they
> call 'Big-key cryptography'. Let me quote Verbatim:
>
> Suppose you have a bigkey K. You want to use it for some protocol P that
> has been designed to use a conventional-length key K. So choose a random
> value R (maybe 256 bits) and hash it to get some number p of probes into
> the bigkey:
>
> i_1 = H(R, 1) i_2 = H(R, 2) ... i_p = H(R, p) .

> [...]

> I think that the subkey prediction problem, and the key-encapsulation
> algorithm based on it, will give rise to nice means for
> exfiltration-resistant authenticated-encryption and pseudorandom
> generators. In general, I see bigkey cryptography as one tool that
> cryptographers can contribute to make mass surveillance harder.
>
> This seems to be a yet unpublished manuscript but I can think of quite a
> few instances where this approach might come in handy for keys used in
> various high-confidentiality protocols. What does CFRG think?

Looks like security-by-obesity extended from protected data using
all-or-nothing transforms to key material. I've seen similar methods
discussed before, but it is nice to see an actual proof for it when used
with key material.

And why not put this key material onto intentionally low-bandwith devices?
Like say putting some really big disk array holding your key material in a
well protected box, with the only external interface being an Arduino (or
maybe something tamper proof?) or similar very simple hardware? Could even
up the security against physical attacks by making it an m-of-n scheme with
multiple boxes physically spread out. Your only plausible attacks on it
would be outright theft or planting backdoors in the control / interface
chip.

http://ethanheilman.tumblr.com/post/28481738192/security-through-obesity
Discussion of that above link:
https://www.reddit.com/r/netsec/comments/xi587/a_look_at_securitythroughobesity/
https://stelfox.net/blog/2012/08/security-through-obesity/
https://www.reddit.com/r/netsec/comments/13mrle/new_developments_in_password_hashing_romporthard/

If you don't trust any HSM and need to generate shared key material between
two locations, this is one way to make your own.