Re: [Cfrg] [Ext] Re: Analysis of ipcrypt?

Seconding David. We're talking tokenization more than encryption. In the
context where I created ipcrypt we just needed to obfuscate the PII data
(such as IP addresses) in a deterministic and format-preserving way.

On Fri, Feb 23, 2018 at 3:26 PM David McGrew (mcgrew) <mcgrew@cisco.com>
wrote:

> Hi Paul,
>
> Besides the particulars of the cipher, it is important to realize that
> deterministic encryption of addresses, or any other identifier, provides a
> limited amount of security against a dedicated attacker.  You surely know
> this already, but it is a point worth raising in this thread.
> Deterministic encryption of addresses is worth using, in my opinion, but it
> is important that end users understand the limitations.
>
> The best example of the security limitation is the following.   Suppose
> that you have a set of (source address, destination address, port,
> protocol, time) tuples for a corporation, where source addresses (but not
> destination addresses) have been anonymized through deterministic
> encryption of addresses.  Your goal is to find the traffic of the CEO, and
> you start by gathering intelligence about that individual (alma mater,
> state of origin, etc.) then construct a set of server addresses that the
> target is likely to visit.  With this data, you now have enough to achieve
> “robust deanonymization of large, sparse datasets” (as per Narayanan and
> Shmatikov).   If, on the other hand, the destination addresses are
> anonymized, the deanonymization challenge is harder (and the data set is
> less useful).
>
> For the record, I’ve used deterministic encryption of IPv4 addresses using
> a single AES-128 invocation, using the simple approach of padding out the
> 32-bit address to a 128-bit plaintext, then making room for the
> ciphertext.  In my application, the addresses are stored as JSON, so the
> expansion is not hard to accomodate.
>
> best
>
> David
>
>
> On 2/22/18, 7:19 PM, "Cfrg on behalf of Paul Hoffman" <
> cfrg-bounces@irtf.org on behalf of paul.hoffman@icann.org> wrote:
>
> >On Feb 22, 2018, at 4:14 PM, Greg Rose <ggr@seer-grog.net> wrote:
> >> Anyone who wants to do 32-bit encryption with a key longer than 80 bits
> already needs to have their threat model reviewed ;-).
> >
> >OK, so please review what I said at the top of the thread:
> >
> >For a project I'm on, ipcrypt is attractive if an attacker cannot derive
> the 128-bit random key without a lot (maybe 2^80ish) effort. For cases in
> common use, assume that the attacker has 2^24 known plaintext/ciphertext
> pairs under a single 128-bit random key. For additional ciphertexts, how
> much effort must the attacker expend to get the key in order to decrypt
> additional unknown ciphertexts?
> >
> >The threat model then is that an attacker with 2^24 known
> plaintext/ciphertext pairs wants to determine the 128-bit random key that
> was used so that the attacker can de-anonymize addresses that are not in
> their current set.
> >
> >Why is that threat model worth a smiley?
> >
> >--Paul Hoffman
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>