Re: [Cfrg] [Ext] Re: Analysis of ipcrypt?

Jean-Philippe Aumasson <> Sat, 24 February 2018 07:34 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 907F6126D45 for <>; Fri, 23 Feb 2018 23:34:50 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.998
X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id jh3VjbntTWhP for <>; Fri, 23 Feb 2018 23:34:48 -0800 (PST)
Received: from ( [IPv6:2607:f8b0:400d:c0d::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 30229120227 for <>; Fri, 23 Feb 2018 23:34:48 -0800 (PST)
Received: by with SMTP id f4so13324293qtj.6 for <>; Fri, 23 Feb 2018 23:34:48 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=9lG+vP8qPpdRN5nTIoUYY2SBOnyCYdJNStPnwpShqXs=; b=dBB4spqDFTAGYPHZTcPS3u7lVxMSvPM7ZxLFK4ZuJ2k+Fw9oZqjBakl4FEm2F5RULJ 8/xp/eans1TiwEdEQnXsJCLTslqZ92Uu7vwZJE7529M1CG2Qe9HJHxUK4zWEVWR7EHir vyZFO2Ye9lSDSd3QcfMQ0i5q+4RSL/SEt++1HH2+3F60GZtvxm87qSWV0PlU6FAtTpHO GDxCrEfy9HCH+kNR5aOnEQHQz7/GIU7bK5Hy+ech8KB59VKbf67Mn3/+9O3nAWN3pDKn DkYshE+F5+2zK++is9Zo5Xd1wcaMMe7rS5b6P96djrqCfaCSS6qzy/uvqqTtPk492zvi czEQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=9lG+vP8qPpdRN5nTIoUYY2SBOnyCYdJNStPnwpShqXs=; b=BkGOJ8XjQgNRphyYHxUbeO1bSCV7V7ukzric8JmMX5ogKQUNw8t66ERsUVszd984LO AW3mL7AZS0r5q3I8rF88teO3T78WluJ5yGCo9sfWUF51UYtm7Iqf3PzfJ8WKEp999pJz 2RaxHwXmPCRHvGSIPvauMOOYhL276evIoYq1a95XxW6Ofm57YAiEVEYYbdtZaWNMdkDg sqvmF3U+FCVRcPPWN5N3D2g3ROIeTPG0BG2NrSHV8PKfCopKGFphVypisah5f5Opxrq5 z68ulkvxgVt+vmkv3OKzGLkLOC/B4xSqpWpIKySLv7wl70GF2GPbGw3fLnIo6D7aq7O+ 5YMw==
X-Gm-Message-State: APf1xPBo/Xnw/f770S066Z4s/UAVZd3oCsIt7EJKZCkOt5q+r3M3d7zt x8kQIJ99Q21z6JvVXxLbf4HsyjCZzHsGUbVSflOMkQ==
X-Google-Smtp-Source: AG47ELucY5qqKtO+jsG8sRQBjpQnaUUp/ijunaFLCpRQaFNq8NRpWDcq5lEalFVc9DuwS3g5FJzgjhzM4mWAlRYVo/c=
X-Received: by with SMTP id h10mr7043727qtj.300.1519457687041; Fri, 23 Feb 2018 23:34:47 -0800 (PST)
MIME-Version: 1.0
References: <> <> <> <> <> <> <>
In-Reply-To: <>
From: Jean-Philippe Aumasson <>
Date: Sat, 24 Feb 2018 07:34:35 +0000
Message-ID: <>
To: "" <>
Cc: Paul Hoffman <>, "David McGrew (mcgrew)" <>, Greg Rose <>
Content-Type: multipart/alternative; boundary="089e0826da88affbe30565f04f28"
Archived-At: <>
Subject: Re: [Cfrg] [Ext] Re: Analysis of ipcrypt?
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Crypto Forum Research Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sat, 24 Feb 2018 07:34:51 -0000

Seconding David. We're talking tokenization more than encryption. In the
context where I created ipcrypt we just needed to obfuscate the PII data
(such as IP addresses) in a deterministic and format-preserving way.

On Fri, Feb 23, 2018 at 3:26 PM David McGrew (mcgrew) <>

> Hi Paul,
> Besides the particulars of the cipher, it is important to realize that
> deterministic encryption of addresses, or any other identifier, provides a
> limited amount of security against a dedicated attacker.  You surely know
> this already, but it is a point worth raising in this thread.
> Deterministic encryption of addresses is worth using, in my opinion, but it
> is important that end users understand the limitations.
> The best example of the security limitation is the following.   Suppose
> that you have a set of (source address, destination address, port,
> protocol, time) tuples for a corporation, where source addresses (but not
> destination addresses) have been anonymized through deterministic
> encryption of addresses.  Your goal is to find the traffic of the CEO, and
> you start by gathering intelligence about that individual (alma mater,
> state of origin, etc.) then construct a set of server addresses that the
> target is likely to visit.  With this data, you now have enough to achieve
> “robust deanonymization of large, sparse datasets” (as per Narayanan and
> Shmatikov).   If, on the other hand, the destination addresses are
> anonymized, the deanonymization challenge is harder (and the data set is
> less useful).
> For the record, I’ve used deterministic encryption of IPv4 addresses using
> a single AES-128 invocation, using the simple approach of padding out the
> 32-bit address to a 128-bit plaintext, then making room for the
> ciphertext.  In my application, the addresses are stored as JSON, so the
> expansion is not hard to accomodate.
> best
> David
> On 2/22/18, 7:19 PM, "Cfrg on behalf of Paul Hoffman" <
> on behalf of> wrote:
> >On Feb 22, 2018, at 4:14 PM, Greg Rose <> wrote:
> >> Anyone who wants to do 32-bit encryption with a key longer than 80 bits
> already needs to have their threat model reviewed ;-).
> >
> >OK, so please review what I said at the top of the thread:
> >
> >For a project I'm on, ipcrypt is attractive if an attacker cannot derive
> the 128-bit random key without a lot (maybe 2^80ish) effort. For cases in
> common use, assume that the attacker has 2^24 known plaintext/ciphertext
> pairs under a single 128-bit random key. For additional ciphertexts, how
> much effort must the attacker expend to get the key in order to decrypt
> additional unknown ciphertexts?
> >
> >The threat model then is that an attacker with 2^24 known
> plaintext/ciphertext pairs wants to determine the 128-bit random key that
> was used so that the attacker can de-anonymize addresses that are not in
> their current set.
> >
> >Why is that threat model worth a smiley?
> >
> >--Paul Hoffman
> _______________________________________________
> Cfrg mailing list