There is this joke, that with SPHINX you could host your passwords even at the NSA. Of course this make only sense if the NSA is not doing any global-adversary things, only hosts the SPHINX oracle. In that case the information theoretic security of the input/output of the OPRF would prevent the NSA from learning anything about your passwords. Somewhere in the depths of the internet on an IRC…
The Problem EIDAS and QWACs 1 EIDAS is a European Union regulation, that in the latest revision mandates browsers to include TLS certificate authorities (CA) operated by EU member-states without scrutiny of the usual CA/Browser forum . The CA/B forum is a voluntary industry group controlling which CAs are "secure" enough to be included in all browsers and operating systems. There are already a lot…
‎ I'm super happy to announce Project Klutshnik ( git ) Klutshnik is client/server solution that brings forward-secrecy, post-compromise security and a bunch of other very nice things to data-at-rest. Also the worlds first public and free threshold OPRF and threshold OPAQUE! WARNING: this release is a very early experimental release meant as a tech-demo, there is little hardening applied yet.…
I was watching Dave Borghuis ' fine talk: How I made the municipality pay a 600.000 euro fine for invading your privacy . But before I start with the topic of this post, let me say that Dave is more than a "Privacy activist / worried & critical citizen", he is in fact the shining light in the Dutch "hacker"-scene, a true role-model. He takes responsibility, protects privacy and approaches not only…
You are probably aware that I have been blessed with a grant by the NLNET foundation from the European Commission NGI0 programme to work on OPAQUE and it's integration into various tools. If not, now you have an explanation for all these posts lately. ;) In my previous post I mentioned that for other protocols like XMPP, IMAP, POP3, etc OPAQUE would make a lot of sense. Each of these supports SASL…
It seems I can't stop blogging about OPAQUE . In our edition today, I'm gonna look at some widely and less widely used protocols if they indeed are nails or only look like nails to me and my OPAQUE hammer... SSH The first on my list is SSH. For those of you who don't know, SSH has three "layers": The transport layer , this connects to the server, verifies TOFU the server key, and establishes a…
Over the last few weeks I have been writing a bunch of blog posts on my implementation of the SPHINX password storage SPHINX and the OPAQUE protocol. Below a list of all these and other related links: SPHINX The main post was followed by an attempt to explain how SPHINX security is better than the rest of existing solutions. OPAQUE The main post was followed by show-casing three use-cases for…
We have already seen two use-cases for OPAQUE: authentication and securing a channel . A third less obvious - if you think of it as a (P)ake - use of OPAQUE is to store and retrieve static and probably sensitive data. In the previous example we always ignored the export-key, in this installment it will be the main instrument. The export-key The export-key is a key derived from your password during…
I heard you need to write a tool that sets up a secure channel between two peers, but you cannot afford the luxury of using certificates for doing so. Maybe you want to develop a less braindead protocol than shadowsocks? All you have is a password? How about combining OPAQUE with a double-ratchet? You heard about OPAQUE, but are afraid to ask how to do this? Fear not, the following bits are here…
Announcing the SPHINX TL;DR if you are using keepass, pass, bitwarden, or similar password managers, you might want to switch to sphinx to handle your passwords (certain caveats apply see below). SPHINX is a simple self-hosted online password "storage" protocol with some very strong security guarantees, which other password storage solutions do no possess. One of the authors of the protocol…
Oblivious Pseudo-Random Functions In my previous SPHINX post I hand-waved away how the SPHINX oracle learns neither the input nor the output password. The mechanism behind this is a less well known cryptographic primitive, that is very nifty. Let's start with what is a pseudo-random function (PRF)? According to Boneh - Shoup Graduate Course in Applied Crypto: A pseudo-random function (PRF) F is a…
OPAQUE is a cool protocol that combines a Oblivious Pseudo-Random Function (OPRF) and an Authenticated Key-Exchange (AKE) into a protocol where a user holding nothing but a password and a server holding some information protected by the password can establish a shared secret. Because the password is used through an OPRF the server never learns anything about the password or the result of the PRF.…
Storing clear text passwords in your user database is very stupid. Traditionally we store hashed passwords of users. When a user logs in, then the user sends their cleartext password to the server (hopefully protected by TLS), the server hashes the password and compares it to to the stored hash, if it matches, all is good. Lets call this symmetric authentication, where both the client and the…
I just published a live demo of the authentication using OPAQUE discussed in my previous post . The backend is a simple python flask app . It has one nifty trick, the server is stateless between steps of the protocol. Both the during first step of registration and authentication the server creates a sensitive context that it needs to protect until the second server step. However imagine your setup…
In POC||GTFO 21 :12 I revealed my pilgrimage to reveal a devilish backdoor forced by the NSA on the PX1000. Not all of my outputs have been included in these blessed pages. Below notes on the margins of these. For your convenience I also prepared a git repo with all the code that was used in finally defeating this infernal construction. I would also like to mention that Act I & II are also…