Bitcoin Forum

I created a topic about "brainwallets" that some of you might have followed (https://bitcointalk.org/index.php?topic=885616.0) where I challenged the idea that "no-one can create a secure brainwallet".

I pointed out my own brainwallet address with 1 BTC (https://blockchain.info/address/1Au4v6dZacFVsWXeKUMJd99AtyBZeqti2L) and it still has that 1 BTC there (so those wanting to show that you can't create a good brainwallet are not doing a good job in that they seemingly are unable to sweep that 1 BTC and it has been there for a long time - and as I took out 9 BTC previously the public key is available also).

My next challenge to conventional thinking is with crypto itself. We are constantly told *don't roll your own crypto* and for sure just like *don't create a brainwallet* it is not something that *anyone can do* but I think that those who are smart enough to create a brainwallet should also be thinking about exercising their skills at creating crypto (if they are keen to work out how to do so).

Why?

Because maybe you shouldn't trust anyone else to create it for you.

Everyone here should be well aware that any publicly created crypto could likely have been influenced by the NSA or other groups (as has already been exposed by Wikileaks and others).

So I prefer that we discuss ways of creating new crypto rather than saying "we can't discuss that as we are not qualified". As that is the easiest argument to force everyone to use unsafe software (i.e. don't think for yourself just use what *we say you should use*).

The biggest reason why not is because you yourself are blind to the ways in which you are incompetent.

You don't know what you don't know.

So let's start with a very simple but important thing - the "one time pad".

It is actually the best method of encryption in existence as it only relies upon the two sides having a shared secret at one point in time.

Before asymmetrical crypto was implemented the issue was "how to exchange keys" but of course that is now much easier using DSA technology. There is still however some problems with trusting the keys that are used that could only be solved by offline (or direct) communication.

But assuming we are happy that we have solved the issue of exchanging a key (whether via GPG or an in person meeting) then we can start to build a secure method to exchange messages without needing to use any 3rd party software.

A good point - as stated - this topic is not intended for those without the necessary skills (the question I am raising is exactly how much skill is required).

Many have tried to point out that I should be incompetent to create a brainwallet - yet my brainwallet stands (and anyone with any brains knows that there are bots working 24x7 to crack brainwallets).

So I accept your criticism but also just point out that I am somehow able to beat the odds (do you think that is just luck - especially after I've published my address for months?).

Points from the Cypherpunks FAQ ...


edit: also ...

Good points - I am not inventing a new type of cypher.

The idea of a OTP is at least hundreds of years old.

The only idea I would ask anyone to accept is that "secure hashes are secure" (as many other crypto algos work upon that assumption I don't think I have violated any sacrosanct idea).

If SHA256 is not secure then Bitcoin should have already been destroyed (and that is the OTP method that I use).

I think you have mistaken me for someone naively creating a "new crypto algo".

I am not doing that at all (SHA256 is actually used by Linux systems for /var/random when physical random data is not available - so unless you are going to suggest that the Linux kernel devs are idiots then perhaps you can stop comparing me to some newbies).

It is interesting how the "arrogance" of the above posts (you referenced) came about - if I were the NSA and I wanted to stop anyone questioning about crypto that is exactly the approach I think I'd use also.

Perhaps the cypherfunks were too naive themselves - they got infiltrated by NSA and didn't even realise it - so next thing they are recommending everyone in the world to not think and just do what they are told with the banner "trust us". :D

If I were a cypherfunk then I think I would be *ashamed* to be so quiet.

Personally I think it would be really strange that true cypherfunks would be so adverse to helping people who are trying to work out how to play with encryption.

If they really are so arrogant then it is clear why they have lost to the NSA and other such organisations.

It's more a case that naively glomming stuff together can tend to create edge cases and create insecure patterns, one can unknowingly create backdoors and shortcuts. Re-implementing well known algorithms can also have many pitfalls for the unwary.

One can only gain much confidence in one's work if the cypher is under constant attack for a long period and remains secure. Getting that level of real world testing "just for the hell of it" is unlikely.

Basically, you can give yourself a false sense of security behind something with critical weaknesses, just because nobody finds what you're protecting with it interesting or lucrative... then after 5 years of patting yourself on the back you use it for something that MATTERS and bam, fucked over in a weekend.

I did not know that insult. Cypherfunk is probably someone partway between cypherpunk and cypherflunk.  ;)

+1000

and the "bitcoin is the be all and is all" mentality being forced onto people is not helping.

Because it takes a PHd level knowledge and about 10 years directly working at breaking crypto implementations to roll your own crypto libraries. That's basically what people mean by "don't roll your own crypto" it means don't invent libraries, use the already well established, and tested ones. For example libsodium is good to use if you want to create an encrypted chat/video program like Tox does.

Colin Percival (FreeBSD developer, owner of Tarsnap) gives a good talk about what you need to know about implementing crypto in w/e software you're doing:
https://www.youtube.com/watch?v=jzY3m5Kv7Y8

For example, cpercival does not use XTS or other block modes for Tarsnap cloud storage and for good reason, because there are all sorts of attacks that can be done to XTS once it is freed from the physical confines of disk geometry.

You have to be really clear whether you are against "reimplementing code" from the libraries or "inventing hokey-pokey algorithms". In particular SSLeay/OpenSSL is a swiss-army-harvester-combine-cum-crutch that is a culprit of many bugs and inconsistencies in many, many codebases. It is not uncommon for a undergrad-student-level exercise projects to beat the efficiency of the supposedly well optimized code from the well-known cryptographic libraries, both open source and for-pay source.

In particular rewriting conventional crypto implementations to properly take advantage of the SIMD instructions that are now available in nearly every processor gives great payoffs in terms of power efficiency and resistance to various attacks.

One thing is the PhD-level knowledge of relevant mathematics/algebra and the other thing is simple patience and careful craftsmanship required to write clear and neat code. There's lots of the source code available out there that for the expedience of portability and meeting some very narrow benchmarking goals had completely forsaken readability and maintainability.

So, how many of these "NSA" algorithms have you personally broken? That's not an unfair question: remember Schneier's Law: "Anyone can create an algorithm that he himself can't break." And your inability to break your own algorithm means nothing if you are unable to break any other algorithms. Nobody will take your cryptography seriously unless you have a lot of experience in breaking other people's algorithms, and rightly so.

Bruce Schneier provides a self-study course in cryptanalysis. Start here (http://www.schneier.com/paper-self-study.pdf) and don't even dream of rolling your own crypto until you've broken most of the algorithms in that paper. And no cheating.

I don't quite understand the paranoid behavior so many of you here display at the NSA. The NSA is not an omnipotetnt all knowing being, it's simply an organization for America's security.

The NSA more likely than not, has had hardly if any any influence on crypto. If they did, then Bitcoin would not have reached where it has today. All the scams and thefts that have rocketed cryptocoins the past year(s) were created mostly by people we know the identities of. The guy who scammed people with his ponzi for millions of Bitcoin, was arrested. Charlie Shrem, was arrested. The guy who scammed the Mintpal users, we know how he looks like, etc etc.

If you actually look at the facts and details, you'd find that most of the big scams going on or that have happened in crypto are not secretive, the identities of the scammers are known, it's just catching them/putting them in jail that awaits.

So please, stop with your damn paranoia. It's annoying.

Interesting - not a single question about any algo I have (supposedly) written but instead a lot of lecturing (funny how people are so happy to tell you not to write any code rather than review any code you have written).

For all you armchair critics know I have simply put a standard OpenSSL call in a function wrapper!

:)

As for the NSA it is not paranoia but actual known issues made public by Wikileaks that I am referring to.

"If you don't like what you see here - get the funk out."

(Extreme II)

:D

That alone says a lot about your understanding of current affairs.

What the NSA is, is an enemy to privacy, and not just them, most intelligence agencies are. They've had more influence on crypto than bitcoin has had on the world. put that comparison to thought if you want to understand "the paranoid behavior"

Maybe because you are an ignoramus without a clue? ;)


False. Wrong generalization using the word "any". Demonstrate to me how Blowfish has been influenced by the NSA.


Certainly. Go ahead and discuss. Maybe you'll learn something. Just don't ask others to rely on any cyphers you have created.


Some of us are more qualified than others. Many of us are more qualified than you. But there is nothing wrong in discussing things.


OK. Let's. As you undoubtedly know, it is unbreakable in theory. Explain to us why it is totally unusable in practice. Emphasize the various possible protocol pitfalls. Describe the key exchange problem.


No, it is not. It is actually one of the worst encryption methods in existence. It is just the most resistant one to cryptanalysis.


Wrong. It relies on the two sides having a key as long as the total length of their communication (over all the time they will be communicating), which key is totally, unpredictably, physically random. How would the sides know beforehand how long their communication would be? And, if they don't, how would they exchange a key with such a length? And, if they can do that in a secure way, why not exchange the message itself?

Some practical implementations have involved giving special "pads" (notebooks) with the key to the soldiers during WWII, although I have no information regarding how the key was created. More contemporary example includes generating the keys from the noise of radioactive decay (the closest thing to random we have in nature), recording it on CD-ROMs and delivering them to the embassies with diplomatic mail. Of course, this relies that the key will not be intercepted and that it will be indeed random, which we cannot theoretically guarantee.


At this point you have already trusted 3rd-party software to generate the keys and perform key exchange. Why not also trust it with the encryption? And, if it is untrustworthy to begin with, your communication is already compromised (the attacker has the key), no matter what software you use for encryption.


From what you have demonstrated so far, your incompetence in cryptology is orders of magnitude larger.


Wrong conclusion. Revealing that SHA-256 is not secure might cost more than one is able to gain by "breaking" Bitcoin.


You use SHA-256 to generate the key and call this a "one time pad"? Either I did not understand what you wrote, or you are a complete moron.


/var/random is not mathemathically random. The output is hashed in an attempt to increase randomness - because this is the best we can do. The result is still not theoretically random - we just hope that it is random enough.


Nobody is stopping anyone from "questioning about crypto". We are just trying to stop ignorant morons from making idiotic statements about crypto that we would have to waste time debunking, like I am doing right now. If you want to learn and have legitimate questions - ask away. If you are going to bombard us with silly ideas and conspiracy theories exposing you ignorance - fuck off.


Uh-huh, and you genius were able to figure it our and are in a position to reveal it to the world. /facepalm


Actually, XTS sucks even for physical disks; it is just the best we can do there, since we are limited by the disk geometry. A disk sector of 512 bytes still has to be encrypted into 512 bytes - you don't have additional space for initialization vectors and authentication codes and checksums. (And, no, you can't rely on compression shrinking the size of the stuff you are going to encrypt.)


The NSA has had huge influence on crypto. They took IBM's Lucifer and changed it into DES, in practice strengthening it against an attack that wasn't known to the civilian sector at the time. They have also weakened a random number generator suggested by NIST - this is documented fact. They have also proposed particular elliptic curves suggested by NIST, except that now nobody knows the reason why - was it in order to strengthen or to weaken the encryption?


This is because the ignorance you have demonstrated so far in cryptology makes us totally uninterested in your algorithm.


And you trust OpenSSL exactly why? And how do you know that you haven't introduced any weaknesses in your wrapper?


OK, explain us exactly what the NSA did, according to Wikileaks. (Given that you got even the source of the information wrong, I am willing to bet that you don't know what the information is, either, let alone understand its implications.)

If you really want someone to actually read a very long reply (which presumably you must have wasted quite a bit of time typing) then next time I'd suggest not starting it with that. ;)

I don't really care whether you'll read it. From what I've seen from you so far, you are unlikely to learn from it anyway.

Consider it just a "cry of the soul" when somebody needs to vent his frustration at some idiocy, even knowing that it isn't going to change anything.

Strange that you'd bother typing it then (and why are you so keen to become the teacher to someone who you are are so keen to insult?).

If you haven't gathered what the purpose of this topic is (and the previous one linked to in the OP) then that isn't my problem.

Enjoy venting!

most people have a hard time getting a wallet open.  not going to be any creating a crypto for them

Actually CD-RWs. Using erasable media is a great protection against accidental reuse, one of the most important failure modes of the OTP.

Well a CDR you could overburn to wipe. Or shred.

IF you had a BDROM fully filled with randomness and emailed like a fiend all day, managing about a megabyte of ascii output daily, I think it would take you about 70 years to use it all.

This raises a lot of red flags. OTP is used as an example of perfect secrecy cipher. Mainly to introduce the more advanced concepts because it only works if the pad is perfectly random, used once and as long as the text to encrypt. All of which makes it impractical. I don't know how you produce your OTP but anything short of the previous is not a OTP.
"secure hash are secure" have to be framed in a particular context. What is the attack model? CPA, CCA, RO, etc. I could go on and on but the point is that these sentences don't give much confidence to start with.

Okay - these are very good points and it is not a "true OTP" at all (for the obvious reason you pointed out) but is instead a PRNG key stretcher (starting with a shared secret). In order to never re-use the same "pseudo OTP" (is that term acceptable?) a message nonce is combined with the shared secret (the nonce itself would be sourced from /dev/random or equivalent).

Of course the "shared secret" could also be determined using ECDSA key pairs (as an alternate to using GPG or some other method of communicating the shared secret).

This looks fairly subject to chosen ciphertext attacks. The nonce has to be sent with the encrypted message. I craft a new message with the same nonce and modify the body of the cipher text. Since I know they are XORs, I can change the decoded content or retrieve the message little by little by sending several attempts and seeing how the receiver reacts.

For sure a nonce cannot be re-used - so in a P2P situation each client would make sure it does not allow nonce re-use to occur so this is easily prevented (it just requires storage space for old nonces which could perhaps be reduced by prefixing nonces with say a date to allow for the later removal of old nonces).

Well - then the receiver has to carry a database of nonces with him wherever he wants to be able to decrypt a message. Otherwise, you just described a stream cipher - it's definitively not a new crypto :)

Edit: http://en.wikipedia.org/wiki/Stream_cipher (http://en.wikipedia.org/wiki/Stream_cipher)

I think the two (brain wallet and crypto) are very different.

I know almost nothing about cryptography, but I know it's complicated enough that there's no point for me to try to roll my own.  And those that know quite a bit more than me are saying that it is quite a deep subject.

Comparatively, brain wallets seem much simpler.  There are really only a few known principles that must be followed, and those principles are easily understood.  Cryptography is a complete science with a large body of knowledge.  It's much more complex and mysterious.

I think perhaps the title of this topic has confused people as I didn't intend it to mean creating things like the lowest level algos but instead the idea of replacing conventional implementations such as HTTPS in particular.

The comparison with the other topic is more to do with challenging "conventional wisdom" (i.e. that you *can't create a replacement for securely encrypting data* for something like HTTPS) so it is the system implementation rather than its low level algorithmic parts that are key.

The main interest I have is in how we create a new secure internet that doesn't use DNS or HTTPS (this topic being about the latter of these two things).

To me it sounds like the title is "The next step in going against "conventional wisdom" - Create your own rocket!

:D

Any suggestion for a better title?

namecoin?

That project has mostly failed because it just replaced one name squatting system with another (I don't like the idea of anything like DNS).

Maybe you could look into improving HTTPS before thinking about replacing it completely? For instance, if your problem with HTTPS is its reliance on trusted Certificate Authorities then look into replacing that piece with some kind of P2P system. I doubt many people would have any issues with HTTPS over TLS 1.2 and the rich cryptographic suites that it supports.

That is indeed something that should be considered and yes the CA component of HTTPS is IMO the biggest part of the problem with it.

To be clearer the reason that I am envisioning something quite different to HTTPS is that I see blockchains (note not singular) and P2P as being the two key core technologies of the internet of the future (and HTTPS was really designed for a traditional client/server model).