Re: Forward secrecy from two RNGs

From: Henrick Hellström (henrick.hellstrm_at_telia.com)
Date: 06/06/04 

Date: Sat, 05 Jun 2004 22:35:30 GMT

> Michael Amling wrote:
>
>> I'd worry less if
>> compromise of Carol's data didn't depend on a single point of failure,
>> namely Carol's RNG. (The prospect of Sue's long-term private key and
>> Sue's RNG both being compromised doesn't really worry me, and Sue's
>> data is not as valuable as Carol's.)

I don't think you can (or should try to) get around Carol's need for a
high quality RNG. If Carol has neither a long term private key nor a
CSPRNG Carol will be a deterministic system with no unknowns and you are
toast.

You can however create a protocol that remains secure if either but not
both of Sue's long-term private key or Sue's (underlying) RNG is
compromised. The solution that comes to mind is to use long-term RSA
keys, and SHA-1 hash the concatenation of the RSA signature (with
application specific padding if the RSA key is used for other purposes
as well) of the other party's protocol messages so far together with
output from the (underlying) RNG and use that as the ephemeral private key.

Relevant Pages

  • Re: Forward secrecy from two RNGs
    ... > or Bob with a disclosed private key. ... Carol's RNG is all that's ... > Carol's data didn't depend on a single point of failure, ... > being compromised doesn't really worry me, and Sue's data is not as ...
    (sci.crypt)
  • Re: new /dev/random
    ... pick a well-known and well-analyzed RNG from the literature, ... Such RNGs typically combine well-known primitives in easily analyzed ... and have associated proofs that the quality of the generator is ... have that "automatic recovery from state compromise" property, ...
    (sci.crypt)
  • Re: Does IBE or ECC crypto switch to a traditional symmetric scheme for bulk data?
    ... >> HSM where the host computer never needs to know what the private key ... > The only HSM with which I am familiar is the Fortezza card. ... If there is a compromise on ...
    (sci.crypt)
  • Re: The Poly1305-AES message-authentication code
    ... to use Diffie-Hellman key exchange with a static shared secret. ... there will usually still be a long-lived private key to protect. ... of my private key won't necessarily compromise past and future sessions. ...
    (sci.crypt)
  • Re: Pubkey
    ... Alexander Klimov wrote: ... > the pubkey to authorized_keys ... The private key ofcourse has to be stored safely. ... compromise of a system containing these private keys can lead to a chain ...
    (SSH)
Quantcast