Changes between Version 27 and Version 28 of NewCaps/WhatCouldGoWrong

Timestamp:

2009-10-11T03:47:59Z (15 years ago)

Author:

davidsarah

Comment:

go back to using r = bitlength(R)

NewCaps/WhatCouldGoWrong

@@ -1 +1 @@
 This is about What Could Go Wrong with the "Elk Point 2" immutable file caps: http://jacaranda.org/tahoe/immutable-elkpoint-2.svg
+(http://jacaranda.org/tahoe/immutable-elkpoint-2.png if your browser does not correctly handle SVG.)
 
 ||#||''what bad thing could happen''||''how''||''who could do it''||''what could they target''||''what crypto property prevents it''||''how expensive to brute force'' [footnote 5]||
-||1||shape-shifter immutable file [footnote 1]||collide read-cap (''R'',''T'')||creator of a file||their own file||the hash function's and cap format's collision resistance on the read-cap (''R'',''T''). This also depends on the encryption of ''K1'' being deterministic and correct.||2^(''n''+''t'')/2^||
-||2||unauthorized read||attack the encryption of ''K1'' with ''R''||anyone||any one file||the security of the encryption scheme used for ''K1'', and the secrecy of the read-key ''R''||2^min(''n'',''k'')^||
-||3||forgery of immutable file||generate a matching read-cap (''R'',''T'') for someone else's file||anyone||any one file||the hash function's and cap format's second-preimage resistance on (''R'',''T''). This also depends on the encryption of ''K1'' being deterministic and correct.||2^''n''+''t''^||
+||1||shape-shifter immutable file [footnote 1]||collide read-cap (''R'',''T'')||creator of a file||their own file||the hash function's and cap format's collision resistance on the read-cap (''R'',''T''). This also depends on the encryption of ''K1'' being deterministic and correct.||2^(''r''+''t'')/2^||
+||2||unauthorized read||attack the encryption of ''K1'' with ''R''||anyone||any one file||the security of the encryption scheme used for ''K1'', and the secrecy of the read-key ''R''||2^min(''r'',''k'')^||
+||3||forgery of immutable file||generate a matching read-cap (''R'',''T'') for someone else's file||anyone||any one file||the hash function's and cap format's second-preimage resistance on (''R'',''T''). This also depends on the encryption of ''K1'' being deterministic and correct.||2^''r''+''t''^||
 ||4||roadblock or speedbump [footnote 2]||generate (''K1enc'',''Dhash'',''V'') that hash to someone else's ''T'', and copy their ''S''||anyone [footnote 6]||any one file||the hash function's and cap format's second-preimage resistance on ''T''||2^''t''^||
 ||5||unauthorized read||attack the encryption of the plaintext with ''K1''||anyone||any one file||the security of the encryption scheme used for the plaintext, and the secrecy of the encryption key ''K1''. The latter also depends on the security and seeding of the RNG that generated it.||2^''k''^||
@@ -13 +14 @@
 ||10||cause invalid share to verify||generate (''K1enc'',''Dhash'',''V'') that hash to someone else's (''T'',''U''), and copy their ''S''||anyone||any one file||the hash function's second-preimage resistance on (''T'',''U'')||2^''t''+''u''^||
 ||11||undeletion [footnote 3]||restore a deleted file's shares by controlling the relevant servers||anyone||any one file||not prevented by crypto||n/a||
-||12||undeletion [footnote 3]||generate matching (''R'',''T'',''U'') for a deleted file||anyone||any one file||the hash function's and cap format's second-preimage resistance on (''R'',''T'',''U'')||2^''n''+''t''+''u''^||
+||12||undeletion [footnote 3]||generate matching (''R'',''T'',''U'') for a deleted file||anyone||any one file||the hash function's and cap format's second-preimage resistance on (''R'',''T'',''U'')||2^''r''+''t''+''u''^||
 ||13||accidental collision||storage indices (''S1'',''T1'') and (''S2'',''T2'') collide accidentally||n/a||any two files||approximately random distribution of hash function outputs||[footnote 4]||
 
-where ''k'' = bitlength(''K1''), ''n'' = bitlength(''R''), ''s'' = bitlength(''S''), ''t'' = bitlength(''T''), ''u'' = bitlength(''U''), ''d'' = bitlength(''KD''), ''dh'' = bitlength(''Dhash'').
+where ''k'' = bitlength(''K1''), ''r'' = bitlength(''R''), ''s'' = bitlength(''S''), ''t'' = bitlength(''T''), ''u'' = bitlength(''U''), ''d'' = bitlength(''KD''), ''dh'' = bitlength(''Dhash'').
+
+(The notes to the diagram assume ''n'' == ''k'' == ''r''.)
+
 
 1. ''shape-shifter immutable file'': creator creates more than one file matching the immutable file readcap