Comment by DanielBMarkham | Hacker News Reader

Comment by DanielBMarkham | Hacker News Reader

Something to remember: One-Time Pads are unbreakable, and as storage costs continue to drop, there are certainly many scenarios where they could be used and never cracked.

Think about it. How much actual secure data do you and your bank need to transfer back and forth? Certainly not web UI elements or site chrome. For each use of your online account, there's probably 3 or 4k max actual data that you need to be secure. Your bank could mail you a 1GB random noise file, perhaps a backup, and you two could communicate for the rest of your life without any fear of anybody understanding what you're saying.

I understand that there's an entire e-commerce ease-of-use scenario where secure communications becomes mission-critical. And I'm certainly not suggesting to replace all secured comms. My only point is that there are parts of this problem that are very tough and there are parts of this problem that we have made more difficult than it has to be simply in an effort to standardize and abstract everything.

The problem with this method is that it requires a side channel. This is the real beauty of public key cryptography, you can negotiate a secure channel over an open channel. (*Authentication sold separately)

I don't get why this argument is used so often as if it was valid. Setting up a banking account and many other things require a secure side channel anyway - physical presence :)

The last bank account I registered was done completely online, except for the physical card being mailed to me.

This is the real beauty of public key cryptography, you can negotiate a secure channel over an open channel.

You still need sufficient shared information as a starting point to authenticate the other party, so that doesn't really avoid the need for a secure side channel. In practice we often trust that the baseline of certificates that come with a new device or built into a browser are sufficient for this purpose, but there is still an attack surface there and our existing CA infrastructure and processes are not perfect.

There exists quantum key distribution https://en.wikipedia.org/wiki/Quantum_key_distribution#Quant... which is provably secure (up to side channel attacks), and allows two parties (say you and your bank) to remotely create a symmetric key. This will certainly require infrastructure to be built, but its possible that this infrastructure consists of beaming signals from bank->satellite->receiver in your home.

In practice schemes based on cryptographic hash functions work just as well and are quantum resistant. 512-bit key length is safe from quantum computers. Use bcrypt, Argon2 if you are pessimistic.

Using side channel to share single 512-bit key that is used to generate other keys keys is enough.

The best known quantum attack against symmetric ciphers uses Grover's algorithm to effectively halve the key size. AES-128 is considered secure against classical attacks, so assuming you have a secure side channel for key distribution, AES-256 is sufficient to defeat quantum attacks.

I assume that we are talking about situations where public key cryptography is used.

If you share one master key for long time, having (effectively) 128-bit secret shared state is too small.

Do you mean like literally mail it to you, or email it to you? If it’s the latter you still have the problem of needing it to be encrypted. If it’s the former, it’s damned inconvenient.

> Your bank could mail you a 1GB random noise file

Right. And the first RCE+escalation 0-day will enable someone to wipe out your accounts.

I mean, sure, but how are you going to protect the one time key?

What might make more sense is if they gave you a usb drive that was good for a thousand transactions or whatever. Then you could get it replaced in person after the pad was used it.

I didn’t read the article (paywall), but unless they are talking about quantum computers, the computation required to break the key and encrypt the data has a exponential difference. If we all started using keys that were, say, 2^32 bits long, we would be fine for the forseeable future.

Reply on news.ycombinator.com