Hacker News Reader

Comment by rauhl | Hacker News Reader

The author has a blog post at https://schollz.com/blog/croc6/ with more information.

I would like to see a security analysis. The code phrases seem ludicrously short to me …

The way it works is that the code phrases are use to do a key exchange (PAKE), which means that the only way they're useful to an adversary is if someone is able to MITM your connection and guess the passphrase. The presumption is that this is unlikely enough that you should see a bunch of incorrect passwords and abort, knowing something is wrong, before someone is able to successfully MITM you.

I admit I'd rather see a longer default passphrase too, but fortunately this is adjustable on the sender's end of the connection, so you can choose a longer one if you'd like.

Quickly looking, the word list is 1626 words, which means 1626^3 = 4 billion combinations. I don't know how it works in practice but I would guess the initial sending communication is always quite short-timed...

4 billion is about 32 bits of security, which is most definitely not enough.

It can be enough for PAKE. Depends on what your requirements are.

Edit: to be more specific: 32 bits means that an attacker has a 1 / 4294967296 chance of guessing your password. They do not get multiple tries, because that's not how PAKE works. It's akin to agreeing with someone that you will meet in the park and exchange a short secret phrase to prove your identities, whereupon you will exchange GPG keys with each other or whatever. You don't need 128 bits of security for the "meeting in the park" exchange, any short unguessable phrase will do.

> an attacker has a 1 / 4294967296 chance of guessing your password

One attacker has that chance for one transfer.

But if the service is popular, then it's perfectly feasible that typing in som random choice intercepts some arbitrary file belonging to someone.

That's right. But you'd have to attack an extraordinary number of transfers to have even a small chance of managing to get one by luck, and an attack of that scale would very quickly become obvious since everyone would have their transfers interrupted. I agree with you in principle though, I'd like to see just a bit more entropy.

> a bit more entropy

The appropriate use of "bit" here made me smile.

Increasing the passphrase to four words would bring the odds up to 1 / 6,990,080,303,376. In magic-tunnel I believe there is a flag to change the number of words used by default. It appears that schollz/croc allows you to use your own passphrase, but not increase the default word size, that would be a good feature request.

You're quite right, of course, but keep in mind that magic-wormhole is using a much smaller wordlist, and in fact only has 1 / 65536 odds by default. The people writing software in this space don't seem to believe this is a credible threat.

You can use whatever string you want as the passphrase for Magic Wormhole, the receiver just won't get tab completion.

How would tab completion work in a situation like this? Are the clients exchanging information about the passphrase over the same communication channel?

No, you need to be able to MITM the connection and inject packets in order to get one shot at trying to break into that specific transfer.

If you guess wrong, the machines trying to do the transfer see an error.

Reply on news.ycombinator.com