From 43fb299f5458e29a36123abc75ed59a15ceb74e2 Mon Sep 17 00:00:00 2001
From: davidsarah <>
Date: Wed, 21 Oct 2009 00:54:23 +0000
Subject: [PATCH] to prevent some attacks, hash_r must be a suitable KDF
 (sort-of implied by secrecy of R, but better to be explicit)

[Imported from Trac: page NewCaps/WhatCouldGoWrong, version 49]
---
 NewCaps/WhatCouldGoWrong.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/NewCaps/WhatCouldGoWrong.md b/NewCaps/WhatCouldGoWrong.md
index dfed5b0..d67fc11 100644
--- a/NewCaps/WhatCouldGoWrong.md
+++ b/NewCaps/WhatCouldGoWrong.md
@@ -6,9 +6,9 @@ This is about What Could Go Wrong with the "Elk Point 2" immutable file caps: <h
 | | | | | | | |
 |---|---|---|---|---|---|---|
 |#|*what bad thing could happen*|*how*|*who could do it*|*what could they target*|*what crypto property prevents it*|*how expensive to brute force*|
-|1|shape-shifter immutable file [1]footnote|collide read-cap (*R*,*T*)|creator of a file|their own file|the hash function's and cap format's collision resistance on the read-cap (*R*,*T*). This also depends on the encryption of *K1* being deterministic and correct.|approx sqrt(2.*p*).2^(*r*+*t*)/2^ [7,8]footnotes|
-|2|unauthorized read|attack the encryption of *K1* with *R*|anyone|any one file|the security of the encryption scheme used for *K1*, and the secrecy of the read-key *R*|*p*.2^min(*r*,*k*)^|
-|3|forgery of immutable file|generate a matching read-cap (*R*,*T*) for someone else's file|anyone|any one file|the hash function's and cap format's second-preimage resistance on (*R*,*T*). This also depends on the encryption of *K1* being deterministic and correct.|(*p*/*N*).2^*r*+*t*^ [5,8]footnotes|
+|1|shape-shifter immutable file [1]footnote|collide read-cap (*R*,*T*)|creator of a file|their own file|the hash function's and cap format's collision resistance on the read-cap (*R*,*T*). This also depends on the encryption of *K1* being deterministic and correct, and on the suitability of hash_r as a KDF (key derivation function).|approx sqrt(2.*p*).2^(*r*+*t*)/2^ [7,8]footnotes|
+|2|unauthorized read|attack the encryption of *K1* with *R*|anyone|any one file|the security of the encryption scheme used for *K1*, the secrecy of the read-key *R*, and the suitability of hash_r as a KDF.|*p*.2^min(*r*,*k*)^|
+|3|forgery of immutable file|generate a matching read-cap (*R*,*T*) for someone else's file|anyone|any one file|the hash function's and cap format's second-preimage resistance on (*R*,*T*). This also depends on the encryption of *K1* being deterministic and correct, and on the suitability of hash_r as a KDF.|(*p*/*N*).2^*r*+*t*^ [5,8]footnotes|
 |4|roadblock or speedbump [2]footnote|generate (*K1enc*,*Dhash*,*V*) that hash to someone else's *T*, and copy their *S*|anyone [6]footnote|any one file|the hash function's and cap format's second-preimage resistance on *T*|(*p*/*N*).2^*t*^|
 |5|unauthorized read|attack the encryption of the plaintext with *K1*|anyone|any one file|the security of the encryption scheme used for the plaintext, and the secrecy of the encryption key *K1*. The latter also depends on the security and seeding of the RNG that generated it.|*p*.2^*k*^|
 |6|unauthorized read|figure out the input to the hash function that generates *S*|anyone|any one file|the hash function's onewayness for (*R*,*T*) -> *S*|brute force on *R* is !#2|