From 592e89dcfddb9177d3e7eefa3f2568c619e85b71 Mon Sep 17 00:00:00 2001
From: davidsarah <>
Date: Wed, 21 Oct 2009 01:29:34 +0000
Subject: [PATCH] actually !#3 does *not* depend on one-wayness of hash_r
 because R has the same secrecy as K1. But it does depend on resistance to
 attack !#2

[Imported from Trac: page NewCaps/WhatCouldGoWrong, version 52]
---
 NewCaps/WhatCouldGoWrong.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/NewCaps/WhatCouldGoWrong.md b/NewCaps/WhatCouldGoWrong.md
index b4d42b4..ed40e29 100644
--- a/NewCaps/WhatCouldGoWrong.md
+++ b/NewCaps/WhatCouldGoWrong.md
@@ -10,7 +10,7 @@ This is about What Could Go Wrong with the "Elk Point 2" immutable file caps: <h
 |2|unauthorized read|attack the encryption of *K1* with *R*|anyone|any one file|the security of the encryption scheme used for *K1*, the secrecy of the read-key *R*, and the suitability of hash_*r* as a KDF.|*p*.2^min(*r*,*k*)^|
 |3|forgery of immutable file|generate a matching read-cap (*R*,*T*) for someone else's file|anyone|any one file|the hash function's and cap format's second-preimage resistance on (*R*,*T*). This also depends on the encryption of *K1* being deterministic and correct, and on the suitability of hash_*r* as a KDF.|(*p*/*N*).2^*r*+*t*^ [5,8]footnotes|
 |4|roadblock or speedbump [2]footnote|generate (*EncK1*,*Dhash*,*V*) that hash to someone else's *T*, and copy their *S*|anyone [6]footnote|any one file|the hash function's and cap format's second-preimage resistance on *T*|(*p*/*N*).2^*t*^|
-|5|unauthorized read|attack the encryption of the plaintext with *K1*|anyone|any one file|the security of the encryption scheme used for the plaintext, and the secrecy of the encryption key *K1*. The latter also depends on the security and seeding of the RNG that generated it, and the one-wayness of hash_*r*.|*p*.2^*k*^|
+|5|unauthorized read|attack the encryption of the plaintext with *K1*|anyone|any one file|the security of the encryption scheme used for the plaintext, and the secrecy of the encryption key *K1*. The latter also depends on the security and seeding of the RNG that generated it, and on resistance to attack #2.|*p*.2^*k*^|
 |6|unauthorized read|figure out the input to the hash function that generates *S*|anyone|any one file|the hash function's onewayness for (*R*,*T*) -> *S*|brute force on *R* is !#2|
 |7|unauthorized deletion|figure out a working destroy-key *KD* for a given *Dhash*|anyone|any one file|the hash function's preimage resistance on *Dhash* and the secrecy of *KD*|(*p*/*N*).2^min(*d*,*dh*)^|
 |8|accidental collision|storage indices (*S1*,*T1*) and (*S2*,*T2*) collide accidentally|not applicable|any two files|approximately random distribution of hash function outputs|[4]footnote|