Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OweFS – One-way encrypted file system

owefs.firelet.net

Post reply on HN
Print view View original

31–39 of 39 posts

Re: OweFS – One-way encrypted file system

#31

Post by eliteraspberrie »

timmclean wrote: post #9

Heads up to anyone considering using this: the author wrote their own crypto code[1]. I would recommend against using this until that is fixed... I've already spotted a few vulnerabilities. [1] https://github.com/FedericoCeratto/owefs/blob/master/pycrypt...

It uses the PyCrypto package to generate random numbers. The Random class is a Fortuna generator seeded with 8 bytes from the system RNG, the PID, and time: https://github.com/dlitz/pycrypto/blob/master/lib/Crypto/Ran...

I doubt eight bytes is enough for cryptography...

If you need random bytes in Python, use os.urandom:

    secret = os.urandom(32)
https://docs.python.org/2/library/os.html#os.urandom

Re: OweFS – One-way encrypted file system

#32

Post by StavrosK »

timmclean wrote: post #9

Heads up to anyone considering using this: the author wrote their own crypto code[1]. I would recommend against using this until that is fixed... I've already spotted a few vulnerabilities. [1] https://github.com/FedericoCeratto/owefs/blob/master/pycrypt...

> the author wrote their own crypto code

That doesn't immediately mean that the library is useless.

> until that is fixed

I disagree with the word "fixed", as if it's broken. He probably used the highest-level primitives he could to achieve the requirements.

> I've already spotted a few vulnerabilities.

It'd probably be more constructive to open an issue detailing the vulnerabilities rather than saying "I've spotted some, use NaCl" and leaving it at that. What makes you so sure that NaCl is even a suitable replacement without knowing all the considerations that went into the project?

Re: OweFS – One-way encrypted file system

#33

Post by StavrosK »

xrcltr wrote: post #28
kentonv wrote: post #25

Earlier quoted context omitted.

To be fair, most full-disk encryption schemes do not authenticate.

This is not disk encryption. This is file encryption.

It looks like the file is replaced every write, too, which removes most of the hard use cases. It really seems to me that he could just use PyNaCl to encrypt the files and not have to bother with all the custom crypto. I don't know what the intentions and tradeoffs are, though, so I can't be sure.

Re: OweFS – One-way encrypted file system

#35

Post by federico3 »

timmclean wrote: post #9

Heads up to anyone considering using this: the author wrote their own crypto code[1]. I would recommend against using this until that is fixed... I've already spotted a few vulnerabilities. [1] https://github.com/FedericoCeratto/owefs/blob/master/pycrypt...

Author here. Please be aware that the project has no releases, it's not on PyPI and it's little more than a proof of concept.

I have no intention to mislead any user into running it so I'll remove the repository for the time being.

Re: OweFS – One-way encrypted file system

#36

Post by technion »

eliteraspberrie wrote: post #31
timmclean wrote: post #9

Heads up to anyone considering using this: the author wrote their own crypto code[1]. I would recommend against using this until that is fixed... I've already spotted a few vulnerabilities. [1] https://github.com/FedericoCeratto/owefs/blob/master/pycrypt...

It uses the PyCrypto package to generate random numbers. The Random class is a Fortuna generator seeded with 8 bytes from the system RNG, the PID, and time: https://github.com/dlitz/pycrypto/blob/master/lib/Crypto/Ran... I doubt eight bytes is enough for cryptography... If you need random bytes in Python, use os.urandom: secret = os.urandom(32) https://docs.python.org/2/library/os.html#os.urandom

It says something if you're using a package called PyCrypto for RNG and that happens to be an insecure approach. You would think with that name it was the right way to do it.

Re: OweFS – One-way encrypted file system

#37

Post by cfcef »

craigds wrote: post #20
cfcef wrote: post #7

Earlier quoted context omitted.

Perhaps I'm missing something obvious, but why can't the filename be encrypted as well? (So you have public key 0xDEAFBEEF; you want to write a file named 'secret.txt' with the contents 'We attack at dawn'. OweFS encrypts 'We attack at dawn' to 010101 and writes that to 'secret.txt'. But why couldn't it have encrypted the contents to 010101 and encrypted the filename 'secret.txt' to 111000, and then written a file na…

You could do that, but it'd be quite inefficient. Firstly, let's assume that directories aren't encrypted. Otherwise this would be a real PITA - just to locate /foo/bar/baz.txt you'd have to decrypt each component of 001001/011101/110101.encrypted separately. More importantly, the decrypting software has no way to encrypt things, only decrypt them. So to read 'secret.txt' you can't just encrypt 'secret.txt' to '11100…

If you're reading files rather than writing them, then you must be decrypting them and in possession of the private key, which means you are permitted access to everything; so you could cache all the decryptions. Initial reads might be more expensive to locate, but then free. Also, how many cycles could it take to decrypt the few hundred or few thousand characters that could possibly make up a full filepath?

Re: OweFS – One-way encrypted file system

#38

Post by michwill »

eliteraspberrie wrote: post #31
timmclean wrote: post #9

Heads up to anyone considering using this: the author wrote their own crypto code[1]. I would recommend against using this until that is fixed... I've already spotted a few vulnerabilities. [1] https://github.com/FedericoCeratto/owefs/blob/master/pycrypt...

It uses the PyCrypto package to generate random numbers. The Random class is a Fortuna generator seeded with 8 bytes from the system RNG, the PID, and time: https://github.com/dlitz/pycrypto/blob/master/lib/Crypto/Ran... I doubt eight bytes is enough for cryptography... If you need random bytes in Python, use os.urandom: secret = os.urandom(32) https://docs.python.org/2/library/os.html#os.urandom

Uhh. I'd think, Crypto.Random is supposed to be secure: """Return the specified number of cryptographically-strong random bytes."""

Pretty sad if it is not the case! Interestingly enough, RNG in pycryptodome which I was using for zerodb is urandom. https://github.com/Legrandin/pycryptodome/blob/master/lib/Cr...

Would be interesting to see similar gotchas about that library (though everybody uses PyCrypto, that makes me feel a little paranoid!)

Re: OweFS – One-way encrypted file system

#39

Post by kentonv »

xrcltr wrote: post #28
kentonv wrote: post #25

Earlier quoted context omitted.

To be fair, most full-disk encryption schemes do not authenticate.

This is not disk encryption. This is file encryption.

Yeah, good point.

You could make similar threat-model arguments as are made about FDE, but that's not really a good excuse when authentication would be technically easy in this case.

Post reply on HN