Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's New CSAM Protections May Make iCloud Photos Bruteforceable

crypto.stackexchange.com

Post reply on HN
Print view View original

71–80 of 86 posts

Re: Apple's New CSAM Protections May Make iCloud Photos Bruteforceable

#71

Post by shuckles »

NTroy wrote: post #64
shuckles wrote: post #17

Earlier quoted context omitted.

I’m a little confused. The vouchers you are trying to decrypt have already been generated. How does it matter if the attacker can decrypt vouchers from a database they created but was not used by the vouchers in the breached data?

It is my understanding that the vouchers are only encrypted with a key derived from the NeuralHash of the photo. Therefore an attacker would only need to find a matching NeuralHash, to decrypt the voucher. Apple needs the blinding key, because they encrypt their list of NeuralHashes hashes first, so that others cannot see exactly which CSAM hashes they're testing against. Therefore they first need to decrypt their ow…

That’s wrong. Dec(H′(\Hat{S}_j), ct_j) requires \alpha the server secret to determine the decryption key using Boneh’s notation of the PSI system. Or looking from the other direction, the encryption uses both w (NeuralHash) and L (\alpha G, for server secret \alpha).

Re: Apple's New CSAM Protections May Make iCloud Photos Bruteforceable

#72

Post by NTroy »

shuckles wrote: post #71
NTroy wrote: post #64

Earlier quoted context omitted.

It is my understanding that the vouchers are only encrypted with a key derived from the NeuralHash of the photo. Therefore an attacker would only need to find a matching NeuralHash, to decrypt the voucher. Apple needs the blinding key, because they encrypt their list of NeuralHashes hashes first, so that others cannot see exactly which CSAM hashes they're testing against. Therefore they first need to decrypt their ow…

That’s wrong. Dec(H′(\Hat{S}_j), ct_j) requires \alpha the server secret to determine the decryption key using Boneh’s notation of the PSI system. Or looking from the other direction, the encryption uses both w (NeuralHash) and L (\alpha G, for server secret \alpha).

I believe the math you outline above refers to this step, located on page 7 of the Technical Summary:

> Next, the client creates a cryptographic safety voucher that has the following properties: If the user image hash matches the entry in the known CSAM hash list, then the NeuralHash of the user image exactly transforms to the blinded hash if it went through the series of transformations done at database setup time. Based on this property, the server will be able to use the cryptographic header (derived from the NeuralHash) and using the server-side secret, can compute the derived encryption key and successfully decrypt the associated payload data.

Is that correct?

If so, then I agree that it is true that in the PSI system the server secret is completely necessary as part of the decryption process in order to decrypt the matching hash in the pointed-to location in the table. That being said, looking only at the information encrypted by the client, I don't think the server secret comes into play, right?

If I'm misunderstanding, and you're confident that an attacker would have to have the server secret to decrypt a photo (even if they already knew that photo's NeuralHash and were able to defeat the internal layer of encryption), then I definitely recommend posting a well-outlined answer to the Cryptography Stack Exchange, as that would be super helpful!

Re: Apple's New CSAM Protections May Make iCloud Photos Bruteforceable

#73

Post by stjohnswarts »

kfprt wrote: post #56

It won't be long until these type of systems are mandated. Combined with a hardware root of trust it's not inconceivable that modifying your hardware not to report home will also be made a crime. It never stops with CSAM either, pretty soon it's terrorism and whatever vague new definition they use. The focus on CSAM seems extremely hypocritical when authorities make such little effort to stop ongoing CSA. I would enc…

Total surveillance is definitely the end goal of policing forces. It's in their very nature of getting their job done (what better way to catch criminals than a computer constantly scanning every move of everyone) and why people need to always push back against these "think of the children" scapegoats they use to get their foot in the door and get more control.

Re: Apple's New CSAM Protections May Make iCloud Photos Bruteforceable

#74

Post by shuckles »

NTroy wrote: post #72
shuckles wrote: post #71

Earlier quoted context omitted.

That’s wrong. Dec(H′(\Hat{S}_j), ct_j) requires \alpha the server secret to determine the decryption key using Boneh’s notation of the PSI system. Or looking from the other direction, the encryption uses both w (NeuralHash) and L (\alpha G, for server secret \alpha).

I believe the math you outline above refers to this step, located on page 7 of the Technical Summary: > Next, the client creates a cryptographic safety voucher that has the following properties: If the user image hash matches the entry in the known CSAM hash list, then the NeuralHash of the user image exactly transforms to the blinded hash if it went through the series of transformations done at database setup time.…

Yes the server secret comes into play looking at the encryption key on the client. This is the value L, which you can think of as a “public key” in usual ECC schemes.

It’s not useful to talk about defeating the “internal” layer of encryption separately from the “outer” layer because vouchers should be stored as generated by clients at rest. The database leak should not include any unwrapped vouchers (that would be like using a password hash but storing plaintext passwords anyways).

Re: Apple's New CSAM Protections May Make iCloud Photos Bruteforceable

#75

Post by zimpenfish »

kfprt wrote: post #56

It won't be long until these type of systems are mandated. Combined with a hardware root of trust it's not inconceivable that modifying your hardware not to report home will also be made a crime. It never stops with CSAM either, pretty soon it's terrorism and whatever vague new definition they use. The focus on CSAM seems extremely hypocritical when authorities make such little effort to stop ongoing CSA. I would enc…

> It never stops with CSAM either, pretty soon it's terrorism and whatever vague new definition they use.

But PhotoDNA has been scanning cloud photos (Google, Dropbox, Microsoft, etc.,) to detect CSAM content for a decade now and this "pretty soon it's terrorism" slippery slope hasn't yet manifested, has it?

If the slope was going to be slippery, wouldn't we have seen some evidence of that by now?

Re: Apple's New CSAM Protections May Make iCloud Photos Bruteforceable

#76

Post by zimpenfish »

NTroy wrote: post #63
jl6 wrote: post #27

For some reason, after reading the initial reporting on this system, I thought it was running against any photos on your iPhone, but now I read the actual paper, it seems like it only applies to photos destined to be uploaded to iCloud? So users can opt out by not using iCloud?

If Apple is to keep their word about guaranteeing the privacy of non-CSAM photos (which this whole discussion is about them not doing a very good job of), then they would only be able to do that with photos stored in iCloud because of this technical specification as to how the identification process works. That being said, other photos across your device are still monitored in a different way. For example Apple will…

> Apple will scan photos that you send or receive via iMessage to automatically detect if they're nudes

Only if they're being sent to or from a minor, I thought?

Re: Apple's New CSAM Protections May Make iCloud Photos Bruteforceable

#77

Post by zimpenfish »

dannyw wrote: post #36
myspy wrote: post #32

Earlier quoted context omitted.

According to Grubers analysis it compares the csam pictures against the library. Your 17 year old is not part of that database. Hence no hash matches. CSAM provides a library with hashes that are compared against the photos on the phone. The real problem comes when governments make laws that open the mechanism to different libraries of photos.

That's the CSAM part. The iMessages part uses a neural network to detect explicit photos through machine learning. What happens when Apple, or the government, mandate an expansion of CSAM into detecting new material? Apple already has built a neural network to detect new explicit material... Also, what happens when the USG mandates that Top Secret classified material must also be added to the database? Or when Russia…

> Also, what happens when the USG mandates that Top Secret classified material must also be added to the database?

That doesn't appear to have happened in the 10+ years this kind of scanning has already been happening at various cloud providers - what specifically about Apple moving it down to the phone from iCloud Photos makes this more likely now?

Re: Apple's New CSAM Protections May Make iCloud Photos Bruteforceable

#78

Post by randomhodler84 »

zimpenfish wrote: post #75
kfprt wrote: post #56

It won't be long until these type of systems are mandated. Combined with a hardware root of trust it's not inconceivable that modifying your hardware not to report home will also be made a crime. It never stops with CSAM either, pretty soon it's terrorism and whatever vague new definition they use. The focus on CSAM seems extremely hypocritical when authorities make such little effort to stop ongoing CSA. I would enc…

> It never stops with CSAM either, pretty soon it's terrorism and whatever vague new definition they use. But PhotoDNA has been scanning cloud photos (Google, Dropbox, Microsoft, etc.,) to detect CSAM content for a decade now and this "pretty soon it's terrorism" slippery slope hasn't yet manifested, has it? If the slope was going to be slippery, wouldn't we have seen some evidence of that by now?

Don’t be so naive. It took less than 3 years for dns blocking to go from csam to copyright infringement. It always was about building censorship infra. I’ve been fighting internet censorship for over a decade and it only gets worse and worse every generation of technology. I want to throw all this government spyware away. Dystopia landed a long time ago.

Re: Apple's New CSAM Protections May Make iCloud Photos Bruteforceable

#79

Post by joe_the_user »

selsta wrote: post #53
joe_the_user wrote: post #26

Regardless of whether this attack works or not, you'd assume this scheme produces a wider attack surface against pictures in iCloud and against iCloud users. One attack I could imagine is a hacker uploading child porn to a hacked device to trigger immediate enforcement against a user (and sure, maybe there are more controls involved but would you carry around a very well-protected, well-designed hand grenade in your…

How is this iCloud specific? You could do the same with Google Photos or OneDrive.

"How is this iCloud specific?"

In case you didn't the topic, what is specific (for now, for now...)to iCloud/apple is the "we're scanning your photos on your device and maybe reporting them if they're bad" approach. So you get the local hashes on the supposedly encrypted files and you get the situation of local files trigger global effects like the police swooping down and arresting you. So that's why despicable and hair-brained scheme in specific produces a greater "attack surface" in multiple ways.

And again, sure, Apple doing this quite possibly will set a precedent for Google et al to answer the other ambiguous meanings your ambiguous comment has.

Re: Apple's New CSAM Protections May Make iCloud Photos Bruteforceable

#80

Post by cmsj »

tandav wrote: post #34
jl6 wrote: post #27

For some reason, after reading the initial reporting on this system, I thought it was running against any photos on your iPhone, but now I read the actual paper, it seems like it only applies to photos destined to be uploaded to iCloud? So users can opt out by not using iCloud?

Friendly reminder: until ios source code is closed all privacy claims is only backed by trust. They easily can do whatever they want if you're not compiling from source.

This isn't really true in a world where it's trivial to reverse engineer and decompile binaries.

For example, we already now have a tool for generating NeuralHash hashes for arbitrary images, thanks to KhaosT:

https://github.com/khaost/nhcalc

Post reply on HN