Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MiniLock – File encryption software that does more with less

minilock.io

Post reply on HN
Print view View original

21–30 of 85 posts

Re: MiniLock – File encryption software that does more with less

#21

Post by tveita »

sillysaurus3 wrote: post #17
lolbrainwallets wrote: post #8

This is a bad cryptosystem which will result in people being fucked. Take it offline. A serious known weakness of zxcvbn is that it will grossly overestimate the entropy of things like quotes, lines from songs, lines from movies, etc. "the quick brown fox jumps over the lazy dog" has 111 bits of entropy according to zxcvbn.

Please don't use language like "People will get fucked" when critiquing a cryptosystem. HN is better than that. Tarsnap has no restrictions on passphrase entropy whatsoever, yet people have no problem with Tarsnap. It's interesting that people are singling out Minilock for this feature. Is this the worst thing that can be said about Minilock? EDIT: I accidentally said Tarsnap; I meant Scrypt.

Tarsnap generates a key file - your password is not used directly to derive the key. A password is used for your account, and for encrypting the key file.

Re: MiniLock – File encryption software that does more with less

#22

Post by sillysaurus3 »

lolbrainwallets wrote: post #18
sillysaurus3 wrote: post #17

Earlier quoted context omitted.

Please don't use language like "People will get fucked" when critiquing a cryptosystem. HN is better than that. Tarsnap has no restrictions on passphrase entropy whatsoever, yet people have no problem with Tarsnap. It's interesting that people are singling out Minilock for this feature. Is this the worst thing that can be said about Minilock? EDIT: I accidentally said Tarsnap; I meant Scrypt.

Tarsnap does not allow anyone who has your public key to attempt to crack your paraphrase. Minilock does, and in fact you can load all public keys into a bloom filter and crack them simultaniously with nearly the same speed as a single key. The design of this system is simply irresponsible. Saying people will be fucked is entirely appropriate here.

Hmm, I meant Scrypt. You can use Scrypt to encrypt files using a passphrase with no entropy restrictions. It doesn't use keys. People never raised this concern about Scrypt, and certainly didn't say people would get fucked for using it. What am I missing here? Why does Minilock warrant this outrage, but not Scrypt?

https://www.tarsnap.com/scrypt.html

Re: MiniLock – File encryption software that does more with less

#23

Post by nine_k »

kijin wrote: post #10

Perhaps I'm missing something obvious, but I don't understand. What's so great about not having to store the key pair on disk? After all, this is a file encryption software. Its job is to store data on disk. In fact, it already adds a bunch of headers to every encrypted file. Why not just grab 128 random bits from /dev/urandom, make it the private key, encrypt it with the passphrase as all the other programs do, and…

If there are no media with your secret key, it can't be stolen.

Of course, if your computer is cracked into, or your adversaries are using rubber-hose cryptanalysis, all bets are off. But this scenario is usually less probable than having your physical wallet or keychain stolen.

Re: MiniLock – File encryption software that does more with less

#24

Post by cordite »

lolbrainwallets wrote: post #8

This is a bad cryptosystem which will result in people being fucked. Take it offline. A serious known weakness of zxcvbn is that it will grossly overestimate the entropy of things like quotes, lines from songs, lines from movies, etc. "the quick brown fox jumps over the lazy dog" has 111 bits of entropy according to zxcvbn.

It took me awhile to figure out what zxcvbn referred to. I even looked at the source code which was in the repository and found 'zxcvbn' in the weak password list.

Finally, whilst on my tablet, I noticed that it was as obvious as the "QWERTY" keyboard that showed up on screen. As a primarily-dvorak user, such a silly stroke of keys had not occurred to me and gave me a bit of a laugh.

Re: MiniLock – File encryption software that does more with less

#25

Post by tveita »

Someone wrote: post #4
[deleted] wrote: post #2

[deleted]

I would use a secret key to encrypt the file, then encrypt the decryption key with each of the keys of those recipients, and add each (user ID, encrypted decryption key) to the file. Reading the linked page, that's exactly what they do (with a nonce to thwart various (differential, known plaintext, etc.) attacks) The header itself is a stringified JSON object which contains information necessary for the recipients to…

Exercise: This padding scheme will not hide the length of the file name as intended. Why?

Re: MiniLock – File encryption software that does more with less

#26

Post by deathanatos »

But wait… if the entire key is derived from the passphrase, if two people both choose the passphrase "password", would they not then get the same public and private keys? Can I not brute force people's private keys by taking millions of common passwords¹ and generating public keys from them, and then seeing which ones match my friends?

Am I wrong? Doesn't this seem much easier to brute force than a RSA key? (Presuming the private key hasn't been compromised; if it has, it's likely protected by a password, and then these two are about equal.)

¹accepting that some will get rejected because of "uses the zxcvbn library in order to impose a strict limit on the amount of detected entropy present in entered passphrases. miniLock will not allow passphrases that fall below the threshold of 100 bits of entropy"

Re: MiniLock – File encryption software that does more with less

#27

Post by eliteraspberrie »

I am not a cryptographer, but I'll offer some advice, if I may: don't let people choose a passphrase, generate one for them. People are very bad at creating good passphrases, but decent at memorizing a good one.

I say that because I don't trust the zxcvbn library. It underestimates the entropy of "aaaaa" as 7 bits [log(26 * 5)], not the correct value of 23 bits [log(26) * 5], for example. In this instance, it's to your advantage, but it doesn't inspire confidence in its other calculations.

Re: MiniLock – File encryption software that does more with less

#28

Post by lolbrainwallets »

sillysaurus3 wrote: post #22
lolbrainwallets wrote: post #18

Earlier quoted context omitted.

Tarsnap does not allow anyone who has your public key to attempt to crack your paraphrase. Minilock does, and in fact you can load all public keys into a bloom filter and crack them simultaniously with nearly the same speed as a single key. The design of this system is simply irresponsible. Saying people will be fucked is entirely appropriate here.

Hmm, I meant Scrypt. You can use Scrypt to encrypt files using a passphrase with no entropy restrictions. It doesn't use keys. People never raised this concern about Scrypt, and certainly didn't say people would get fucked for using it. What am I missing here? Why does Minilock warrant this outrage, but not Scrypt? https://www.tarsnap.com/scrypt.html

That tool generates a random salt, so passphrase cracking time is O(n) where n is the number of files being cracked vs O(1) for Minilock public keys. Additionally, encrypted files are generally still not "public", whereas Minilock public keys likely would be.

Re: MiniLock – File encryption software that does more with less

#29

Post by lolbrainwallets »

eliteraspberrie wrote: post #27

I am not a cryptographer, but I'll offer some advice, if I may: don't let people choose a passphrase, generate one for them. People are very bad at creating good passphrases, but decent at memorizing a good one. I say that because I don't trust the zxcvbn library. It underestimates the entropy of "aaaaa" as 7 bits [log(26 * 5)], not the correct value of 23 bits [log(26) * 5], for example. In this instance, it's to yo…

zxcvbn has problems but your example is backwards. "aaaaa" gets (as it should) low entropy because it is a single repeated character. It is more likely to be used than "rqntd". The major limitations are that it is worthless for estimating entropy of passphrase (which is what it's being used for here) and words not in its dictionary (non english).

Re: MiniLock – File encryption software that does more with less

#30

Post by diafygi »

deathanatos wrote: post #26

But wait… if the entire key is derived from the passphrase, if two people both choose the passphrase "password", would they not then get the same public and private keys? Can I not brute force people's private keys by taking millions of common passwords¹ and generating public keys from them, and then seeing which ones match my friends? Am I wrong? Doesn't this seem much easier to brute force than a RSA key? (Presumin…

Yes, and it clearly stated in the demo[1]. The key feature that this approach is trying to accomplish is allowing the user to not have to store anything beyond a password. Keeping track of a keyfile is HARD for a lay-user, so miniLock is trying to do the best it can securing files with only a password.

[1] - https://github.com/kaepora/miniLock/blob/master/src/index.ht...

Post reply on HN