Juicebox: Squeezing the hassle out of encryption key recovery
1–10 of 25 posts
Re: Juicebox: Squeezing the hassle out of encryption key recovery
#2Author here, happy to answer any questions!
TL;DR we're sharing an open-source encryption key recovery protocol that provides high security coupled with a user-friendly design, to make encryption further accessible to larger numbers of people. What we've built leverages programmable HSMs, distributed cryptography, and a user-friendly PIN-based recovery process to simplify key recovery without compromising security.
Re: Juicebox: Squeezing the hassle out of encryption key recovery
#3Author here, happy to answer any questions! TL;DR we're sharing an open-source encryption key recovery protocol that provides high security coupled with a user-friendly design, to make encryption further accessible to larger numbers of people. What we've built leverages programmable HSMs, distributed cryptography, and a user-friendly PIN-based recovery process to simplify key recovery without compromising security.
I'm not a cryptographer- what's the attack/failure mode of "standard HSM key recovery, but the 'PIN' sent to each realm is actually HMAC(some_identifier_for_each_realm, PIN), and each realm stores just one share of the secret"- i.e. what motivates the use of OPRF here instead of just HMAC to prevent a realm from basically pass-the-hash-ing the user's PIN to get shares from other realms?
Re: Juicebox: Squeezing the hassle out of encryption key recovery
#4It's a shame key escrow has become a tainted concept, mired in "government has my keys" because a mechanism to store offline a cold copy of keying material and recover it is a good thing to have available.
Re: Juicebox: Squeezing the hassle out of encryption key recovery
#5Author here, happy to answer any questions! TL;DR we're sharing an open-source encryption key recovery protocol that provides high security coupled with a user-friendly design, to make encryption further accessible to larger numbers of people. What we've built leverages programmable HSMs, distributed cryptography, and a user-friendly PIN-based recovery process to simplify key recovery without compromising security.
Besides "how do we use this" any word on the authors of this project? I did a very cursory search of the two contributors and there was very little I could find that would reassure me in using such a sensitive tool. Could well be my heightened paranoia after recent events.
Re: Juicebox: Squeezing the hassle out of encryption key recovery
#6Author here, happy to answer any questions! TL;DR we're sharing an open-source encryption key recovery protocol that provides high security coupled with a user-friendly design, to make encryption further accessible to larger numbers of people. What we've built leverages programmable HSMs, distributed cryptography, and a user-friendly PIN-based recovery process to simplify key recovery without compromising security.
I'm not a cryptographer- what's the attack/failure mode of "standard HSM key recovery, but the 'PIN' sent to each realm is actually HMAC(some_identifier_for_each_realm, PIN), and each realm stores just one share of the secret"- i.e. what motivates the use of OPRF here instead of just HMAC to prevent a realm from basically pass-the-hash-ing the user's PIN to get shares from other realms?
The issue if realms stored HMAC(realm_id + PIN), where PINs are presumed to be low-entropy, then an individual realm could brute-force the PIN. Specifically, an adversary with access to a single realm's database could enumerate PINs, run them through the HMAC along with the realm ID, and test locally whether that's the correct PIN. That would already be bad because users might reuse PINs across services. Then, if the adversary had valid auth tokens for other realms, they would be able to use that PIN to recover the secret shares from other realms and reconstruct the secret.
The Juicebox protocol is designed to prevent this. A realm can't individually test whether or not a PIN is correct.
Note: I'm a former employee of/contributor to Juicebox.
Re: Juicebox: Squeezing the hassle out of encryption key recovery
#7Earlier quoted context omitted.
I'm not a cryptographer- what's the attack/failure mode of "standard HSM key recovery, but the 'PIN' sent to each realm is actually HMAC(some_identifier_for_each_realm, PIN), and each realm stores just one share of the secret"- i.e. what motivates the use of OPRF here instead of just HMAC to prevent a realm from basically pass-the-hash-ing the user's PIN to get shares from other realms?
The issue if realms stored HMAC(realm_id + PIN), where PINs are presumed to be low-entropy, then an individual realm could brute-force the PIN. Specifically, an adversary with access to a single realm's database could enumerate PINs, run them through the HMAC along with the realm ID, and test locally whether that's the correct PIN. That would already be bad because users might reuse PINs across services. Then, if the…
Ah, of course, that makes sense- thanks for the answer!
Re: Juicebox: Squeezing the hassle out of encryption key recovery
#8Author here, happy to answer any questions! TL;DR we're sharing an open-source encryption key recovery protocol that provides high security coupled with a user-friendly design, to make encryption further accessible to larger numbers of people. What we've built leverages programmable HSMs, distributed cryptography, and a user-friendly PIN-based recovery process to simplify key recovery without compromising security.
Besides "how do we use this" any word on the authors of this project? I did a very cursory search of the two contributors and there was very little I could find that would reassure me in using such a sensitive tool. Could well be my heightened paranoia after recent events.
The team is here, includes creator of Signal, among others: https://www.juicebox.xyz/contributors
Re: Juicebox: Squeezing the hassle out of encryption key recovery
#9Author here, happy to answer any questions! TL;DR we're sharing an open-source encryption key recovery protocol that provides high security coupled with a user-friendly design, to make encryption further accessible to larger numbers of people. What we've built leverages programmable HSMs, distributed cryptography, and a user-friendly PIN-based recovery process to simplify key recovery without compromising security.
Besides "how do we use this" any word on the authors of this project? I did a very cursory search of the two contributors and there was very little I could find that would reassure me in using such a sensitive tool. Could well be my heightened paranoia after recent events.
Ideally you don't have to trust us! Code is open source on GitHub, protocol is published in the whitepaper, and all has been independently audited.
If you have specific concerns, happy to talk them through!
Re: Juicebox: Squeezing the hassle out of encryption key recovery
#10It's a shame key escrow has become a tainted concept, mired in "government has my keys" because a mechanism to store offline a cold copy of keying material and recover it is a good thing to have available.
Making encryption more convenient for everyone is definitely a good thing. Some people will always have that paranoia around letting keys out of their hand, but for the rest of us this protocol aims to reduce the need to trust any one service with your key material by distributing it across independent distrusting services.