Thanks everyone who has provided inputs so far!
This is the new proposal for the encryption aspect of the scheme, based on all the feedback.
The key derivation function would be PBKDF2, with PRF = SHA512. This should be readily available on today's hardware already, as they are used for BIP39.
DK = PBKDF2(PRF, Password, Salt, c, dkLen)
PRF = SHA512
Pwd = HUMAN_READABLE_TITLE
Salt = NONCE
c = 2048
dkLen = 256
HUMAN_READABLE_TITLE is in ASCII format, minimum length = 8, maximum length = 20.
NONCE is a 64-bit number.
Reason for going with SHA512 is due to legacy support on some hardware. c=2048 also mimics BIP39. It takes about ~3 seconds to derive the encryption key on a 80Mhz MCU. We feel like this is a good enough tradeoff for this use case. The assumption here is that the secure session is only needed temporarily for a few hours, maybe up to one day.
The Coordinator and Signers agree and exchange these 2 secrets prior to the setup. The NONCE can be converted to either:
(a) a 6-word phrase using BIP39 wordlist
(b) a 20-digit decimal number
(c) a QR code
Depending on the vendor. This flexibility in the data format allows each vendor to customize the UX based on their respective device capabilities.
Best,
Hugo
В Thu, 11 Feb 2021 05:45:33 -0800
Hugo Nguyen via bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org>
wrote:
> > > ENCRYPTION_KEY = SHA256(SHA256(TOKEN))
> >
> > This scheme might be vulnerable to rainbow table attack.
> >
>
> Thank you for pointing this out! Incidentally, Dmitry Petukhov also
> told me the same privately.
My thought was that if TOKEN has the characteristics of a password
(short ASCII string), then it would be better to use key derivation
function designed for passwords, like PBKDF2.
The counter-argument to this is that this adds another code dependency
for vendors, if the device firmware does not already have the required
key derivation function.
Maybe this could be solved by going into opposite direction - make the
"token" even longer, use the mnemoic.
The issue is that entering long data of the shared key into the device
manually is difficult UX-wise.
Hww vendors that allow to enter custom keys into their device already
have to face this issue, and those who allow to enter custom keys via
mnemonic probably tackled this somehow.
Maybe the shared key for multisig setup can be entered in the same way
? (with maybe additional visual check via some fingerprint).
Although we would then have another issue of potential confusion
between two procedures (entering the main key and entering the shared
key for multisig setup), and the measures has to be taken to prevent
such confusion.
The approaches can be combined - specify a key derivation function
suitable for passwords; via secure channel, share a password and/or the
derived key. If hww supports derivation function, it can derive the key
from password. If hww supports only keys, the key can be entered raw or
via mnemonic.
_______________________________________________
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev