[144701] in cryptography@c2.net mail archive
Re: cleversafe says: 3 Reasons Why Encryption is Overrated
daemon@ATHENA.MIT.EDU (james hughes)
Sun Aug 9 10:06:22 2009
Cc: james hughes <hughejp@mac.com>, Zooko Wilcox-O'Hearn <zooko@zooko.com>,
tahoe-dev@allmydata.org, Cryptography List <cryptography@metzdowd.com>
From: james hughes <hughejp@mac.com>
To: Ben Laurie <ben@links.org>
In-reply-to: <4A7A99C7.4010500@links.org>
Date: Thu, 06 Aug 2009 16:08:16 -0700
On Aug 6, 2009, at 1:52 AM, Ben Laurie wrote:
> Zooko Wilcox-O'Hearn wrote:
>> I don't think there is any basis to the claims that Cleversafe makes
>> that their erasure-coding ("Information Dispersal")-based system is
>> fundamentally safer, e.g. these claims from [3]: "a malicious party
>> cannot recreate data from a slice, or two, or three, no matter what
>> the
>> advances in processing power." ... "Maybe encryption alone is 'good
>> enough' in some cases now - but Dispersal is 'good always' and
>> represents the future."
>
> Surely this is fundamental to threshold secret sharing - until you
> reach
> the threshold, you have not reduced the cost of an attack?
Until you reach the threshold, you do not have the information to
attack. It becomes information theoretic secure.
They are correct, if you lose a "slice, or two, or three" that's fine,
but once you have the threshold number, then you have it all. This
means that you must still defend the site from attackers, protect your
media from loss, ensure your admins are trusted. As such, you have
accomplished nothing to make the management of the data easier.
Assume your threshold is 5. You lost 5 disks... Whose information was
lost? Anyone? Do you know? What if the 5 drives were lost over 5
years, what then? CleverSafe can not provide any security guarantees
unless these questions can be answered. Without answers, CleverSafe is
neither Clever nor Safe.
Jim
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
