Slashdot Mirror
Making Data Unvanish
sertsa writes "Earlier this year a group of researchers at the University of Washington came up with a scheme to use peer-to-peer networks to store and, ultimately, to forget the keys for encrypted messages, causing them to 'Vanish.' Now a group from researchers from UT Austin, Princeton, and the University of Michigan has come up with a way to break this approach, by making a single computer appear to be many nodes on the p2p network. 'In our experiments with Unvanish, we have shown that it is possible to make Vanish messages reappear long after they should have disappeared nearly 100 percent of the time...'"
In my opinion Vanish didn't really serve any purpose.
- As we all know (and what MPAA/RIIA hate), once you've got hold of the data you cannot "vanish" it. It's really easy to save a copy of it.
- If you wanted encryption with public/private keys, theres PGP and other solutions to do it.
So the only thing Vanish added was the impossible-to-archieve vanishing of data.
Along with that it distributes your secret content all over the p2p network, where one machine can act as thousands of clients like to article says. I'd rather skip that and send the message directly and tell the other party to delete it, because vanishing doens't work if both parties dont do it.
Now a group from researchers from UT Austin, Princeton, and U Michigan has come up with a way to break this approach, by mking a single computer appear to be many nodes
I've performed similar procedures. The last time I mortal kombatted my computer, it became several pieces on my floor.
My work here is dung.
Update, 9/20/2009: Other researchers have recently discovered a vulnerability in our original Vanish research prototype. Their work shows that the Vuze DHT on which we built the original prototype did not provide sufficient security properties, and that there are therefore attacks that can capture Vanish keys. We released a revised prototype on September 20, 2009. This revised prototype, which distributes keys across both the Vuze DHT and OpenDHT, invalidates this attack. In addition, we are working to further strengthen Vanish from two angles: (1) by hardening the underlying DHT for Vanish-like purposes and (2) by modifying applications to make more intelligent use of DHTs. Please see our new technical report for additional information about the currently known attacks and our defenses. Due to the complexity of the systems we are relying upon, we would like to strengthen our advice that users should be cautious if they want to use Vanish. At this point, Vanish should only be used for experimental purposes. We do encourage researchers, however, to analyze it and improve upon it.
Vanish is possible with something like a web service which simply sends back the decrypted data.
However, the decryption key would have to stored only in memory and strictly deleted when done.
Vanish is completely worthless though because when I have the decrypted data I can do what I want with it.
Any kind of security system that provides a limited lifetime or constrained redistribution rights for messages is, fundamentally, DRM. Therefore, it's subject to the same kinds of attacks that cause DRM to fail. Ultimately, unless you can build a trusted platform module with remote attestation that is tamper proof, there are gaps. This particular attack is, at a more abstract level, really about producing counterfeit trusted nodes. Without a TPM at each node and some way to authenticate independence through a trust hierarchy, there's no way for this to work.
From original article:
It is technically possible to save information sent with Vanish. A recipient could print e-mail and save it, or cut and paste unencrypted text into a word-processing document, or photograph an unscrambled message. Vanish is meant to protect communication between two trusted parties, researchers say.
The stated goal doesn't mesh well with what Vanish actually does. If the communication is happening between two trusted parties, each party can trust the other to delete the information within a given time-frame.
It sounds more like distributing trust among multiple nodes, so that any of the nodes can destroy the information at will. I believe this has idea has been done before, and this sounds like a variation on a theme. Or perhaps this is not exploiting any new property of math, but rather drafting a protocol upon it for a given purpose (destroying information after time)
A DRM scheme that doesn't work? That's totally amazing.
Orange book:
A-
You are are a single communication construct. No one outside the circle of trust has any idea what is communicated.
B-
You are in a network (circle) of trust. moving data to each other is logged, and allowed/censored.
C-
A typical LAN with verifiable security.
D-
The internet, a net work of networks. Data can 'vanish', as a function of time/money spent on keeping the data stored.
Read the data security handbook summarized:
http://en.wikipedia.org/wiki/Trusted_Computer_System_Evaluation_Criteria
Now a group...has come up with a way to break this approach, by making a single computer
I have often wondered if Freenet would be vulnerable to such an attack.
Freenet needs the super-user with generous amounts of storage and bandwidth.
Which its well-funded adversaries can provide in spades. Thousands of nodes. Tens of thousands of nodes. Hundreds...
It seems that sooner or later they would be capturing enough of the traffic to begin putting the pieces together - or sending them into the void.
Unmodified Kademlia is vulnerable to Sybil attacks. *yawn* We kind of already knew that. There are various mitigations you can put in place. For example, if you've got the same IP address appearing twice in the routing tables, you have a major problem.
That doesn't mean that I think the general idea of Vanish is a sound one - it's rather silly, and a trusted client problem like all DRM techniques to which it is a close analog, so it's doomed from the start to some extent. All you have to do to defeat it is log the keys, which is completely undetectable and provides no disadvantage to you. And the advantage of a logging node is clearly and immediately obvious, so if it ever became "real", it's a game everyone would cheat in.
A nice toy, but a thoroughly pointless construct.
I've performed similar procedures. The last time I mortal kombatted my computer, it became several pieces on my floor.
A computer once beat me at chess, but it was no match for me at kick boxing.
--Emo Philips
Reply to That ||
Most P2P anonymity/privacy only works if a majority of the nodes is honest. The obvious way to attack is therefore to sumulate a lot of noted on one phycical node. Any sane system therefore contains detection for this attack. Incidentially, this knowledge is at least half a decade old. Seems to me some people did not do their literature search.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
it would be interesting to use some other metric, like computing a work unit (could make it very expensive to masquerade many nodes).
or even linking it to something in RL, difficult but possible. say you could use some metric from their facebook account? anyway by having some measure of how certain you are of their authenticity, and their different neighbours, which might have varying levels of relative trust; you could store a proportional amount of the key with them.
one interesting consideration is this could be quite asymmetric, you might trust them more than they trust you? and it may not observe transitive properties ect.
has this been done?
"There is no security model that protects against a scenario where the intended recipient is the attacker" or something?
Plausible deniability has at least been achieved with OTR, but for DRM this concept remains as valid as ever.
Unless computer chips come sealed in tamper-proof self-destructive foam, and opening a computer case or building circuit boards without authorization is declared a felony. I suppose that could work... for a while.