Building Deception Into Encryption Software

holy_calamity writes "MIT Technology Review reports on a new cryptosystem designed to protect stolen data against attempts to break encryption by brute force guessing of the password or key. Honey Encryption serves up plausible fake data in response to every incorrect guess of the password. If the attacker does eventually guess correctly, the real data should be lost amongst the crowd of spoof data. Ari Juels, who invented the technique and was previously chief scientist at RSA, is working on software to protect password managers using the technique."

Comments

Fake info generation to stop intrusive phone apps

[Animats]

I'd been looking into this in a slightly different context. Recently, at Hacker Dojo, someone demonstrated an Android mod to me which dealt with applications that demand too many privileges. It has the usual "disable privileges" option, but for apps that won't run with privileges disabled, it sends fake info.

The demo showed generation of fake phone serial numbers and such. That's easy. Apps that improperly try to upload your address book, though, require generation of a plausible, but fake, address book. That's wasn't in the demo, but it's worth doing. Location data should probably be sent as a random walk from some random starting point.

If enough people do this, it will garbage marketing databases.

Re:This is more of authentication than encryption.

[Phreakiture]

Consider a case of a credit card number. A CC# consists of 15 digits plus a check digit for 16 digits total.

Now, in encrypting, validate the check digit and then drop it. Take the remaining 15 digits and express them as a binary value. It should be around 50 bits. XOR it against a 50-bit mask, and that will be your ciphertext value.

To decrypt, XOR against that same value and recompute the check digit.

Any incorrect value will produce a number that passes basic validation (as long as it doesn't exceed 2^15).

For bonus points, you can probably encode the first digit in only 2 bits, because most cards begin with 3, 4, 5 or 6, depending on the issuer.

Now, is this a good encryption scheme? Maybe not, but it does at least demonstrate the concept.