fix(kos): make domain-separation salt non-invertible (tccr mix) - #3
Closed
AdamDawidKrol wants to merge 1 commit into
Closed
fix(kos): make domain-separation salt non-invertible (tccr mix)#3AdamDawidKrol wants to merge 1 commit into
AdamDawidKrol wants to merge 1 commit into
Conversation
The XOR seed mix (`Prg::from_seed(seed ^ instance_id)`) is linear and
invertible, so it does not actually domain-separate two KOS instances that
share one global delta. A malicious receiver controls the base-OT seeds (it
is the base-OT sender) and can pre-compensate
seed_B[i][b] = seed_A[i][b] ^ id_A ^ id_B (both b)
so that `seed_B ^ id_B == seed_A ^ id_A` for every column, collapsing the two
instances onto the same PRG stream while both still pass their consistency
checks. XOR-ing the sender keys at a column with complementary receiver
choices then yields delta exactly.
Mix the instance id in with a tweakable correlation-robust hash instead,
`Prg::from_seed(FIXED_KEY_AES.tccr(instance_id, seed))`. Both parties apply
the same transform to the same chosen seed, so extension correctness is
preserved, but the mix is non-invertible in `seed`, so a receiver can no
longer force cross-instance seed collisions.
Turns the security regression test in the previous commit green.
Owner
Author
|
Folded into #2 — the salt and its non-invertible (tccr) mix now ship as a single commit. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the bypass demonstrated in #1.
The salt added in #2 was mixed into the setup PRG seeds with XOR (
Prg::from_seed(seed ^ instance_id)). XOR is linear and invertible, and the receiver is the base-OT sender (it picks the seeds), so it can pre-compensatemaking
seed_B ^ id_B == seed_A ^ id_Afor every column. The salt cancels, the two instances collapse onto the same PRG stream, and XOR-ing the sender keys at a column with complementary receiver choices yieldsdeltaexactly — while both instances still pass their consistency checks.Fix: mix the salt with a non-invertible tweakable correlation-robust hash instead:
Both parties apply the same transform to the same chosen seed (correctness preserved), but the receiver can no longer force cross-instance seed collisions without inverting AES.
Turns the
kos::attack_pocsecurity regression test from #1 green.mpz-ot-coreandmpz-otkos suites pass.Stack: #2 (salt) → #1 (
[red]test) → this PR ([green]fix).