Caius -- A heirarchical delegable password safe Daniel Silverstone

A long while ago I, Rob Kendrick, Clive Jones (and possibly others) sat down and tried to come up with a way to store passwords a-la Password Safe. However, being us, we wanted to ensure a number of properties which password safes commonly don't have. We wanted to allow the delegation of access to some subset of the passwords. We also wanted for it to be reasonable to deny that there is content which has not been decrypted.

I was reminded of this work when I was discussing the concept of deniable storage of secrets with a colleague (An idea I'll expand upon in another blog post at another time). I am therefore presenting, with little change other than formatting the design from years ago. I would be very interested if anyone knows of software which meets the properties of the Caius system since I would like to have one but simply don't trust myself (see another future posting) to write it right now.


Caius

The following concepts are assumed to be understood:

The 'Caius' system is a password-safe type system sporting hierarchical delegable access to the data it stores. The 'Caius Fob' is the data-store for the system.

The 'Caius Fob' is a file which consists of a header and then three sections. The header identifies it as such a file, the first section lists a number of 'External IDs' which can be used to access portions of the file. The second section lists ACL entries as defined below. The third section of the file is the encrypted data looked after by this file. It is not intended that the holder of a CaiusFob be able to deny it is a CaiusFob, but it is expected that it be possible to deny an ability to decrypt (perhaps by lacking a password) any ACL entries. Given that the structure of the file is known, it is necessary that there be external IDs for which the password or GPG key is not valid or cannot decrypt an ACL entry, and ACL entries which even if decrypted may not be valid, and ACL entries which even if decrypted and valid may not be used to encode any data blocks.

An External ID

External ID ::=
   LENGTH
   TYPE
   DATA

Where TYPE is one of: * 0: Unused (ID slot placeholder) * 1: GPG key, where DATA is the keyid of the gpg key * 2: Password, where DATA is some hash of a password which can be used to derive a key for decrypting an ACL entry.

The list of external ids forms a numbered sequence where the index (0-based) into the sequence is the External ID number. (EIDnr)

An ACL Entry

ACL Entry ::=
   LENGTH
   EIDnr
   DATA
   HMAC

The EIDnr is the number of the External ID as explained above. The LENGTH is the length of the DATA section which is a key-pair as explained below, encrypted to the external id. The HMAC uses the authentication key in the key-pair in the DATA section, and authenticates the EIDnr, LENGTH, DATA tuple.

One possibility for increasing deniability is to remove the EIDnr from this part of the file, and assume that for every external ID you try to decrypt all ACLs you've not succeeded in decrypting thus-far. This has the benefit of being able to deny that an ACL entry ought to be decryptable with the credentials you hold, but also an increased inability to know if you have successfully unlocked everything appropriate to being able to fully manipulate a CaiusFob. This tradeoff is currently set in favour of better understanding of the content, but a future design feature might suggest EIDnr should always be -1 to indicate "unknown, try every EID".

A key pair

Key Pair ::=
   ENCRYPTIONKEY
   AUTHENTICATIONKEY

The ENCRYPTIONKEY is used to initialise the stream cipher for the data section. The AUTHENTICATIONKEY is used to compute HMACs for the appropriate ACL entries or data blocks (as defined below)

The data section

First consider a set of stream ciphers. There exists always one cipher which we will call the NULL cipher. It is defined such that Cipher(Byte, Offset) == Byte and is always available. Then there is a cipher initialised for each key pair we can successfully extract from the ACL entry section of the file.

Each of these ciphers is initialised and made ready such that the data section can be xored with the bytes as they come out of the stream ciphers in an attempt to decrypt the blocks. Essentially this is equivalent to decrypting the entire data section with each cipher in turn to produce N proposed cleartexts which can then be examined to find decrypted blocks.

Whenever a cipher, combined with the data stream in the file, manages to produce a sequence of eight bytes of value zero, we have reached a synchronisation point and what follows is a data block enciphered with which ever cipher managed to reveal the synchronisation sequence.

Since it is vanishingly unlikely that you will find eight zeros in a row when playing about with arbitrary cipher initialisation, we consider this to be an acceptable synchronisation sequence.

Once we have found a sync sequence, we can know the length of this block and thus we do not look for sync markers again until after the block we have just found.

A data block

Data block ::=
   DATALENGTH
   PADLENGTH
   TYPE
   DATA
   PAD
   HMAC

Such that each field is the obvious, DATA is DATALENGTH bytes of data, the texture of which is defined by TYPE and PAD is PADLENGTH arbitrary bytes which pad this block. HMAC is keyed using the authentication key associated with the stream cipher managing to decrypt this and is over the DATALENGTH, PADLENGTH, TYPE, DATA, PAD tuple.

If TYPE is zero then this is a ''free-space'' block and will typically contain zero bytes of DATA and some number of padding. This is however arbitrary and not enforced, the free space can be DATA if the implementer prefers and implementations are encouraged if possible to randomise the distribution of the consumed space between the DATA and PAD sections.

A node block

TYPE == 1 (Node)
DATA ::=
   MY_ID
   PARENT_ID
   NAME
   NOTES

MY_ID is a unique ID for this node. (generally a random number, probably 64 bits long, perhaps a UUID). PARENT_ID if not all NULLs is the ID for the parent node. If all NULLs then this is the root of a heirarchy. NAME is a NULL terminated byte string of one or more characters which is the name of this node. It may consist only of any characters other than NULL and the forward-slash character. NOTES is a byte string of zero or more characters, NULL terminated. Note that the DATALENGTH of the data block clearly delimits this field but the NULL is present to aid parsing.

A system block

TYPE == 2 (System)
DATA ::=
   PARENT_ID
   USERNAME
   PASSWORD
   EXPIRYDATE
   NOTES

PARENT_ID is the node to which this block belongs. It is required that any system blocks you succeed in decrypting can be placed within a node you succeed in decrypting. If the library encounters a system block which belongs to a node it cannot find then this is considered to be a corrupt system block and will be treated as though it could not be decrypted.

USERNAME is a byte string of one or more characters terminated by a NULL, ditto for PASSWORD and as for a node block, the NOTES are NULL terminated also.

EXPIRYDATE is a byte string of characters in RFC-822 date format.

Implementation notes

It is expected that any implementation of Caius will adhere to the following guidelines in order to enhance the security of content over time.

  1. Any time a block is invalidated (such as by the changing of a password, the obsoleting of an entry, the changing of notes, names, or reparenting a node) anywhere from one to all of the bits in the block can be changed. Trivially, this includes the synchronisation sequence preceeding the block as if the synchronisation sequence isn't present then the block does not exist.

  2. Every time a CaiusFob is altered in any way, some amount of known intra-block padding must be altered in a random way. Ideally this will be done so that it looks like number 1 has happened somewhere else in the file as well. Anywhere from zero to all of the padding can be thusly altered in any given change.

  3. No attempt will be made to write to any part of the file which cannot be positively identified as padding unless the user has explicitly stated that they will accept damage to data they cannot currently decrypt.

  4. No indication will be given to the user if any part of the file was unable to be decrypted or failed an HMAC check. Such data is simply incorrectly decrypted and thus ignored.

  5. Intrablock padding can be positively identified if you have two consecutive blocks in a CaiusFob such that the number of bytes between them could not possibly hold the simplest of free space blocks.

  6. When appending a block to a CaiusFob it is encouraged to place up to 50% of the size of the intrablock spacing before it as random padding, and up to 50% afterwards also. Naturally anywhere between zero and the full amount is acceptable, ideally the implementation would choose at random each time.

I promise that I... Daniel Silverstone

A friend and ex-colleague Francis Irving (@frabcus on Twitter) has recently been on a bit of an anti C/C++ kick, including tweeting about the problems which happen in software written in so called "insecure" languages, and culminating in his promise website which boldly calls for people to promise to not use C/C++ for new projects.

Recently I've not been programming enough. I'm still a member of the NetSurf browser project, and I'm still (slowly) working on Gitano from time to time. I am still (in theory) an upstream on the Cherokee Webserver project (and I really do need to sit down and fix some bugs in logging) and any number of smaller projects as well. I am still part of Debian and would like to start making positive contributions beyond voting and egging others on, but I have been somewhat burned out by everything going on in my life, including both home and work. While I am hardly in any kind of mental trouble, I've simply not had any tuits of late.

I find it very hard to make public promises which I know I am going to break. Francis suggested that the promise can be broken which while it might not devalue it for him (or you) it does for me. I do however think that public promises are a good thing, especially when they foster useful discussion in the communities I am part of, so from that point of view I very much support Francis in his efforts.

Even given all of the above, I'd like to make a promise statement of my own. I'd like to make it in public and hopefully that'll help me to keep it. I know I could easily fail to live up to this promise, but I'm hoping I'll do well and to some extent I'm relying on all you out there to help me keep it. Given we're almost at the end of the month, I am making the promise now and I want it to take effect starting on the 1st of February 2015.

I hereby promise that I will do better at contributing to all the projects I am nominally part of, making at least one useful material contribution to at least one project every week. I also promise to be more mindful of the choices I make when choosing how to implement solutions to problems, selecting appropriate languages and giving full consideration to how my solution might be attacked if appropriate.

I can't and won't promise not to use C/C++ but if you honestly feel you can make that promise, then I'm certain Francis would love for you to head over to his promise website and pledge. Also regardless of your opinions, please do join in the conversation, particularly regarding being mindful of attack vectors whenever you write something.

New blog engine up and running Daniel Silverstone

Finally I have my blog resurrected and migrated to IkiWiki which pleases me no-end. The theme still isn't quite right, but for the first time since I left Livejournal all those years ago, I have web-based comment support once more.

For those interested, you can see the blog source content and also you can see the setup content. For those interested in Gitano you can also see the post-receive hook which pings the wiki should I push content via Git instead of using the website.

For now, at least, you must log into the blog in order to comment. Most OpenID forms are supported, though the Google one seems a little temperamental and Google will be dropping OpenID support soon anyway. If you don't have an OpenID yet, I recommend using Stack Overflow's service, it's simple and effective.

Sorry for the ugly form the blog is taking, if one of you wants to offer a replacement theme / templates / CSS I'd be quite grateful for suggestions. Currently I'm using a modified bootstrap based theme but I'd entertain anything which overall looks clean and better. Even little tweaks to make the edit/comment links in the inline pages nicer would be good.

Yakking… Daniel Silverstone

Myself, Lars Wirzenius and Richard Maw have been working on an idea for a while now to have a website where we post articles to help new free-software hackers get started.

We called this idea “Yakking” and it has finally arrived.

If you visit http://yakking.branchable.com/ then you can read about the regular contributors, see a short article written by Lars about software freedom and get the RSS/ATOM feed URLs for your feed readers.

If you think you might like to contribute, then there’s an obvious way to contact us (email) and also a suggestions box on the website.

Some software that I used to build... Daniel Silverstone

Based on Gotye’s ‘Somebody that I used to know’

Now and then I think of when I used to do this
Like when I said this was a simple thing to build
I told myself that it was right for me
To build this software for your company
But I was wrong and it’s an ache I still remember

You can get addicted to a certain kinda project
Like a death march to the end, always the end
So when we found that it could not make sense
To do this project with this recompense
Then I’ll admit that I was glad it was over

But you didn’t have to cut me off
Make out like it never happened and that I did nothing
I don’t even need your cash, but you treat me like a stranger
And that feels so rough

No, you didn’t have to stoop so low
Take my work, write up an invoice
And then take the money
Guess that I don’t need that though
Now it’s just some software that I used to build

Now it’s just some software that I used to build

Now it’s just some software that I used to build

(

Now and then I think of all the times you screwed me over
But had me believin it was always something that I’d done

But I don’t wanna work that way
Reading into every word you say
You said that you could write new code
And I wouldn’t catch you hacking on some software that you used to buiiiild

)

But you didn’t have to cut me off
Make out like it never happened and that I did nothing
I don’t even need your cash, but you treat me like a stranger
And that feels so rough

(oh)

No, you didn’t have to stoop so low
Take my work, write up an invoice
And then take the money
Guess that I don’t need that though
Now it’s just some software that I used to build

Some software (I used to build)
Some software that I used to build
Some software (now it’s just some software that I used to build)
That I used to build
Some software that I used to build
Some software (Some software) (now it’s just some software that I used to build)
That I used to build

I used to build
That I used to build
I used to build
Some software

Tracking activity… Daniel Silverstone

Dear Lazyweb,

I am considering purchasing an activity tracker. In the running are two, the first is the Fitbit Flex and the second is the Jawbone Up but I do not know which to choose.

The Fitbit is a little more flexible, looks cuter and has “moar features” in terms of tracking your climb etc. However it won’t sync with my phone and there’s no viable Linux sync solution AFAICT which would lead to having to have a CackOS box or a Wintendo (and yes, you can draw whatever conclusions you like about my OS preferences from that).

The Jawbone however syncs with Android phones (and mine is on the supported list) via the headphone socket which is quite clever and plausibly even reverse-engineerable. But the Up is a tad more expensive than the Flex and not as convenient in terms of wrist sizing.

I would be very interested to hear from any Flex owners or Up owners, particularly about their experiences using their devices where there’s no Apple or Microsoft involved. I am aware that some previous Fitbit products worked with Linux (fitbitd) but none of the sleep-tracking ones seem to.

For reference, I run Debian/Wheezy (although I am persuading myself to switch to Jessie soon) and my phone is a Galaxy Nexus, running stock Android (although it is in unlocked-bootloader mode).

Please supply ideas.

Kthxbye

Okay, but why YouTube?… Daniel Silverstone

For a month or so now, I have been making YouTube videos on my channel mostly for my own amusement.

I have done screencasts of Haskell (starting with Project Euler solutions).

I have done basic vlogs and, more recently, I have been playing with vidlets which are video-form ficlets

I have yet to find my way entirely, but I am enjoying putting a little microcosm of my life up on YouTube. I got a modest number of viewers in the early days when I pimped my videos out quite hard by blogging, tweeting etc. But more recently I’ve only used whatever automatic pimping YouTube can do on my behalf, and my viewing figures have dropped as I expected.

Fortunately I’m not doing this to get adulation (although it does feel nice when it happens) but rather to help force myself out of my comfort zone. I even made a video about why I make videos for what it’s worth.

I am finding myself wanting to speak to people more. Admittedly currently still with the moderating influence of a computer between me and them, but I’m hoping it might extend to the real world eventually.

If you only take one thing away from this rambly monologue, let it be this: Breaking out of your comfort zone might hurt, but ultimately it’s very beneficial.

This blog is powered by ikiwiki.