API tools faq
paste
Guest User

OUROBOROS : WATERFALL

a guest
Feb 21st, 2014
41
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 9.66 KB | None | 0 0
raw download clone embed print report
  1. OUROBOROS : WATERFALL ( Cascading Key Encryption )
  2. ===================================================================================================
  3.  
  4. INTRODUCTION:
  5. Keys are usually wrapped with the help of other keys with the purpose of secure transmission or for
  6. storage in mind. A wrapping key may not always be ideal especially in the field of keys at rest.
  7. If a resting key has to be wrapped for protection, the wrapping key must also be protected and this
  8. will result in a chain of keys that need to be protected by other keys. The ideal way of handling
  9. key protection is to have the key protect itself somehow. A person remembering his master key is one
  10. such method of protecting the key as the master key would usually be in the form of a master password
  11. which a security conscious person would remember and hopefully not fall into security pitfalls.
  12.  
  13. OUROBOROS : WATERFALL is a somewhat abstract idea of an algorithm for a key to protect itself by the
  14. virtue of the key "consuming itself" to generate it's own encryption that will produce it's own
  15. ciphertext.
  16.  
  17. OUROBOROS is the name of a concept of this algorithm and also a family of such algorithms that
  18. "consumes itself" like the Ouroboros serpent of legends from many different ancient civilisations. The
  19. Ouroboros world serpent has the ability to consume itself and yet renew itself (thus in a way self-
  20. creating and self-preserving) similar to the workings of this family of self-encrypting key encryption
  21. that uses itself as the material to secure itself. WATERFALL is the name assigned to this very
  22. particular algorithm since the style it uses looks similar to a cascading waterfall which would be
  23. explained in much details later on in this document.
  24.  
  25.  
  26.  
  27. THREAT-MODEL:
  28. The goal of WATERFALL is to allow keys the ability to protect itself from attackers whom have gained a
  29. copy of it.
  30.  
  31.  
  32.  
  33. SAMPLE SCENARIO:
  34. The ideal scenario for the use of WATERFALL to protect keys is a user credential database
  35. that contains multiple passwords of each individual. Whenever a credentials database gets snatched from
  36. a database server, their passwords would quickly be decoded and the secrecy of passwords stored in the
  37. credentials database would be leaked. One of the reasons why hashed passwords are easily cracked is due
  38. to the fact that weak hashes with some salt would be carelessly used to create password hashes (usually
  39. system defaults). One way to circumvent such threats is to use a Hardware Security Module (HSM) to
  40. escrow keys on the behalf of users but that would mean the administrators of the HSM would have to be
  41. trusted and a HSM is not some cheap computing tool everyone can afford.
  42.  
  43.  
  44.  
  45. MECHANICS:
  46. WATERFALL algorithm uses the keys to "consume" itself by using the key as the key material to encrypt
  47. itself. The original key is divided into equal sized blocks of n length with the block size at least
  48. bigger than 2 bits. The algorithm sequence would proceed from the first block to the last block
  49. sequentially from the Most Significant Block (left side) to the Least Significant Block (right side).
  50. The targeted block for encryption would be encrypted with the remaining blocks. The arrangement for the
  51. remaining blocks as key material to encrypt the targeted block would be arranged from the Most
  52. Significant Block to the Least Significant Block in order with the exception of the target itself as
  53. the algorithm is trying to encrypt the targeted block. Every iteration would move the targeted block
  54. from the Most Significant Block to the Least Significant Block and every iteration's output called a
  55. 'Ciphered Key Text Block' would be merged according to their original target's significance position into a
  56. complete 'Ciphered Key Text'. The encryption algorithm is not fixed. One may use any encryption algorithm.
  57.  
  58. Below is an ASCII diagram representation on the concept.
  59.  
  60. 1.) ________________________________________________________________________________________
  61. | |
  62. | Original Key |
  63. |_______________________________________________________________________________________|
  64.  
  65. |
  66. |
  67. \|/
  68. v
  69.  
  70. 2.) _________________________________________________________________________________________
  71. | | | | | | | |
  72. | Block #1 | Block #2 | Block #3 | Block #4 | Block #5 | Block #6 | Block #7 |
  73. |___________|___________|___________|____________|_____________|____________|____________|
  74.  
  75. Blocks are broken into 7 equal sized blocks.
  76.  
  77. |
  78. |
  79. \|/
  80. v
  81.  
  82. 3.) ____________ _____________________________________________________________________________
  83. | | | | | | | | |
  84. | Block #1 | | Block #2 | Block #3 | Block #4 | Block #5 | Block #6 | Block #7 |
  85. |___________| |___________|___________|____________|_____________|____________|____________|
  86. Target for <------------------Encryption key for iteration 1 -------------------------->
  87. iteration #1.
  88.  
  89. For iteration 1, the first block is taken as the target for encryption with the rest (block 2-7)
  90. that is used as the key for iteration 1. The 'Ciphered Key Text Block' for the first iteration,
  91. CKTB 1, would be generated from the encryption of the first iteration and set aside.
  92.  
  93. |
  94. |
  95. \|/
  96. v
  97.  
  98. 4.) ____________ _____________________________________________________________________________
  99. | | | | | | | | |
  100. | Block #2 | | Block #1 | Block #3 | Block #4 | Block #5 | Block #6 | Block #7 |
  101. |___________| |___________|___________|____________|_____________|____________|____________|
  102. Target for <------------------Encryption key for iteration 2 -------------------------->
  103. iteration #2.
  104.  
  105. For iteration 2, the second block is taken as the target for encryption with the rest (block 1,
  106. 3-7) that is used as the key for iteration 2. The 'Ciphered Key Text Block' for the second
  107. iteration,CKTB 2, would be generated from the encryption of the second iteration and set aside.
  108.  
  109. |
  110. | <Fast forward to last iteration>
  111. \|/
  112. v
  113.  
  114. 4.) ____________ _____________________________________________________________________________
  115. | | | | | | | | |
  116. | Block #7 | | Block #1 | Block #2 | Block #3 | Block #4 | Block #5 | Block #6 |
  117. |___________| |___________|___________|____________|_____________|____________|____________|
  118. Target for <------------------Encryption key for iteration 7 -------------------------->
  119. iteration #7.
  120.  
  121. For iteration 7, the seventh block is taken as the target for encryption with the rest (block 2-7)
  122. that is used as the key for iteration 7. The 'Ciphered Key Text Block' for the seventh
  123. iteration,CKTB 7, would be generated from the encryption of the seventh iteration and set aside.
  124.  
  125. |
  126. |
  127. \|/
  128. v
  129.  
  130. 5.) _________________________________________________________________________________________
  131. | | | | | | | |
  132. | CKTB #1 | CKTB #2 | CKTB #3 | CKTB #4 | CKTB #5 | CKTB #6 | CKTB #7 |
  133. |___________|___________|___________|____________|_____________|____________|____________|
  134. <---------------------------Completed Ciphered Key Text---------------------------------->
  135.  
  136. The CKTBs are merged together according to their original unciphered text's significant positions.
  137.  
  138. |
  139. |
  140. \|/
  141. v
  142.  
  143. 6.) To decrypt, the original password / key is presented, split into equal pieces and decrypted in the
  144. reverse process. The encryption algorithm used for every iteration is up to the choice of the user.
  145. The generated Ciphered Key Text would be significantly larger than it's original key it protects.
  146.  
  147.  
  148.  
  149. NOTES:
  150. The use of WATERFALL to protect passwords and keys that only authorized parties have conscious access to
  151. is required. Attempting to use WATERFALL as a key wrapping device to send keys across a channel would
  152. require the sender and receiver to know the original password / key. Leaking any part of the password /
  153. key, as with other security protocol, would reduce the security of the algorithm.
  154.  
  155.  
  156.  
  157. INTELLECTUAL PROPERTY:
  158. This algorithm described here is free to the public to implement, distribute and modify at their own will
  159. without legal restrains of any sort in regards to patents and intellectual property, however, the only
  160. contract is to not claim the original design falsefully and / or use it to restrict others from freely
  161. implementing, modifying or distributing this algorithm.
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!