API tools faq
paste
Guest User

OUROBOROS : WATERFALL V1

a guest
Feb 21st, 2014
43
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 9.66 KB | None | 0 0
raw download clone embed print report diff
  1. OUROBOROS : WATERFALL ( Cascading Key Encryption )
  2. ===================================================================================================
  3. AUTHOR: THOTHEOLH
  4.  
  5. INTRODUCTION:
  6. Keys are usually wrapped with the help of other keys with the purpose of secure transmission or for
  7. storage in mind. A wrapping key may not always be ideal especially in the field of keys at rest.
  8. If a resting key has to be wrapped for protection, the wrapping key must also be protected and this
  9. will result in a chain of keys that need to be protected by other keys. The ideal way of handling
  10. key protection is to have the key protect itself somehow. A person remembering his master key is one
  11. such method of protecting the key as the master key would usually be in the form of a master password
  12. which a security conscious person would remember and hopefully not fall into security pitfalls.
  13.  
  14. OUROBOROS : WATERFALL is a somewhat abstract idea of an algorithm for a key to protect itself by the
  15. virtue of the key "consuming itself" to generate it's own encryption that will produce it's own
  16. ciphertext.
  17.  
  18. OUROBOROS is the name of a concept of this algorithm and also a family of such algorithms that
  19. "consumes itself" like the Ouroboros serpent of legends from many different ancient civilisations. The
  20. Ouroboros world serpent has the ability to consume itself and yet renew itself (thus in a way self-
  21. creating and self-preserving) similar to the workings of this family of self-encrypting key encryption
  22. that uses itself as the material to secure itself. WATERFALL is the name assigned to this very
  23. particular algorithm since the style it uses looks similar to a cascading waterfall which would be
  24. explained in much details later on in this document.
  25.  
  26.  
  27.  
  28. THREAT-MODEL:
  29. The goal of WATERFALL is to allow keys the ability to protect itself from attackers whom have gained a
  30. copy of it.
  31.  
  32.  
  33.  
  34. SAMPLE SCENARIO:
  35. The ideal scenario for the use of WATERFALL to protect keys is a user credential database
  36. that contains multiple passwords of each individual. Whenever a credentials database gets snatched from
  37. a database server, their passwords would quickly be decoded and the secrecy of passwords stored in the
  38. credentials database would be leaked. One of the reasons why hashed passwords are easily cracked is due
  39. to the fact that weak hashes with some salt would be carelessly used to create password hashes (usually
  40. system defaults). One way to circumvent such threats is to use a Hardware Security Module (HSM) to
  41. escrow keys on the behalf of users but that would mean the administrators of the HSM would have to be
  42. trusted and a HSM is not some cheap computing tool everyone can afford.
  43.  
  44.  
  45.  
  46. MECHANICS:
  47. WATERFALL algorithm uses the keys to "consume" itself by using the key as the key material to encrypt
  48. itself. The original key is divided into equal sized blocks of n length with the block size at least
  49. bigger than 2 bits. The algorithm sequence would proceed from the first block to the last block
  50. sequentially from the Most Significant Block (left side) to the Least Significant Block (right side).
  51. The targeted block for encryption would be encrypted with the remaining blocks. The arrangement for the
  52. remaining blocks as key material to encrypt the targeted block would be arranged from the Most
  53. Significant Block to the Least Significant Block in order with the exception of the target itself as
  54. the algorithm is trying to encrypt the targeted block. Every iteration would move the targeted block
  55. from the Most Significant Block to the Least Significant Block and every iteration's output called a
  56. 'Ciphered Key Text Block' would be merged according to their original target's significance position into a
  57. complete 'Ciphered Key Text'. The encryption algorithm is not fixed. One may use any encryption algorithm.
  58.  
  59. Below is an ASCII diagram representation on the concept.
  60.  
  61. 1.) ________________________________________________________________________________________
  62. | |
  63. | Original Key |
  64. |_______________________________________________________________________________________|
  65.  
  66. |
  67. |
  68. \|/
  69. v
  70.  
  71. 2.) _________________________________________________________________________________________
  72. | | | | | | | |
  73. | Block #1 | Block #2 | Block #3 | Block #4 | Block #5 | Block #6 | Block #7 |
  74. |___________|___________|___________|____________|_____________|____________|____________|
  75.  
  76. Blocks are broken into 7 equal sized blocks.
  77.  
  78. |
  79. |
  80. \|/
  81. v
  82.  
  83. 3.) ____________ _____________________________________________________________________________
  84. | | | | | | | | |
  85. | Block #1 | | Block #2 | Block #3 | Block #4 | Block #5 | Block #6 | Block #7 |
  86. |___________| |___________|___________|____________|_____________|____________|____________|
  87. Target for <------------------Encryption key for iteration 1 -------------------------->
  88. iteration #1.
  89.  
  90. For iteration 1, the first block is taken as the target for encryption with the rest (block 2-7)
  91. that is used as the key for iteration 1. The 'Ciphered Key Text Block' for the first iteration,
  92. CKTB 1, would be generated from the encryption of the first iteration and set aside.
  93.  
  94. |
  95. |
  96. \|/
  97. v
  98.  
  99. 4.) ____________ _____________________________________________________________________________
  100. | | | | | | | | |
  101. | Block #2 | | Block #1 | Block #3 | Block #4 | Block #5 | Block #6 | Block #7 |
  102. |___________| |___________|___________|____________|_____________|____________|____________|
  103. Target for <------------------Encryption key for iteration 2 -------------------------->
  104. iteration #2.
  105.  
  106. For iteration 2, the second block is taken as the target for encryption with the rest (block 1,
  107. 3-7) that is used as the key for iteration 2. The 'Ciphered Key Text Block' for the second
  108. iteration,CKTB 2, would be generated from the encryption of the second iteration and set aside.
  109.  
  110. |
  111. | <Fast forward to last iteration>
  112. \|/
  113. v
  114.  
  115. 4.) ____________ _____________________________________________________________________________
  116. | | | | | | | | |
  117. | Block #7 | | Block #1 | Block #2 | Block #3 | Block #4 | Block #5 | Block #6 |
  118. |___________| |___________|___________|____________|_____________|____________|____________|
  119. Target for <------------------Encryption key for iteration 7 -------------------------->
  120. iteration #7.
  121.  
  122. For iteration 7, the seventh block is taken as the target for encryption with the rest (block 2-7)
  123. that is used as the key for iteration 7. The 'Ciphered Key Text Block' for the seventh
  124. iteration,CKTB 7, would be generated from the encryption of the seventh iteration and set aside.
  125.  
  126. |
  127. |
  128. \|/
  129. v
  130.  
  131. 5.) _________________________________________________________________________________________
  132. | | | | | | | |
  133. | CKTB #1 | CKTB #2 | CKTB #3 | CKTB #4 | CKTB #5 | CKTB #6 | CKTB #7 |
  134. |___________|___________|___________|____________|_____________|____________|____________|
  135. <---------------------------Completed Ciphered Key Text---------------------------------->
  136.  
  137. The CKTBs are merged together according to their original unciphered text's significant positions.
  138.  
  139. |
  140. |
  141. \|/
  142. v
  143.  
  144. 6.) To decrypt, the original password / key is presented, split into equal pieces and decrypted in the
  145. reverse process. The encryption algorithm used for every iteration is up to the choice of the user.
  146. The generated Ciphered Key Text would be significantly larger than it's original key it protects.
  147.  
  148.  
  149.  
  150. NOTES:
  151. The use of WATERFALL to protect passwords and keys that only authorized parties have conscious access to
  152. is required. Attempting to use WATERFALL as a key wrapping device to send keys across a channel would
  153. require the sender and receiver to know the original password / key. Leaking any part of the password /
  154. key, as with other security protocol, would reduce the security of the algorithm.
  155.  
  156.  
  157.  
  158. INTELLECTUAL PROPERTY:
  159. This algorithm described here is free to the public to implement, distribute and modify at their own will
  160. without legal restrains of any sort in regards to patents and intellectual property, however, the only
  161. contract is to not claim the original design falsefully and / or use it to restrict others from freely
  162. implementing, modifying or distributing this algorithm.
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!