Linked by Thom Holwerda on Tue 24th Apr 2012 17:39 UTC
Thread beginning with comment 515596
To read all comments associated with this story, please click here.
To read all comments associated with this story, please click here.
News
Linked by Thom Holwerda on 06/18/13 22:33 UTC
Linked by Anonymous on 06/18/13 22:26 UTC
Linked by Thom Holwerda on 06/18/13 22:25 UTC
Linked by Thom Holwerda on 06/18/13 17:45 UTC
Linked by Thom Holwerda on 06/18/13 17:32 UTC, submitted by poundsmack
Linked by Thom Holwerda on 06/17/13 17:58 UTC
Linked by Thom Holwerda on 06/17/13 17:52 UTC
Linked by Thom Holwerda on 06/14/13 21:03 UTC
Linked by Thom Holwerda on 06/14/13 20:46 UTC
Linked by Thom Holwerda on 06/14/13 17:32 UTC
More News »
Sponsored Links



Member since:
2012-02-26
This comment assumes the following as background:
https://en.wikipedia.org/wiki/Secret_sharing
https://en.wikipedia.org/wiki/Secure_multi-party_computation
https://en.wikipedia.org/wiki/One-time_pad
https://en.wikipedia.org/wiki/One-time_password
https://en.wikipedia.org/wiki/Byzantine_Fault_Tolerance
Now. You want an unbreakable remote storage? You need some parts.
1, You need 3+ computers. Grab some Rasberry Pi's, secure them in the usual manner. For better security, each of them should run a different OS (different versions of Linux don't count, Linux + BSD is possibly OK). These computers will store your data via a secret sharing scheme with a threshold. If the adversary breaks in to more servers than the threshold, they can discover the files. Hence the OS diversity. The client will need to access these servers in turn in order to get the files. Note that you need at least 3 computers so that 1/3 of them can fail in any arbitrary manner, and this puts an upper limit on the threshold for secret sharing.
2, You need a One-Time Password mechanism. There are several sites that sell OTP generators. Trick is, I don't know what algorithm they use. The security of this system is entirely in the quality of the RNG used. This authentication system can be tricked if someone steals your OTP generator or if someone can predict the next password given the current one. OTP systems work by the server storing the seed and running the generator, so in order to make the auth system work securely, SMPC is required.
If you don't like that version of 2, you can try:
2, You need a Zero-Knowledge proof system that asserts your client knows something without telling the server what that thing is. Hamiltonian Circuit looks fun, if the graph is never transmitted.
3, you need some way of communicating securely. The bullet-proof version is One-Time Pad. I won't say another word about the infeasibility of that. Most internet traffic uses TLS, and if this is used, all computers should have certs from a trusted authority. Alternatively, you can use Diffie-Helman Key Exchange to get a symmetric key, and use AES or whatever.