= 27d567bc2d48d9f40e9ccc20ea370b15)
ChristianKl comments on A pair of free information security tools I wrote - Less Wrong
You are viewing a comment permalink. View the original post to see all comments and the full post content.
= 783df68a0f980790206b9ea87794c5b6)
Loading…= b715d02e85f7b3b4ae65ca3d3e450868)
Subscribe to RSS Feed
Powered by Reddit
= f037147d6e6c911a85753b9abdedda8d)
You are viewing a comment permalink. View the original post to see all comments and the full post content.
Comments (97)
I don't think that attack is practical, as long as Decoy leaves the metadata alone and works only on the image data. You'd need to reproduce the inputs to a particular implementation of the image encoding exactly, which is impossible unless you're snooping the raw data -- my phone camera produces images in JPEG format (high quality, but it's still lossy compression) and does the conversion before the raw image data even leaves RAM.
If you're dealing with images originating off the device, things get both easier and more difficult. Easier because there will typically be unchanged images in the wild to compare against; more difficult because there will typically be several different copies of an image floating around, and I don't think it's practical to reconstruct every possible chain of encodings. Many popular image-hosting sites, for example, reencode everything they get their grubby little paws on. Send an image as a text, that's another reencoding. And so forth.
As I've mentioned elsewhere, though, decoy images may be statistically distinguishable from an untouched JPEG even if you can't conclusively match it to an origin or e.g. validate against its EXIF tags -- though I could be proven wrong here with the right analysis, and I'd like to be.
If you would put a probability on it, how likely would you expect a proper security audit to prove you wrong?
.01%
How much money are you willing to bet on that?
If the amount is less than $50,000, I suggest you just offer it all as prize to whoever proves you wrong. The value to your reputation will be more than $5, and due to transaction costs people are unlikely to bet with you directly with less than $5 to gain.
I'd be willing to bet 50% of the market value of a feasible distinguishing-attack against AES. Under the condition that whoever proves me wrong discloses their method to me and only me.
In other words: a shitload. Such an attack would be far more valuable than any sum I'd possibly be able to offer.
Wrong on what count? I intended that sentence to refer only to the last paragraph of my post, and I'd expect that to be very implementation-dependent. Generally speaking, the higher the compression ratio the more perfectly random I'd expect the low bits to be -- but even at low ratios I'd expect them to be pretty noisy. I'm fairly confident that some JPEG implementations would leave distinguishable patterns when fed some inputs, but I don't have any good way of knowing how many or how easily distinguishable. To take a shot in the dark, I'm guessing there's maybe a 30% chance that an arbitrarily chosen implementation with arbitrarily chosen parameters would be easily checked in this way? That's mostly model uncertainty, though, so my error bars are pretty wide.
If we exclude that sort of statistical analysis, I'd estimate on the order of a 10 or 20% chance that Decoy images are distinguishable as such by examining metadata or other non-image traces -- but that comes almost entirely from the fact that I haven't read Nanashi's code, I'm not a JPEG expert, and security is hard. A properly done implementation should not be vulnerable to such an attack; I just don't know if this is properly done.