Topic: Keyless encryption and passwordless authentication - page 2. (Read 2887 times)

Exactly the same procedures, changes of chaotic arrangement relative to each other, simultaneously occur with all "neighbors" of this element, which was used in "encoding" information, at this point in time, in this logical tunnel of time (in this LTT).

But then one interesting chain of events can be traced, which leads to even more interesting results.

The encryption principle strictly limits the use of more than one element of one enclave for "encoding once" (and actually only finding a pointer vector to this element, in this geometric encryption model principle) at one point in time.

Another principle suggests that the system (primarily GIS systems) - should not be in a static state.

We do not have a key, which dictates the order and regularity of changing all settings and states of the system.

So what should we do with these contradictions?

  There is both an interesting way out and a way to disguise.
You can smear useful, original user information, which is encrypted - fake, garbage "information" created by the system only in moments when there is no information for encryption from the user.

On the one hand this seems to be a drawback, because the system must simulate information exchange at times when it is not available.

On the other hand, there is not only the effect of disguising useful information - fake, we do not really need it.
And more interesting is the effect of hiding from an external observer the real amount of information exchanged by users. The external observer only sees what maximum size of information has passed through its observation point.
But the external observer has no idea how much coded information is in this flow, and whether it is there at all.

This is a real closed communication channel, not just encryption.

Tell me, what other encryption systems have such an interesting and useful effect in the communication channel they organize?

It is clear that in such a sensitive model, the correct configuration and the correct selection of algorithms is very important.
This work should be done taking into account the fulfillment of the “always new neighbor” condition for any element of the system.

It is also necessary to take into account the stability of the performed transformations to a possible loop, to the periodic hit of the same symbol in the same cell.

In other words, the selected set of transformation algorithms should not bring the system into a state of repeated or non-periodic cyclicity.
In any encryption system, the cycle can be calculated, this is a clear vulnerability and a loophole for cryptanalysis.

With each new transformation, each element of space, at any level of space, must begin its movement to a new location, only from the previous location, a connection of history appears, a continuous connected chain of all transformations is observed.

Just like in the blockchain, a chain of connected blocks, but with an analog of blocks, we have a state of space, which (in normal operation mode) is not saved, there is no need. The save mode of previously existing space states is possible for the implementation of the “restore point” mode by analogy with the restore points in operating systems. Such recovery points can be created by taking and saving screenshots of space and time counters at the right time.
 
Due to the strict interconnection of all system states and a direct dependence on the entire information exchange processed by the system on a point-to-point site, the difference in the entire information stream, even in one bit, is always noticeable, easily analyzed, and unambiguously calculated.

This error can be fixed by requesting a retry of this package. This principle of operation of a keyless encryption system provides absolute integrity control and the impossibility of discreet modification of any data packet, and therefore the entire information exchange as a whole.
We add one more rule to this brief description: if one element, from any one area of ​​space, was used for “coding” at least once, this entire area of ​​space (enclave) cannot be reused without a thorough transformation.

This is the implementation of the principle of combinatorics, if any law is applied to chaos, but the same to all elements of this chaos, then we will always get only new chaos, and we will never get order.

A good rule for our system, which has some kind of inside of itself that is not defined by an external observer, is chaos.

Any chaos, any internal uncertainty, random numbers and random variables are encryption friends and enemies of cryptanalysis.

=================
The fact is that the issues of encryption of information are more or less well resolved.
Few people want to use uncertified encryption technologies
encryption technologies (such as ours, KE), but the issue of passwordless
authentication is well unsolved.

It is especially relevant for banks, for their security systems.

The problem of phishing in the usual password authentication is not very well solved,
e.g. by increasing authentication factors (biometrics, SMS, temporary
valid codes, etc.), two- and even three-factor authentication systems.
All these technologies are only modification of authentication by stable factors,
assigned to this or that client.

No really working password-free authentication.
And yet, billions have already been invested in this topic by the world's leading corporations.

Therefore, it is necessary to clearly define what to call what.
let's make such a definition:

If in this closed channel of communication (SCC) is observed:
- a rapidly changing, strictly deterministic, known only to the members of that VCS - digital factor for authentication;
- any and each authentication factor is used only once;
- any and each authentication factor is not generated in advance, is not transmitted through third-party channels (local), and does not require storage;
- authentication occurs continuously, does not stop the whole communication session, a priori for each data packet, in both directions;
- any and every authentication factor is not derived from any other authentication factor or from any set of them;
- the fast changeability of any authentication factor is in no way related to physical time and has no stable generation function;
- generation of any authentication factors does not require the user to create, store, use any password information,   
then such method of authentication, within the framework of this technology, will be called password-free authentication.

--------------
Information security systems are based on rules, technologies, security protocols, and cryptography. The core of information security systems is cryptography. All modern symmetric cryptography is built on the same principle: the encryption scheme is determined by the key. And even if the cryptography itself is "conditionally secure" or absolutely secure (absolutely strong Vernam ciphers), the fact of having a key will always be a natural vulnerability in any security system. First of all, attacks will be aimed at keys (passwords), the "human factor" will be exploited most successfully.
It is this factor that instantly and irrevocably weakens to zero any most secure cryptographic system and consequently the security system in general. There will be fatal consequences if the fact of compromising key or password information remains a secret to the attacker for a long time. The same danger will be acute for any new cryptography that will exist in the era of quantum computers, for any newest cyber defense system of tomorrow.

Yeah, that's a lot of gibberish... The old concept keeps crumbling like sand...
Here's a recent gibberish: Developers of popular Android apps forgot to fix a dangerous vulnerability...
This year, Oversecured security researchers discovered a serious vulnerability (CVE-2020-8913) in the Play Core library, which allowed malware installed on users' devices to inject rogue code into other apps and steal sensitive data such as passwords, photos, 2FA codes and more.  Nothing about the topic of password-based security - doesn't that help your thinking go into a groove?
According to a scan conducted by Check Point, six months after the Play Core update was released, 13% of all apps on the Google Play Store were still using the library, and only 5% were using the updated (secure) version. Among the apps with the highest number of users who failed to update the library, Check Point identified:
- Microsoft Edge, Grindr, OKCupid, Cisco Teams, Viber and Booking.com.

You don't happen to have products from these companies. I mean on the devices you use when you work with cryptocurrency?

It's the scam of the century. It's happening now. It's called encrypt your secrets with good cryptography, and we'll just steal your key. So statistics show that whoever has a key to keep for a long time is a profane.
Today we are all profane.
And for us, for the profane, there is gibberish, like security in cyberspace, which does not yet exist.
And then there's gibberish for those who look at things superficially.
Everyone has a choice.
The con is where one writes for the sake of writing and being a legendary and untalented writer on the forum.
And if there is a desire to think freely, to think, for the sake of interest and not just to write, then I will write the following for those.
The key is what opens the lock. If the lock is not changed for a long time, the key can be picked. Therefore, if the lock is not changed for a long time, the key should be as sophisticated as possible. If you change the lock sometimes, there will be less time to pick the key. And if the lock is changed very often, the complexity of the key will cease to matter and there will be no time to pick the key. And if you change it even more often... then you can refuse the pair lock-key at all, it is enough to change, to know the direction of opening of this door. For example, the door to yourself is "1", the door from yourself - "0". Imagine that we need to guess 256 openings and never make a mistake. We can only try once, there is no time for a second attempt. The gambler will say - you can try. The analyst will say - there is no point in trying, it is the same as guessing a key that is 256 bits long. It is not possible to guess, because this problem cannot be solved, even by a complete search, in polynomial time, not only with modern computing power, even those that can be predicted in the future. And in our example, there is no time at all, let us say conventionally, one second and only one attempt. These explanations are given to understand the level of complexity of the problem, and hence the reliability of encryption in such a concept.

gibberish thread. I wonder what scam its peddling on the backend?

Technological part.
Steamless symmetric encryption technology is based on the method of very fast change of encryption schemes, which are determined only in very short moments and are absolutely unpredictable for an external observer-analyst. The lack of the ability to attack the person in the middle (MITM) prevents key or password information from being compromised by users.
To fully implement the principle of fast change of encryption schemes, a vector-geometric encoding technology was developed based on fast and continuous change of virtual geometric space in a continuum with virtual internal time.
Such cipher code is reasonably resistant to cryptanalysis, brute force attack, especially given the rapid emergence of quantum computers. The keyless cipher code is absolutely resistant to Chosen-plaintext attack (CPA) attacks based on comparing the selected open text with the cipher code, without the possibility of violating the integrity of the open message, hidden modification, even at the level of one bit of information, and special (attack), and "noise" origin.
Instant and continuous verification of any volume of transmitted (or received) information.
  A channel watcher has no possibility to know:
 1) who transmitted (or received from whom) the information;
 2) how much information is transmitted and/or received at all or per session;
 3) whether there was any information exchange between users at all;
 4) all pauses of the "silence" moments of the interlocutors, of any duration, are filled with fake data, which are encoded in the same way as an open message.

--------------------------
In a keyless system that does not have a key, but has a continuously changing set of encryption schemes, it is necessary to perform exactly the same task for absolutely every data packet with a volume of 256 bits.
Why?
Because for any and every 256-bit message, one unique encryption scheme is used (in fact, this is a unique set of encryption schemes and rules).

Consider attack resistance.
First. If the message contains only 10 data packets of 256 bits each, this is 10 times 2256 bits of information, then a brute force attack will have to be carried out absolutely on each data packet.
Mathematically, this means that with respect to the key encryption model, the task becomes more complicated as many times as there are data packets (256 bits each) a message contains.
Second. In contrast to the key encryption model, in a keyless system, the hypothetical positive result of a successful brute-force attack of any number of data packets (256 bits each) does not help to solve the problem of decrypting other data packets that make up this message.
Third. Thus, a rough search will have to be done for each data packet from the available set. If G is the minimum number of data packets, adding up which it is possible to unambiguously understand the open message, then the exhaustive search problem will look like this: it will be necessary to check 2 to the power (G * 256) options. The possibility of attacking such numbers needs no comment, it is utopia by definition for any high technological level of attackers.
 Fourth. Any model of keyless encryption, technologically, must have the function of "encryption of silence", which simulates the exchange of cipher codes of open messages in this closed communication channel. If this function is there, therefore, you can use it as many times as necessary. This means that the number of packets that must be simultaneously decoded to understand an open message can be any large, regardless of the minimum size of the open message itself. How to solve the problem of breaking a cipher with such an additional condition? I can not imagine.

All modern cryptography is built on the same principle: the encryption scheme is defined by the key. And even if the cryptography itself is "conditionally reliable" or absolutely reliable (Vernam's ciphers), the fact of having a key will always be a natural vulnerability, which will be actively exploited by fraudsters in the first place. It is this vulnerability factor that instantly, irrevocably, completely levels out and weakens to zero any most reliable cryptographic system. Moreover, it has fatal consequences if the fact of compromising key information remains a mystery to the attacker. For this reason, all new post-quantum encryption systems, any key encryption technology, all the latest security systems of tomorrow will be no exception.
Any security system, a security protocol based on cryptography with a mandatory key function, will be attacked first, through the encryption keys, through its weakest point.

Keyless encryption technology, in essence, has a strict and clear theoretical rationale.
So... Any key system (for simplicity let's talk about symmetric encryption systems) uses the key to select one encryption scheme from a variety of possible ones. One key is one scheme. The same public message is the same cipher code. This is exactly the point that has been changed in the keyless encryption model.
Specifically, that's it.
You select the size of the message to be encrypted in one encryption scheme, one of many possible in the system. For example, the message size is 256 bits. A priori, this is the message size that you would not fear even a brute force attack, even a quantum computer. This is a known fact, so we chose the size of the first message that was encrypted with the first encryption scheme.
Next. The second message is encrypted with a new encryption scheme that is unknown to the outside observer. And so on. Each new message...
is encrypted with a completely new encryption scheme.
What does an external observer need to know in order to calculate a new encryption scheme following the previous one?
In addition to the key that was used to encrypt the first 256-bit message, he needs to know all the public texts of all messages up to the last one, to have all the ciphers of all messages without a single error (even a 1-bit error is not a 1-bit error).
It is allowed), to know the exact sequence of all messages and their cipher codes and much more.
Look at the differences. In a key system, you don't need to know anything but the key.
Isn't this a fundamentally different solution to key information security problems? Doesn't it have some fundamental theoretical contradictions or obstacles?
It's an interesting discussion on this subject.

Today hackers don't crack, they don't look for hard decisions, they just log in with a password. This phrase, which is often repeated by cybersecurity experts, describes a real pattern: most hackings are due to stealing passwords, not malware. That's it, it turned out to be just...
This is a direct consequence of outdated key and/or password authentication technologies that are based on unique client identifiers fixed on the server, including biometric constant identifiers.
So what is the point of existing complex cryptographic solutions, even of new post-quantum cryptography, if the key or password basis of these technologies is always attacked? This is an old rudimentary loophole for swindlers, which is never closed at the fundamental level of protection systems functioning. 
The conclusion is unequivocal. What can work reliably for one well-organized, attentive and accurate person does not work very well, or rather does not work properly at all, for an average user. Even worse, it works for large groups of people connected by the same security system, where a single member's vulnerability compromises the entire security system. This is the case when a correct, reliable, good theory of protection does not go well with modern practice, with the observed pattern of cybercrime, with the realities of our lives. 

The point of authentication without a password is not that you can't use your password, but that your password can't be used by anyone other than yourself, except the account owner.
With regular password authentication, when your password has fallen into the hands of a fraudster, you are lost. And it's good if you find out about it.
With passwordless authentication, if someone steals your password, they can't use it! And moreover, such an attempt will surely become known to you (if there is such a service).
In passwordless authentication, a fraudster needs to steal not only your password, but your entire device. And the loss of the device - a normal person will notice immediately. But the loss of the password - will not notice, because this information.
Fraudsters take advantage of the fact that you know nothing, that they have the password. If you knew that, you would take urgent action.
For this reason, passwordless authentication will make the fraudster's life as difficult as it can even be done. 

---------------------------
Do you really think you control when you have a password?

And how can you be sure that you're in control and not someone else?

Maybe your password isn't just yours anymore.

Who knows if your information is here:

- The FBI recently seized the domain WeLeakInfo.com for giving users access to data that's gone online. The operation was carried out jointly with the National Crime Agency (NCA), the Netherlands National Police Corps, the German Federal Criminal Police Office (Bundeskriminalamt) and the Police Service of Northern Ireland. The website provided users with access to data from over 12 billion entries (!) containing email addresses, logins, telephone numbers and passwords.  And that's the amount of user data available on just one domain!

The collapse of the password security system has already occurred, but we do not notice it persistently.

--------------------------------
About 2FA - I described in detail in the post of March 09 = 13 ways to bypass this technology. The more factors, 2FA is more than 1FA, the harder it is to bypass 2 levels of protection when the technology first appears. But with time, when cheaters start to study it, they find ways to hack, and their methods of hacking concern each of the factors. It's all described above.
If it's 3FA, 4FA... it's going to be the top at first! And at the end, as soon as you get used to it, you get even more hacking than with a 1-PhA than with a normal password.
If I were to suggest one more factor, time:
1. I would not offer anything new, this idea is many years old and it was useless;
2. I'd introduce a third factor that would only weaken, in the end, not strengthen the defense.

For now, I'm stopping myself from being so stupid...

The basis for passwordless authentication is that as a client and server, you need to identify every packet of data.
A data packet is a bit sequence of a predetermined length.
You need to recognize your bitmap sequence from an outsider.
In addition, this identification only works simultaneously in 2 directions. And only continuously, for each data packet - the same check.
But how can we do this if we do not know in advance what information is transmitted in the next data packet?
No way. With this data packet you will do nothing, accept, decipher. And put it on hold for inspection...  the user won't get it yet, even though it's decrypted.
But then you need to form your data packet and send it.
And how do you form it if you don't have the key?
That means, you need to use all events in the system - as arguments for irreversible functions (hash functions) to get a result - which will set up a new encryption scheme for a new data packet.
Recall that we are talking about a geometric encryption model (who has not read above - read).
And what new encryption scheme will I get?
If I decrypted every bit of it correctly (and in all rounds, not just in the end) - it will be exactly the same as it was prepared to receive my data packet - my companion. In other words, me and my conversation partner, the new encryption and decryption scheme will match! It's a symmetrical encryption system.
And in the end what?
I "correctly", understandably for my interlocutor, encrypt my data, and he will take it and decipher it correctly.

And if I decrypted the received data packet incorrectly, at least by 1 bit - my encryption scheme will be cardinally, thoroughly, very much different from the scheme prepared by my conversation partner.
And what will happen?
He will decrypt my data incorrectly and prepare another encryption scheme for his new data packet. The situation will become avalanche-like - we will no longer understand each other, which means that the data packet that I decrypted, postponed, and did not give to the user - will be found to be erroneous:
1. or erroneously decrypted due to interference in the communication channel or no matter what else;
2. or it's not our data packet at all, it's an attack, modification, misinformation - no matter what, it's fictitious.

So what do we do? Let's not cry.
Let's ask for a repeat of exactly this data packet and start building a new encryption scheme - exactly the same scheme as the wrong data packet came in and failed to check.
Let's do it again.
Until we get and correctly decrypt the new, repeated data packet, until the data packet is unambiguously authenticated as "its" by the new data packet - we do not use the information encrypted in it, it is recognized by the system as misinformation.

It is clear that the data packet, apart from the information, has a sufficient set of service bits to make a preliminary check of the package - in advance, until its full decryption.
It is clear that the geometrical space has not only elements filled with information, but also a lot of empty cells, and if the information is not true, then the decryption will be built a vector on an empty cell and the system will understand in advance - that somewhere there is an error (see the following). Vector-geometric encryption scheme from December 7, 2019 in this topic), but it's all the nuances of the technology, they are not needed to understand the principle of identification and 100% authentication of the sender of ALL ONE DATA PACKAGE and the same EVERYTHING DATA PACKAGE!

With normal authentication - the server recognized you (you server usually only recognize by the appearance of the site - and this is in our 21st century!!!!), and then works with you without checking each data packet, your he or Eve (attack man in the middle and other nasty things).
That's what all phishing is based on - you've had your passwords, every security factor taken away once, and everyone is using it without fear that the server will notice a spoof.
One theft is a bunch of problems. It's now.
We have nothing to steal because the encryption scheme (like key) for each data packet is different (like key). If this non-existent key, this encryption scheme - the cheater steals it, he will not be able to use it for the following data packet - he can not until he steals your entire device.

This is real security and real authentication, not a password template.

I still don't see how is this better than 2FA.
The secret password/seed is needed and one more "derivation" component based on time is necessary.
The problem of 2FA is the way it's usually implemented and used, favoring the secret password/seed being stored on vulnerable devices. But nowadays there are hardware devices handling that too.

---------------------------------------

- Recently, unknown persons attacked UN units, "as a result, components of key infrastructure in Geneva and Vienna were compromised ..." - quotes Dujaric Reuters (stealing keys);
And that's what it leads to, password, key, the essence of one you break through them even if you have post quantum cryptography or quantum key distribution.
By the way, nobody limits you from a password - in passwordless authentication or from a key - in keyless encryption. This is your own business.

But if this "your personal business" is stolen, then this technology will NOT be able to use it against you.

If you only use a password or just a key, then even if you live in this future with new cryptography, there is phishing and other nasty modern things against you.
No cheater breaks the cryptographic system or password authentication, their mind is not so configured.

That's what they do against us:

- The CIA, together with the German Federal Intelligence Service (Bundesnachrichtendienst, BND), has been reading secret messages from officials in more than 120 countries for the past fifty years (!) through Crypto AG, a company that produces special encryption equipment (via encryption keys);

- security researchers from ESET discovered the dangerous vulnerability Kr00k (CVE-2019-15126) in widely used Wi-Fi chips from Broadcom and Cypress and affects more than a billion devices worldwide (smartphones, tablets, laptops, routers and IoT devices) that use the WPA2-Personal or WPA2-Enterprise protocol with the AES-CCMP encryption algorithm. Now Amazon (Echo, Kindle), Apple (iPhone, iPad, MacBook), Google (Nexus), Samsung (Galaxy), Raspberry (Pi 3), Xiaomi (RedMi) and access points from Asus and Huawei are under attack. The Kr00k vulnerability is related to Key Reinstallation Attack (KRACK), which allows attackers to crack Wi-Fi passwords protected by the WPA2 protocol (keys again);

- huge problems with device shells that contain embedded vulnerabilities such as embedded passwords and embedded SSH/SSL keys. The appearance of one such device in your home, including an IOT device, connecting it to your home wi-fi, allows you to attack all your other devices connected to the same access point (keys, passwords);

- experts found a database with unencrypted e-mail addresses and passwords of more than 1 billion users on the Web, put up for sale by a cybercriminal under the pseudonym DoubleFlag (passwords);

- of the 175 million RSA certificates analyzed, over 435,000 are vulnerable to attack. At the international conference IEEE TPS (Trust, Privacy and Security) in Los Angeles, California, a group of researchers from Keyfactor presented these results (vulnerability of key infrastructures in general).

So what does the password give? Protection? It's more like the opposite.

I still want to feel that I control something and know the password.

------------------------
No, that's not right.
When you send messages through a messenger, or by mail if encryption is enabled, this is normal key encryption.
Which one is a question for the program you are using.
If it's E2E encryption, then 2 cryptographic systems and Meclie Marlinspik's double ratchet (first used in Signal) are used at once.
Yes, you don't make up the keys, you don't even know them, if you're particularly gifted, you don't even know that the channel is encrypted. But it is encrypted with the keys, the keys are stolen remotely from you, and then you are listened to, and you say, write without understanding that your ears are already sitting.
The general type of protocol is very sketchy and very unspecified:
1) An asymmetric cryptographic system (usually RCA or ECC) negotiates the shared session secret key of the communication channel, the given encryption session.
2. This key is then used by some symmetric cryptographic system to encrypt your traffic.
3 If there is an E2E, then each message has its own additional modified key, derived from the shared encryption key and a number of other factors.

That's it. This is a protocol built on key encryption systems.
What does it take to read your channel? A key or keys.
How do crooks get them?
Easily, in a variety of ways, read online.
What are the consequences of using key systems?
Global.
Fraudsters do not break a cryptographic system, except for someone who is waiting to run a quantum computer for public use over a network (there is such a service).
 They collect your encrypted messages.
Then they get the key.
Then, all your secrets stop being secrets.
Or they do it quickly through a 'man in the middle' attack, phishing and other nasty things.
And you don't know anything about that.

What does a keyless encryption system give - no matter how many of the above problems, no matter how many of your encrypted messages a cheater (or special services, which are the same) would accumulate, no matter how many "keys" he steals or searches for with a quantum computer - he will not find them for a simple reason, they simply do not exist.

Let him try, and we'll see.

What a bonus to such an encryption system is passwordless authentication. You don't need to enter a password, this password doesn't remember your or a third-party application and doesn't enter it for you, you don't need to put your finger on the sensor, your eyes, blood, heartbeat, DNA, your saliva and your other biological waste.
You need to access the channel from the program you came in from earlier. This program (encryption program, keyless cipher generator - KCG) has a unique, original state of its internal spatial virtual continuum. So, encrypting your information (or false information if you are silent) always, for every packet of your data that you send, happens by a new rule that only a second program that has all the same up to one bit history of communicating with you, all the up to one bit correctly decrypted previously information that does not accumulate, but is an argument for a derivative that changes the geometry of your internal space.
The analogue. You're welcome.
How many chess games, how many options are there for arranging pieces on the chessboard?
Many, I couldn't calculate.
Now add here a variable number of pieces from 1 to 64 (instead of 2 to 32, as is).
Also add here a game without rules, which means that any piece can turn into any one and have new variants at all.
After that add one more condition - there are no 2 or more identical pieces on the board (for example, in chess there are 16 identical pawns).
And now there is an indefinitely huge number of variants - you do not apply to all possible variants of information, but only six (six) bits, and 6 (six) bits have only 64 variants of encryption, more and more do not. And you have 1000 chessboards, one for every 6 bits of open information.
Is there even one contradiction and limitation, as safe to encrypt without a key (in your logical tunnel of time) and as safe to identify the correct cipher from the false, if each chessboard will have its own chess sketch for its 6 bits, a chess position, which can not be guessed by an outside observer.

These are the basics of vector-geometric encryption, the principles of which are shown in the diagram in this post dated December 7, 2019, in which the key mode can only be an option, not a mandatory rule for encryption and most importantly - for decryption.

A lot of my posts have been removed by the administration and there have been numerous explanations for this technology.
I don't see the point in repeating everything - they'll delete it again.

What's not clear is I'm ready to answer.

Sorry guys but it got me lost out there after reading through. So keyless encryption is basically what we are all doing on a daily basis when our devices encrypt stuff right? For example I'm sending Telegram messages and it's all getting encrypted, but I'm not using any key.

But passwordless authentication, I still don't get it. My voice or fingerprint is still my password right?