#klutshnik — Public Fediverse posts

#Klutshnik v0.4.1 is out.

Klutshnik is a Key Mgmnt Service 4 data-at-rest. Keys r stored in a threshold setup& r never reconstructed only used in operations that hide their values. These keys r cheaply&securely updatable without reencrypting the encrypted data, providing forward-secrecy&post-compromise security. Klutshnik servers can use TLS, USB or BLE.

https://github.com/stef/klutshnik/releases/tag/v0.4.1
https://github.com/stef/klutshnik-zephyr/releases/tag/v0.4.1

check the updated site: https://klutshnik.info

#crypto previously funded by #ngi0 #nlnet

pretty cool, i just created a #klutshnik 3-out-of-5 setup with an rp2350, teensy40, teensy41, xiao_esp32s3 and a generic tcp-based server, and my test script runs through successfully. getting there i found a bunch of gotchas that i polished away. so, yay \o/

new #klutshnik website dropped a few days ago, but it described a few - back then - vaporware things, which are all real now. if you ever wondered wtf this #klutshnik thing is, but were to busy to watch a video, or read an academic paper, here is a website, you'll be to busy to read: https://klutshnik.info/

submitted a #talk about practical threshold OPRF deployments (#klutshnik & #sphinx, and maybe a little opaque) to #39c3 - let's see if it gets admitted.

next milestone on the #klutshnik ride is to setup a system with each of those supported embedded controllers, 1-2 rpi images (see https://github.com/stef/klutshnik/tree/master/images/klutshnik-sbox-rpi) and 1-2 of the native zig servers somewhere online, and run the test suite against this heterogeneous setup.

yippie-kee-yay! just added teensy4.0 support to #klutshnik #zephyr - the 4.0 is smaller and cheaper than the 4.1 but comes with the same powerful cortex-m7 mcu. with this change klutshnik now runs on 4 different embedded systems: xiao_esp32s3, rpi pico2 (w) and the teensy4.1 and teensy4.0. \o/

also rewrote the provisioning interface which is now a proper shell on usb cdc-acm.

check it out on #radicle
rad:z2EBBi4vui98QV8Mk8DT3c25yZbJ4

or on the ms-trap: https://github.com/stef/klutshnik-zephyr

wooohooo, just released v0.3.0 of #klutshnik. the client now supports connections to servers over USB serial, and there is now support for aarch64 #raspberrypi images. check it out: https://github.com/stef/klutshnik/releases/tag/v0.3.0

the rpi image builder: https://github.com/stef/klutshnik/tree/master/images/klutshnik-sbox-rpi

the rpi images come with a very reduced attack surface, providing excellent physical isolation, and also further hardening using seccomp bpf rules for klutshnik.

woohoo, got #klutshnik running on a teensy over usb!

wooohooo, #klutshnik end-to-end tests successfully run with a peer on a xiao esp32s3 over BLE using zephyr!

\o/ i just did a 5-way DKG with one of the "servers" being a xiao esp32s3 over bluetooth LE! \m/

i'm porting #klutshnik to #zephyr it's not very quick, takes a few seconds, but this is creating of a key. decrypting should be much quicker. also i expect this to be faster when done over usb. this is an early PoC, loads of features missing before it can be deployed in production.

got a shipment of some dev boards to port #klutshnik to microcontrollers over usb/ble, these things are small, powerful and cheap!

Waveshare RP2350-Plus https://www.waveshare.com/rp2350-plus.htm
Seeed XIAO nRF52840 https://wiki.seeedstudio.com/XIAO_BLE/
Seeed XIAO ESP32S3 https://wiki.seeedstudio.com/xiao_esp32s3_getting_started/
Raspberry PI Pico 2 W https://datasheets.raspberrypi.com/picow/pico-2-w-datasheet.pdf
Teensy USB Board, Version 4.1, Without Ethernet Chip https://www.pjrc.com/store/teensy41.html

one more incoming later: a very cheap STM32WB55CGU6 from https://www.aliexpress.com/item/1005007119406784.html

quite exciting :)

rejoice, just released v0.2.0 of #klutshnik

https://github.com/stef/klutshnik/releases/tag/v0.2.0

i also packaged a static x86_64 debug build of the server for people who are not blessed by #zig

this release comes with man pages and a whitepaper/spec.

happy to report that i'm making good progress on #klutshnik, client/server, some tests and man pages are getting there. next up writing spec/whitepaper.

the whole thing is much simpler than the original PoC with the revised authorization approach.

still experimental, but if you like to live on the edge, have a look: https://github.com/stef/klutshnik

this sounds like a cool paper and result: https://eprint.iacr.org/2024/989

#klutshnik #ee2e #storage #dataatrest

Good news everyone! Both of my talks (talk1: oprfs, talk2: klutshnik) from #camp++ a few weeks ago have been published at https://camp.hsbp.org/2023/pp7e7/recordings.html #crypto #presentation #oprf #klutshnik

\o/ It seems my proposal has been accepted for funding by NLNet & NGI0 Entrust, there's gonna be a lot more OPRF based free software be available soon. #klutshnik #opaque #sphinx #oprf #nlnet #ngi0

hmmm, just found two papers that do similar things as #klutshnik https://eprint.iacr.org/2022/1017 https://eprint.iacr.org/2020/1443

the latter one uses pairings, not sure who wants to use pairings... but the first one looks interesting.

i made a sketch how #klutshnik decryption works right now. i also made a translation of the abstract of the original UOKMS paper by Jareczky et al: https://mastodon.social/@stf/110135311256650094

it's funny how the challenges of the 2nd talk in the "breaking and securing systems" session yesterday "Why E2EE Cloud Storage is hard - Challenges, Attacks and Best Practices" is mostly solved by project klutshnik: https://www.ctrlc.hu/~stef/blog/posts/Announcing_Project_Klutshnik.html #realworldcrypto #klutshnik