2012-rogers-secure
findings extracted from this paper
-
The paper explicitly flags that BTP's fixed-size b-byte connection tag creates an active-probing oracle: a censor that sends b−1 bytes and observes no close, then sends one more byte and observes a close, can confirm the endpoint is running BTP. Preventing such active-probing attacks is identified as future work.
-
BTP's forward secrecy guarantee depends on reliably destroying old keys, but the paper notes that secure deletion from persistent storage—especially solid-state storage—is difficult with current operating systems and hardware. The recommended mitigation is passphrase-derived encryption of stored secrets, though this shifts the problem to passphrase protection.
-
BTP achieves forward secrecy over unidirectional transports—where ephemeral in-band key exchange is impossible—by using a one-way key derivation function (NIST SP 800-108) to produce sequential temporary secrets from an initial shared secret. Once both devices destroy a given temporary secret, no keys derived from it can be reconstructed even if devices are later compromised.
-
BTP's wire protocol contains no handshakes, timeouts, or plaintext headers. Connections open with a pseudo-random b-byte tag that the recipient can compute in advance from its key state, making BTP frames indistinguishable from random data to a passive observer who does not know the shared secret.
-
BTP's secret retention period for transport t is Rt + 2C + Lt, where Rt is the rotation period, C is the maximum clock-skew tolerance, and Lt is the maximum transport latency. With Rt = 2C + Lt only two temporary secrets need simultaneous storage. Concrete durations: TCP with automatic clocks (C=10s, Lt=60s) requires 2 minutes 40 seconds; TCP with manual clocks (C=1800s) requires 4 hours 2 minutes; mail with manual clocks (Lt=2 weeks) requires 4 weeks 4 hours.