Honey encryption - PSJoshi/Notes GitHub Wiki

Honey cryptokens

Traps are set on the Internet to attract hackers in order to understand their behavior and tactics. Many of these traps are known as honeypots, which are deliberately unpatched computers or infrastructure exposed to the Internet that lure attackers to break in while their actions are recorded.

However, these decoys are not suusally built in security processes and is called honey encryption.Honey Encryption was presented at the Eurocrypt conference in Copenhagen in the spring of 2014.

It gives encrypted data an additional layer of protection by serving up fake data in response to every incorrect guess of the password or encryption key. If the attacker does eventually guess correctly, the real data should be lost amongst the crowd of spoof data.

This approach could be valuable given how frequently large encrypted stashes of sensitive data fall into the hands of criminals. After capturing encrypted data, criminals often use software to repeatedly guess the password or cryptographic key used to protect it. The design of conventional cryptographic systems makes it easy to know when such a guess is correct or not: the wrong key produces a garbled mess, not a recognizable piece of raw data. With honey encryption, it looks like real contextual data.

When the wrong key is used to decrypt something protected by their system, the Honey Encryption software generates a piece of fake data resembling the true data. If an attacker used software to make 10,000 attempts to decrypt a credit card number, for example, they would get back 10,000 different fake credit card numbers with each decryption is going to look plausible.

The initial motivation behind the project was the security of password vaults. Services such as LastPass, which was breached in 2011, enable users to secure a number of passwords with a master; synchronization of these services is often done in the cloud. The problem is that many people use an insecure master password to protect their collection, and that makes password managers a very attractive target for criminals.

If one of these password providers is breached, an attacker can crack the master password associated with any vault and extract all of their passwords. But if those vaults were protected with Honey Encryption, each incorrect attempt to decrypt a vault would yield a fake one instead.

References

Git repos