1

For example I want to have a hard copy of my backup 2FA codes so that if I lose/destroy/don't have my phone or laptop on me. I, of course, do not want them in plain text. I don't want to encrypt them using a secure cryptographic algorithm that I memorize a key for, as I might not have access to a device that can decrypt them.

Are there any downsides to using mathematical operations such as trig functions, exponents and roots, inversions, truncations, selections of the i-th to j-th digits, addition subtraction division and multiplication, remainders, OR/XOR/AND etc. in a sequence that I memorize?

Would this also be a safe way to store you personal credit card number in case of emergency?

Improve this question
3
  • Maybe you are looking for paper-based encryption? This article might get you started: hackaday.com/2021/05/12/simple-encryption-you-can-do-on-paper
    – Marcel
    Dec 8, 2021 at 11:33
  • Also, consider your threat model. I presume you won't be carrying this around with you - how likely is it that someone will be able to access it wherever you store it? Do you need to defend against housemate/"evil maid" attacks? How likely is it that anyone is going to try and brute force decryption off this piece of paper? A very simple algorithm like swapping each pair of digits might be sufficient.
    – Bobson
    Dec 8, 2021 at 15:10
  • @Bobson , Actually the exact case is for carrying it around, especially when I am on a trip. I want something that I can use with a dumb calculator if I don't trust computers or phones around me. For one time backup codes, the standard seems to usually be 8 digits, so in that case a very simple algorithim could work. But for credit card details, if someone was doing Luhn checks, they would have an easier time figuring out something as simple as swapping digits.
    – Seraphya
    Dec 8, 2021 at 22:45

2 Answers 2

Reset to default
1

Are there any downsides to using mathematical operations such as trig functions, exponents and roots, inversions, truncations, selections of the i-th to j-th digits, addition subtraction division and multiplication, remainders, OR/XOR/AND etc. in a sequence that I memorize?

Yes, there are downside. For example, if you forget the sequence.

As another downside, consider the sine function. There is the complication of input "units." Are you using degrees? Are you using radians?

Also, if you input an integer into your sine function, you are likely going to get a real number out. How many digits are you storing? Single precision? Double precision? Etc? You may have to introduce some rounding scheme as well... it seems like your scheme may quickly become unmanageable.

Would this also be a safe way to store you personal credit card number in case of emergency?

Probably not. The risks to availability are likely to outweigh any benefits of the obfuscation scheme.

Improve this answer
2
  • Forgetting the sequence is like forgetting the password/key. I have used this before, and it workde in terms of remembering. The rounding wasn't an issue because I was using selection of digits, which rounding is a subset of, between each step. In terms of risks to availability, the alternatice would be to have no paper backup, or a paper backup with no obfuscation. I was also thinking about using an algorithim as a pre-shared key for someone who can use a calculator but doesn't know how to use computers well.
    – Seraphya
    Dec 8, 2021 at 22:53
  • "..is like forgetting the password/key." Yes, similar, but worse. Since now you have to remember both the "password/key" as well as the "sequence." And the "sequence" is some random set of operations that you will never remember in two years... unless you write it down, but then you might as well just write down the password... So: Just write down the password in a nice covered notebook, and put the notebook in a locked drawer. You will be fine.
    – hft
    Dec 8, 2021 at 23:09
0

It seems as though in your encryption scheme, the algorithm is the secret, instead of the key being secret. This is in direct contrast to Kerckhoffs's principle, which is a fundamental law of modern cryptography, and states that a cryptosystem should be secure, even if everything about the system, except the key, is public knowledge.

Improve this answer
3
  • Well, the OP might switch the algorithm for the key, but this then implies that the key is public and the algorithm must have a high entropy to be meaningfully secure. I assume this will fail in practice, though.
    – Marcel
    Dec 8, 2021 at 11:34
  • We could just define the key as the order of the operations and the selection of truncation
    – Seraphya
    Dec 8, 2021 at 22:39
  • @Seraphya Yes, you could. But, if the order of the operations is the secret, then this is akin to the algorithm is the secret. By contrast, with most widely used cryptographic primitives (e.g. AES), the algorithm (i.e. the order of operations) is widely known, but the key (which is an input to the algorithm) is secret (a la Kerckhoff's Principle).
    – mti2935
    Dec 9, 2021 at 15:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .