Possible restic repository vulnerability - any plans to address it in rustic?

[kapitainsky]

Some potential restic repository vulnerability has been discovered recently. Restic has already some plans to at least mitigate it:

restic/restic#5291

Is it something rustic is going to incorporate too?

[aawsome]

Hi @kapitainsky, thanks for pointing to this restic repository topic!

I must say, I also already read about this (very quickly) yesterday.

So, the basic points are:

• rustic is affected in the same way as restic is (as this is about how the chunkeing algorithm works - which is defined in the restic repository format; and rustic's philosophy is to be 100% repo format compatible)
• Any mitigations will need to change/enhance the repository format, so yes, rustic will implement everything whats needed to keep repository format compatibility.
• I also think that this is a strong argument that we add the possibility to use fixed-size chunking in rustic. This chunking algorithm will completely make such attacks impossible.

Besides this, I added some personal notes about the vulnerabilities in the linked restic issue - where I think we should discuss it and possible mitigations.

[DianaNites]

Was the restic 0.18.0 mitigation applied to rustic as well?

[aawsome]

Hi @DianaNites! Thanks for asking about the status of this possible vulnerability!

First I must say that a mitigation that has been always implemented in restic and rustic is to pack the chunks into packfiles - and IMO the larger the packfiles, the harder it is to gain chunk size information. However, I don't know how chunking attacks would work when adversaries get to know the size of packfiles. So for me it is hard to say if the "mitigtion" implemented in 0.18.0 (which does not change pack sizes, but only randomizes the determination which chunk is saved in which pack) really is a mitigation.

To shortly answer your question: Yes a similar randomization is and has been implemented for long in rustic.
(but there are differences in how restic and rustic do the packing, so as a result either of both could have better "mitigation" - depending on yet unknown attacks)

I must however say that I don't think that any kind of randomization really is a good mitigation - normally this can be statistically calculated out when using just a couple of tests. But I also don't feel competent enough to really judge this.

There is a "real" mitigation planned for restic in restic/restic#5410 and I already have a POC implementation based on rustic-rs/rustic_core#409 which adds the same padding. But I think this approach needs a bit of reasoning, see my comments on the restic PR.