# Tag Info

5

Let me see if I have this right (and please correct me if I misunderstand; my conclusions depend on the details of this); you distribute images for your firmware device; these images are encrypted with a secret AES key (using AES in CBC mode); the device decrypts the image, and then runs that decrypted image. The sole check to make sure that the image ...

3

Yes, you are correct. The modulo operation (in general, not only over polynomials) is defined such that this is always true: $A \equiv A + B\ \ (\bmod\ B)$ Thus, if $A = X^3$ and $B = X^3+X^2+1$, that implies that $X^3$ is equivalent to the sum of $X^3$ and $X^3+x^2+1$, which is $X^2+1$, which is represented by $101$.

3

As poncho said in his comment, you added padding before decryption as well, which is not correct. AES encryption and decryption are both permutations, so if you decrypt data with a key, it will "look" random (at least, if AES is secure). Instead of adding padding, you need to remove the padding from the already decrypted text: from Crypto.Cipher import AES ...

3

011b is a hexadecimal representation of the polynomial $m(X) = X^8 + X^4 + X^3 + X + 1$ (so you should never regard it as an integer). This polynomial has coefficients in the finite field $\mathrm{GF}(2)$, which is just the math-y way to say that its coefficients are in $\{0,1\}$: hex | 0 1 1 b bin | 0000 0001 0001 1011 x^n | 8 7654 3210 ...

3

PBKDF2 is designed for low-entropy passwords. Assuming your key is generated by a CSPRNG, then running it through PBKDF2 is redundant. I don't, however, believe it could be weaker than the original key.

1

Because AES CBC does not provide authenticated encryption, this leads to many interesting attacks, which allow to modify or guess plaintext. Such attacks as BEAST or Lucky 13 are based on this vulnerability of AES CBC. Some details about this attacks you can find here.

1

If you don't mind that the ciphertext is longer than the plaintext, GCM is perfectly fine for storage encryption. Every time you write a block to disk, choose a fresh nonce and write the resulting ciphertext to disk. (You can ask for even stronger security properties, but then everything gets more expensive. Basically, build a tree structure for tags. Reads ...

1

If I know your password is k bits long and I know the m bits, then I have to brute force the rest of the k-m bits. That's the standard for any algorithm and independent of whether this is prefix, suffix etc. This means that I have $2^{k-m}$ tests to make. However, you can even do better, You can say that you have a decayed version of the key, or you have ...

1

Problem statement You have a list of messages $(m_1, m_2, \dots, m_n)$, possibly with corresponding tags/descriptions $(t_1, t_2, \dots, t_n)$, that you want to store. You want to protect confidentiality of the messages (but not the tags/descriptions) against an adversary that compromises your storage. You have a single secret passphrase $pw$ at your ...

Only top voted, non community-wiki answers of a minimum length are eligible