# Tag Info

0

There ARE a scenarios where adding the pbkdf2_hmac_sha1 step might be damaging to security. That includes an adversary having instrumented that step to log the input as part of another attack; or a successful side-channel attack on that step (e.g. using a less-privileged process on the same CPU). Multiplying the crypto algorithms increases the attack ...

-2

Considering we have seen unintentional (and intentional?) bugs in crypto recently, I think it would be prudent to chain together different algorithms and sources of entropy, if possible.

3

PBKDF2 is designed for low-entropy passwords. Assuming your key is generated by a CSPRNG, then running it through PBKDF2 is redundant. I don't, however, believe it could be weaker than the original key.

0

Take a look at tlslite, it offers an AES implementation. The API seems to support CBC mode only though. https://github.com/trevp/tlslite/blob/master/tlslite/utils/python_aes.py

0

AES-GCM encrypts the plaintext in the Counter Mode. GHASH operates on the resulting ciphertext, so no weakness in GHASH could compromise the confidentiality of plaintext. The GCM authentication is not as strong as that of SHA-256, in particular on short tags. If the tag is $\tau$-bit, an adversary can forge the tag after $2^{\tau/2}$ attempts given the ...

1

Because AES CBC does not provide authenticated encryption, this leads to many interesting attacks, which allow to modify or guess plaintext. Such attacks as BEAST or Lucky 13 are based on this vulnerability of AES CBC. Some details about this attacks you can find here.

1

If you don't mind that the ciphertext is longer than the plaintext, GCM is perfectly fine for storage encryption. Every time you write a block to disk, choose a fresh nonce and write the resulting ciphertext to disk. (You can ask for even stronger security properties, but then everything gets more expensive. Basically, build a tree structure for tags. Reads ...

1

If I know your password is k bits long and I know the m bits, then I have to brute force the rest of the k-m bits. That's the standard for any algorithm and independent of whether this is prefix, suffix etc. This means that I have $2^{k-m}$ tests to make. However, you can even do better, You can say that you have a decayed version of the key, or you have ...

5

Let me see if I have this right (and please correct me if I misunderstand; my conclusions depend on the details of this); you distribute images for your firmware device; these images are encrypted with a secret AES key (using AES in CBC mode); the device decrypts the image, and then runs that decrypted image. The sole check to make sure that the image ...

1

Problem statement You have a list of messages $(m_1, m_2, \dots, m_n)$, possibly with corresponding tags/descriptions $(t_1, t_2, \dots, t_n)$, that you want to store. You want to protect confidentiality of the messages (but not the tags/descriptions) against an adversary that compromises your storage. You have a single secret passphrase $pw$ at your ...

3

Yes, you are correct. The modulo operation (in general, not only over polynomials) is defined such that this is always true: $A \equiv A + B\ \ (\bmod\ B)$ Thus, if $A = X^3$ and $B = X^3+X^2+1$, that implies that $X^3$ is equivalent to the sum of $X^3$ and $X^3+x^2+1$, which is $X^2+1$, which is represented by $101$.

3

As poncho said in his comment, you added padding before decryption as well, which is not correct. AES encryption and decryption are both permutations, so if you decrypt data with a key, it will "look" random (at least, if AES is secure). Instead of adding padding, you need to remove the padding from the already decrypted text: from Crypto.Cipher import AES ...

1

It probably is doing some good, although there's probably a simple attack, depending on how long your fields are. You should use a MAC or authenticated encryption, depending on whether or not you want to keep $\:$ username + start timestamp + end timestamp $\:$ confidential from someone who gets access to a user's computer while that computer has a token ...

1

There are other ways to "win" space. $\:$ Also, see this answer regarding compression. You can remove (or just reduce the size of) the IV, since if the salts are different then the derived keys should be sufficiently independent. You can make the salt smaller than what it should be if bandwidth wasn't an issue. Additionally, the salt length can depend on ...

Top 50 recent answers are included