New answers tagged

1

The commit that added this double HMAC only says it improves "valid MAC detection", but it simultaneously adds the constant-time comparison, so likely the reason is indeed defense against timing attacks: Improve valid MAC detection Implement constant time string comparison as well as double HMAC verification for encryption MACs. Double HMAC is a ...


1

You could use the turtle block cipher with CMAC, maybe. The turtle block cipher claims a cipher design that is based on "an NP-Complete Subproblem". Block ciphers can be used to produce authentication tags via algorithms such as CMAC. I'm not sure if this combination necessarily qualifies the authentication as being based on an NP-Complete subproblem ...


1

As fgrieu noted in his answer using sign-then-encrypt is probably the best way of handling encrypted & signed messages. However when the OpenPGP format in RFC 4880 is studied it seems that it uses both PKCS#1 v1.5 padding and CBC mode encryption. Both schemes are vulnerable to padding oracle attacks. So it is important to make sure the software is not ...


1

Yes, PGP's sketch as in the question is sound by today's textbooks on cryptography, and reasonable from a computer security standpoint. Applying digital signature then encryption (critically: including on the signature) does provide data integrity and confidentiality for the message. PGP's way of doing things has the characteristic that one able to decipher ...


0

and encryption does not provide data integrity. You might want to read up on authenticated encryption. However, even if that isn't used it's still not a big problem for if an attacker corrupts the encrypted text the cleartext produced the by corrupted ciphertext cannot be authenticated, i.e. the signature will be corrupted or the hashes won't be equal.


3

For example, someone suggested improving UNIX authentication by defining 3 different passwords for a user that are stored in the shadow file. All three passwords are stored with the same salt value. When a user wants to authenticate to some system, he must provide in the i attempt to login, the i mod 3 password. For example, in the first attempt he will ...


0

[I would rather put this as a comment but my 'reputation' is not high enough to allow comments]. the information must be authentic and fresh Not sure what is meant by 'fresh' in this context. Anyway, given that both the 'device' and the 'source' are capable of storing a secret key, first thing that springs to mind is a protocol based on a symmetric ...


1

I don't know about MACs (keyed Hashes e.g. HMAC might fall under the definition of symmetric but that's not clear to me) but there are restrictions on asymmetric crypto as well, RSA and Diffie-Hellman are restricted to 512 bits and ECDH is restricted to 112 bits (which effectively is a security level of 56 bits, the same as the limit on symmetric crypto): ...



Top 50 recent answers are included