Tag Info

New answers tagged

3

Rejecting replays is the duty of a higher level protocol. Simple authenticated encryption will accept any message with a valid MAC, even if you receive it several times. Decryption is a stateless process, but you need state to keep track of messages you already received. For example you could associate an increasing counter for each message you send. The ...


3

AES CBC usually requires padding, such as PKCS#7 padding. This padding is 1 to 16 bytes, 16 being the block size of AES. The HMAC will add 256 / 8 = 32 bytes to the total. Usually you will need to store the randomized IV as well with ciphertext, to allow for reuse of the key, adding another 16 bytes (the block size again). So the total overhead will be about ...


1

In both options, if the adversary has a way to check either AES key, then a brute password guessing attack can be attempted, and BCrypt is the main line of defense against that. For constant effort, option 2 force to halve the cost parameter in BCrypt, and is thus twice more vulnerable to password guessing than option 1 is. BCrypt's output is described as ...


2

BCrypt is considered more secure The theoretical security of bcrypt has received less scrutiny than that of PBKDF2, SHA2 and HMAC. PBKDF2 is thus widely standardised (e.g. in NIST SP800-132 and PKCS #5) while bcrypt is not. In practice the security (resistance to brute force attack or dictionary attack) of bcrypt and PBKDF2-HMAC-SHA512 can be ...


1

Your question is kind of broad, but I think it's still more or less answerable. Let me just address your sub-questions one by one: I am looking for the implementation of IPsec security algorithms for both authentication and Encryption. Is there any open source implementation available for the same? Yes, plenty. If you specified which platform and/or ...


0

Yes you can use bcrypt in this scenario. The output of bcrypt is 192-bits encoded using base-64, giving you 248-bits. Well short of your 512-bit requirement. What I would recommend you do, if you choose bcrypt, is akin to what was recommended here. Use HMAC instead of SHA-512 of the output of bcrypt. For the reasons why, see this question and answer. It is ...


1

In one sense, no, encoding should not have an impact on security of HMAC. On the other hand, it could have an application dependent impact. Consider the following. '26' and 26 have the same HMAC. Now, assume your code receives a message, M, and an HMAC, MAC, and then does something like this if HMAC(M, private_key) == MAC: if isinstance(M, basestring): ...


0

The reason we add salts to the key derivation process it to make the key hash image unique for a given password. Actually a salt is added to remove weakness when an attacker has a list of "most common password". Adding a salt make the attacker job harder, he has to rebuild the attack per every salt he finds, i.e.: per every ciphertext he gets. It is ...


5

First of all there does exist information theoretically secure message authentication codes suitable for use with a one time pad. An HMAC is not one of those information theoretically secure. As far as I recall the first article presenting such a construction is the 1981 article by Wegman and Carter: New hash functions and their use in authentication and ...



Top 50 recent answers are included