Tag Info

0

What you did seems fine for verifying the key is correct. However, unless AES256_encrypt uses an authenticated mode of encryption (in which case the whole exercise would be unnecessary), there is nothing that prevents an attacker from modifying the message. And depending on the mode of encryption used, that can even compromise the privacy of the message. ...

2

This answers a comment to Stephen Touset's fine answer. With SHA-256, or any collision-resistant hash, no known attack (including length extension) allows producing a file different from the original file and that has the same hash as the original, even if an adversary could choose the original. Even with the practically-broken MD5, or the broken SHA-1, no ...

5

A length extension attack doesn't let you find a collision. It lets you predict the hash for an input with an unknown component in the prefix. If you have $h = H(x)$ for unknown (or partially unknown) $x$, you can generate $h_y = H(x \vert\vert y)$ for arbitrary $y$ (this is not strictly correct; I've ignored padding, but for the purposes of this discussion ...

1

No, the nonce is not fit to be a HMAC key, because anybody can view the nonce in transit. If - on the other hand - the TLS connection does deliver enough security then you would not need the HMAC. It's fine to use the nonce as one time code, but you don't need the HMAC for that. If an attacker can obtain nonce's send to clients than the attacker can always ...

-1

For the symmetric key crypto, generally speaking, you must provide the secret key to the other end for decryption. The same random keys can be generated at the receiver end, if you use same function with same parameters. I am also a bit confused, since you have also used "signature" word in your program. Are you talking about the encryption or the ...

0

Yes, this is fine for verifying that the file contents match the original. You are basically using a hash list. As long as SHA-256 is collision resistant, there is no way to find a hash that would be ambiguous and refer to two or more known file sets. In addition to the potential issues mentioned in the comments, storing just the aggregate hash value leaves ...

Top 50 recent answers are included