62 reputation
6
bio website rihan.fr
location France
age 23
visits member for 10 months
seen Jun 9 at 0:01

Oct
20
awarded  Popular Question
Mar
19
comment Are IVs and salts the same and usable for each other uses?
It's exactly what I've concluded. In theory they're different, but I've understood that you can use an IV generator to generate a salt, for instance.
Mar
3
accepted OpenSSL PBKDF2 documentation
Mar
3
comment OpenSSL PBKDF2 documentation
Thank you for that, really helpful
Dec
15
accepted Are IVs and salts the same and usable for each other uses?
Dec
15
comment Are IVs and salts the same and usable for each other uses?
I understand. The thing is that I'm working on a KDE's lib, an OpenSSL wrapper for Qt. We have an InitializationVector class, I was asking if using it was an issue. The answer is "no" ;) . So, as my question IS about a security issue when using a secured/random/unpredictable IV as my PBKDF salt, if I can without issue, I think you should edit your answer. The advices still apply, thx.
Dec
15
comment OpenSSL PBKDF2 documentation
I'm working on cross-platform apps, so I prefer to use OpenSSL instead, that's why I'm asking for a reference. Actually I didn't know that the only PBKDF2 included in OpenSSL is PKCS5_PBKDF2_HMAC_SHA1, and it seems not to appear on the website :S
Dec
15
comment Are IVs and salts the same and usable for each other uses?
I'm indeed asking if I can feed my IV into PBKDF :) . As you suggest me to use an IV of 0 (so empty IV?) if I'm already using a salt, it's like using my IV as a salt and not using the IV to feed my symmetric encryption algorithm (i.e.: AES). Did I understand correctly?
Dec
15
comment Are IVs and salts the same and usable for each other uses?
I see, but concerning files encryption, I don't have any database or any user knowledge, using the IV (or part of it) would be like having a per-file salt. I'm only interested about the strength part, if doing so adds flaws or security breach or else ?
Dec
15
comment Are IVs and salts the same and usable for each other uses?
Ok, but I don't get why an IV wouldn't be random/unpredictible enough for a salt (Assuming that for a symmetric encryption, the salt have to be included in the cipher text, as is the IV, isn't it ?)
Dec
15
asked OpenSSL PBKDF2 documentation
Dec
15
comment Implement deniable encryption with AES/RSA
If I XOR the plaintext BEFORE ciphering it, it needs 2 keys to decipher (public key/password + OTP), isn't it? It seems to be an extra layer for @fgrieu's algorithm (or any other), not another solution, am I right ?
Dec
15
comment Are IVs and salts the same and usable for each other uses?
Hey! Thanks for the "correction". "No" means it's not secure to generate and use the same IV to derive a password and to give it to the encryption algorithm?
Dec
14
asked Are IVs and salts the same and usable for each other uses?
Dec
14
awarded  Scholar
Dec
14
accepted Implement deniable encryption with AES/RSA
Dec
14
awarded  Commentator
Dec
14
comment Implement deniable encryption with AES/RSA
It's clearer, thanks. BTW, is it limited to CTR mode? I will have a LOOOOT of fun implementing your maths with C/C++ (Actually I'm a system dev, not a cryptologist, but there is a beginning in everything ;) . Thanks for that answer anyway.
Dec
14
comment Implement deniable encryption with AES/RSA
Sorry, I understand do...while, what I didn't understand is "less than twice" which means "once", why doing a loop?
Dec
14
comment Implement deniable encryption with AES/RSA
Great answer thanks. Before accepting it, I need to test it, and I have to admit that I have some difficults to understand your maths (I haven't made any studies in cryptography). From top to bottom, the first thing I don't understand is "Repeat (less than twice)" which means "once" isn't it? "Until" which means "many times until condition" but your computation seems to have the same result over and over (like 1+1=2). Sorry if I misunderstand because of my lack of maths/crypto knowledge.