Reputation
Top tag
Next privilege 250 Rep.
View close votes
Badges
6
Newest
 Student
Impact
~2k people reached

  • 0 posts edited
  • 0 helpful flags
  • 7 votes cast
Apr
4
comment Why is it a bad idea to use a UTF-8 derived symmetric key?
Just to clarify, we're not using a key that is a hexadecimal string. The hexadecimal conversion is only because the value is stored in a table that doesn't have a BINARY data type for the column it needs to be in. The idea is to encode the hexadecimal (using the normal hexadecimal conversion, not UTF-8) into bytes to be fed into HMAC. I agree with you.
Mar
31
comment Why is it a bad idea to use a UTF-8 derived symmetric key?
I appreciate the reply and the explanation. I know I left my context agnostic to the algorithm we're using, but it's HMAC-SHA512 and your point is even more valid in this case because of the way HMAC is specified to handle keys longer than the internal block size of the hash. If we used a 512 bit key it would end up as a 1024 bit ASCII block which would get hashed internally and then used as the key. That would make it difficult for other software to integrate since it's not a standard practice.
Mar
31
comment Why is it a bad idea to use a UTF-8 derived symmetric key?
@StephenTouset I want to be clear - I understand the difference but I am having a hard time explaining to a coworker why it's not a good idea in more technical or mathematical terms. Their argument is that since a single byte is 0 - 255 and a single character is 0 - F that they actually double the key strength by encoding it since each character would get represented by two bytes; obviously that's wrong. I argued that the entropy of the source remains the same and that because we would need to then truncate the string that the overall entropy of the key is reduced by half or more.
Mar
11
comment Is it possible to brute force a single smaller variable in $\operatorname{HMAC-SHA512}(k, a\ ||\ b\ ||\ c\ ||\ d)$?
@RickyDemer Indeed! I noticed that this would pose a problem for a different thing I was working on. Someone recommended using a separator value like a comma.
Mar
10
comment Is it possible to brute force a single smaller variable in $\operatorname{HMAC-SHA512}(k, a\ ||\ b\ ||\ c\ ||\ d)$?
I assumed this was the case. I figured it would not make any difference if there were small independent variables in the message that were changing in minor ways versus the message changing completely.
Mar
6
comment Zero Knowledge Password Proof
It is expired now :)
Nov
21
comment Derived Shared Key vs Distinct Keys?
What kind of replay attacks specifically? I don't see how using the shared key for authentication and encryption would open up a replay vulnerability.
Nov
18
comment Encryption technique performance evaluation
I don't believe you can say that all amateur encryption schemes are insecure because frankly, things like AES and Serpent are amateur in nature. You cam also make something so complicated and convoluted that it's very difficult to analyze without knowledge of the actual cipher. So, if this individual hid their cipher implementation and simply posted the ciphertext online, it's pretty likely that even the NSA would not be able to break it without a fair bit of hints. There have been amateur ciphers in the past that have not been broken by the FBI nor the NSA this way.