meta user
network profile
| bio | website | en.wikipedia.org/wiki/… |
|---|---|---|
| location | United Kingdom | |
| age | 25 | |
| visits | member for | 1 year, 6 months |
| seen | May 17 at 9:04 | |
| stats | profile views | 28 |
Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado.
Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly
All answers and comments are encrypted with ROT256-ECB.
Opinions are my own. Advice provided with no warranty.
|
Jul 16 |
accepted | Padding methods for block ciphers - PKCS7 vs ANSI X.923 |
|
Jul 16 |
comment |
Padding methods for block ciphers - PKCS7 vs ANSI X.923 @Thomas After thinking about it, I realised that PKCS7 is slightly more resistant to bit-flipping damage. In X.923, a flipped bit (for whatever reason) in the final byte makes it difficult to "guess" the number of padding bytes. In PKCS7, you have a higher confidence in recovery since a single flipped bit in the padding doesn't destroy the length value. This could be a good thing (recovery of messages), or a bad thing (forensic analysis) in terms of the security of the mechanism. To be honest, I think the impact is so negligible it's not really worth the concern. |
|
Jul 15 |
comment |
Padding methods for block ciphers - PKCS7 vs ANSI X.923 @Thomas You can't actually verify either 100% accurately. You can check that there are at least enough padding bytes, but not that there aren't extra padding bytes. With ANSI X.923, if the data ends with zeros, you can't verify that there aren't extra erroneous padding bytes. With PKCS7, if the data ends with the number of padding bytes, you can't verify that there aren't extra erroneous padding bytes. I guess there isn't really any benefit for either method. |
|
Jul 13 |
comment |
Is the encryption of a hash a good MAC? You're also relying on the strength of the cipher for both encryption and authentication, so given a non-key-disclosing attack on the block cipher you could also inject packets. With HMAC you'd only be able to read the stream unless you could recover the key. |
|
Jul 11 |
comment |
Combatting traffic shape analysis with spurious packets That pretty much sums up what I thought. Glad to see I came up with the same idea as the IPSec guys independantly! :D |
|
Jul 11 |
comment |
Order of cascaded ciphers Interesting. Assuming DPA is a risk, are there any analyses of common implementations of popular block ciphers in various modes? Also, is there any published analysis of DPA attacks on CPU-specific cryptographic extensions, such as Intel's AES instructions? I've only scan-read the paper you linked (I'll take a proper look later) so I my apologies if these questions are answered in it. |
|
Jul 11 |
comment |
Hash function from narrower block cipher operated in CBC-encryption mode? Normally my advice is "never roll your own", but... Holy crap! |
|
Jul 11 |
asked | Combatting traffic shape analysis with spurious packets |
|
Jul 11 |
asked | Padding methods for block ciphers - PKCS7 vs ANSI X.923 |
|
Jul 10 |
awarded | Organizer |
|
Jul 10 |
revised |
Untraceable communication protocol Deniable encryption tag. |
|
Jul 10 |
revised |
Untraceable communication protocol link |
|
Jul 10 |
awarded | Promoter |
|
Jul 10 |
accepted | Hash decrypts key, key decrypts cipher… why? |
|
Jul 10 |
answered | Untraceable communication protocol |
|
Jul 10 |
suggested | suggested edit on Untraceable communication protocol |
|
Jul 10 |
comment |
KDF with low-entropy salts @CodeInChaos In terms of theory, I'd agree with you. In practice, however, forcing the attacker to wait until he has breached the database is useful. It gives you time to respond to an incident. |
|
Jul 10 |
comment |
Entropy of system data - use all and hash, or trim least significant bits? @CodeInChaos That's the part I don't really understand. The Wikipedia article is a little vague. |
|
Jul 10 |
comment |
KDF with low-entropy salts @CodeInChaos If the salt is predictable (e.g. user ID from database auto-increment) an attacker could trivially generate small rainbow tables for each user. |
|
Jul 10 |
answered | KDF with low-entropy salts |
