Reputation
967
Top tag
Next privilege 1,000 Rep.
Edit questions and answers
Badges
4 26
Impact
~27k people reached

Jul
16
accepted Order of cascaded ciphers
Jul
16
accepted Padding methods for block ciphers - PKCS7 vs ANSI X.923
Jul
16
comment Padding methods for block ciphers - PKCS7 vs ANSI X.923
@Thomas After thinking about it, I realised that PKCS7 is slightly more resistant to bit-flipping damage. In X.923, a flipped bit (for whatever reason) in the final byte makes it difficult to "guess" the number of padding bytes. In PKCS7, you have a higher confidence in recovery since a single flipped bit in the padding doesn't destroy the length value. This could be a good thing (recovery of messages), or a bad thing (forensic analysis) in terms of the security of the mechanism. To be honest, I think the impact is so negligible it's not really worth the concern.
Jul
15
comment Padding methods for block ciphers - PKCS7 vs ANSI X.923
@Thomas You can't actually verify either 100% accurately. You can check that there are at least enough padding bytes, but not that there aren't extra padding bytes. With ANSI X.923, if the data ends with zeros, you can't verify that there aren't extra erroneous padding bytes. With PKCS7, if the data ends with the number of padding bytes, you can't verify that there aren't extra erroneous padding bytes. I guess there isn't really any benefit for either method.
Jul
13
comment Is the encryption of a hash a good MAC?
You're also relying on the strength of the cipher for both encryption and authentication, so given a non-key-disclosing attack on the block cipher you could also inject packets. With HMAC you'd only be able to read the stream unless you could recover the key.
Jul
11
comment Combatting traffic shape analysis with spurious packets
That pretty much sums up what I thought. Glad to see I came up with the same idea as the IPSec guys independantly! :D
Jul
11
comment Order of cascaded ciphers
Interesting. Assuming DPA is a risk, are there any analyses of common implementations of popular block ciphers in various modes? Also, is there any published analysis of DPA attacks on CPU-specific cryptographic extensions, such as Intel's AES instructions? I've only scan-read the paper you linked (I'll take a proper look later) so I my apologies if these questions are answered in it.
Jul
11
comment Hash function from narrower block cipher operated in CBC-encryption mode?
Normally my advice is "never roll your own", but... Holy crap!
Jul
11
asked Combatting traffic shape analysis with spurious packets
Jul
11
asked Padding methods for block ciphers - PKCS7 vs ANSI X.923
Jul
10
awarded  Organizer
Jul
10
revised Untraceable communication protocol
Deniable encryption tag.
Jul
10
revised Untraceable communication protocol
link
Jul
10
awarded  Promoter
Jul
10
accepted Hash decrypts key, key decrypts cipher… why?
Jul
10
answered Untraceable communication protocol
Jul
10
suggested approved edit on Untraceable communication protocol
Jul
10
comment KDF with low-entropy salts
@CodeInChaos In terms of theory, I'd agree with you. In practice, however, forcing the attacker to wait until he has breached the database is useful. It gives you time to respond to an incident.
Jul
10
comment Entropy of system data - use all and hash, or trim least significant bits?
@CodeInChaos That's the part I don't really understand. The Wikipedia article is a little vague.
Jul
10
comment KDF with low-entropy salts
@CodeInChaos If the salt is predictable (e.g. user ID from database auto-increment) an attacker could trivially generate small rainbow tables for each user.