288 reputation
29
bio website drowtales.com
location Latvia
age 29
visits member for 2 years, 3 months
seen May 29 at 23:05

Just your average everyday programmer.


May
23
awarded  Commentator
May
22
awarded  Citizen Patrol
May
22
comment Which tamper-protection algorithm provides the shortest output?
@OhJeez - True, but this presents me with a memory leak. How do I know when I can remove it from the session? Also I need to differentiate between different open browser tabs. This gets pretty hairy pretty quickly. Encryption is actually simpler (if I have the proper primitives, of course).
May
21
comment Which tamper-protection algorithm provides the shortest output?
Hmm... true. Well, how about this - I don't want to save the document on the server side, but I can generate a new key/salt/whatever when the user logs on and save that in the session. Then another key/salt/whatever is generated for each opening of the form. BOTH are used to encrypt or hash the values. That way you can't replay or CSRF anything, even within the same session.
May
21
comment Which tamper-protection algorithm provides the shortest output?
The attacks you mention however can all be mitigated by using frequently changing keys and tokens (on opening of a document). Thank you for pointing them all out, I will definitely keep them in mind when designing my tamper-protection!
May
21
comment Which tamper-protection algorithm provides the shortest output?
Storing a copy on the server side however becomes pretty tedious pretty quickly, especially since a person can open multiple browser tabs and edit several similar documents at once. It also leaks memory, because it's hard to tell when a browser tab has closed and when I can dispose of the server-side copy. Therefore a more elegant solution is to always pass all data to the client, but protect the sensitive parts.
May
21
comment Which tamper-protection algorithm provides the shortest output?
This has less to do with visibility and more with tampering and the stateless nature of The Web. The current mantra is to make your webpages as stateless as possible. So, basically, when I open a document for editing in my browser, all the data should be on client side, and not server. Then, when I save the document, all the data should be posted back. The problems arise when permissions only allow a person to edit some parts of the document, but not others. Without a copy of the original document, I cannot tell on server side which fields were modified.
May
21
comment Which tamper-protection algorithm provides the shortest output?
@CodesInChaos - Truncating a HMAC does not severely affect it's security?
May
21
comment Which tamper-protection algorithm provides the shortest output?
I'm using .NET (C#). Usually it's possible to find libraries for most things, but if not - .NET provides a good set of cryptographic functions (primitives?) to build upon. I'll read your links and see which method suits me best.
May
21
awarded  Supporter
May
21
accepted Which tamper-protection algorithm provides the shortest output?
May
21
comment Which tamper-protection algorithm provides the shortest output?
Good point about the reuse. I'll keep that in mind. And... I guess you're right about the saving a few bytes too. I just thought that a SHA-1 seems so... unsightly. :)
May
21
asked Which tamper-protection algorithm provides the shortest output?
Apr
20
awarded  Good Question
Aug
11
awarded  Popular Question
Mar
20
awarded  Yearling
Apr
25
awarded  Autobiographer
Mar
20
awarded  Teacher
Mar
20
awarded  Student
Mar
20
awarded  Scholar