183 reputation
7
bio website github.com/jbtule
location St. Louis, MO
age
visits member for 2 years, 6 months
seen Feb 14 at 19:09

twitter: @jbtule


Dec
31
comment Should I salt an AES password at each encryption?
It is not clear if you are using a per application salt or a per user salt, could you clarify?
Apr
25
comment Why is AES resistant to known-plaintext attacks?
@owlstead You are going to have to be more specific, because I'm still only seeing padding or validation oracles that let you recover the plain text with chosen-cipher-text-attacks.
Apr
25
comment Why is AES resistant to known-plaintext attacks?
@owlstead I think it's a stretch to say that a padding oracle attack is a known plain text attack, because while there is "plain text" that is known (ie the padding algorithm) knowing the plain text message isn't really helpful except for the fact that you wouldn't need the attack in the first place.
Apr
25
comment Why is the IV passed in the clear when it can be easily encrypted?
@BobBryan you are missing the point, if I'm an attacker, and I have an magic attack that is based on knowing the IV, and you have magically encrypted the IV (Block 0) so that I can't use it in my attack, you have only thwarted me from decrypting Block 1 of your plain text, because every other block N used the Block N-1's cipher text as the IV and you didn't magically encrypt those IV's as well.