Top tag
Next privilege 250 Rep.
View close votes
~3k people reached

  • 0 posts edited
  • 0 helpful flags
  • 30 votes cast
comment Should I salt an AES password at each encryption?
It is not clear if you are using a per application salt or a per user salt, could you clarify?
comment Why is AES resistant to known-plaintext attacks?
@owlstead You are going to have to be more specific, because I'm still only seeing padding or validation oracles that let you recover the plain text with chosen-cipher-text-attacks.
comment Why is AES resistant to known-plaintext attacks?
@owlstead I think it's a stretch to say that a padding oracle attack is a known plain text attack, because while there is "plain text" that is known (ie the padding algorithm) knowing the plain text message isn't really helpful except for the fact that you wouldn't need the attack in the first place.
comment Why is the IV passed in the clear when it can be easily encrypted?
@BobBryan you are missing the point, if I'm an attacker, and I have an magic attack that is based on knowing the IV, and you have magically encrypted the IV (Block 0) so that I can't use it in my attack, you have only thwarted me from decrypting Block 1 of your plain text, because every other block N used the Block N-1's cipher text as the IV and you didn't magically encrypt those IV's as well.