Reputation
Top tag
Next privilege 125 Rep.
Vote down
Badges
5
Impact
~186 people reached

  • 0 posts edited
  • 0 helpful flags
  • 5 votes cast
Sep
24
awarded  Autobiographer
Dec
30
comment Future-Proof Versioning and Validation
@JesperMortensen afaik keyczar doesn't work w python 3. if it does, please tell me. incidentally, simple-crypt is secure against that attack and it's documented in the code (not through any brilliance of mine, but because i have been pestering people to review the code and including their feedback)
Dec
28
awarded  Scholar
Dec
28
accepted Future-Proof Versioning and Validation
Dec
28
comment Future-Proof Versioning and Validation
@Thomas oh, an extra HMAC (one that doesn't change with protocol ID), sorry, right.
Dec
27
comment Future-Proof Versioning and Validation
i don't have a specific attack in mind (hence my comment that maybe i need to wait for more specifics). i'm just assuming i may have screwed up. thanks for the comments - it's given me more to think about. i'll wait a while to see if anyone else posts, but that was help enough for a "correct" answer, thanks.
Dec
27
comment Future-Proof Versioning and Validation
thanks. so apologies for not being clear enough that what seems to be the root of the problem is that i want to both (1) automatically support decrypting data encrypted with an older version and (2) somehow avoid attacks that supporting an older version could imply. i guess looked at that way i may be asking the impossible. to answer the final q - the api is ideally two functions, encrypt and decrypt. but maybe i need to consider conversion instead of automatic backwards support. ps the current heder includes what you are calling a protocol id.
Dec
27
comment Future-Proof Versioning and Validation
@dchest - true, but in general corrupting the data will simply abort things. changing the version number triggers a more specific action (update your software) that might be combined with some kind of attack where a fake replacement is provided. i realise i may be taking things too far, but it seemed like it was different...
Dec
27
comment Future-Proof Versioning and Validation
@PaĆ­loEbermann - yes, clarified
Dec
27
revised Future-Proof Versioning and Validation
added 25 characters in body
Dec
27
awarded  Student
Dec
27
revised Future-Proof Versioning and Validation
edited body
Dec
27
revised Future-Proof Versioning and Validation
added 66 characters in body
Dec
27
awarded  Editor
Dec
27
revised Future-Proof Versioning and Validation
added 170 characters in body
Dec
27
asked Future-Proof Versioning and Validation
May
16
awarded  Supporter