KeithS

235 reputation

bio	website
	location
	age
visits	member for	8 months
	seen	May 9 at 16:19
stats	profile views	1

	235 reputation	bio	website		visits	member for	8 months
7 badges		location			seen	May 9 at 16:19

summary answers questions tags badges favorites bounties reputation activity

53 Actions

suggestions reviews revisions comments badges posts accepts all

Feb 12	revised	How and why can a decryption program tell me that a key is incorrect? added 41 characters in body
Feb 6	accepted	Understanding padding oracles - is an attack plausible in my scenario?
Jan 23	comment	Understanding padding oracles - is an attack plausible in my scenario? The vector I see for the padding oracle attack is to impersonate the server during a legitimate user's login, and pass back malformed chosen plaintexts. The server isn't encrypting or decrypting anything; it simply accepts, stores, then retrieved and sends data already encrypted by the client. The attacker would have to be "on" the computer receiving these packets as well, in order to get the error message. The client app won't tell the server that the data it was given was bad; it tells the user that decryption failed (in so many words).
Jan 23	comment	Understanding padding oracles - is an attack plausible in my scenario? Anyway, dropping the SHA-512 key-"lengthening" (I won't call it "stretching" anymore) in favor of PBKDF2 for the AES key derivation would require some other way to send the password securely. BCrypting it on the client before sending it is totally an option (it's what we're doing now). So is knuckling under and setting up a PKI in our network, giving the DB a certificate and using TLS-secured communications to the DB server.
Jan 23	comment	Understanding padding oracles - is an attack plausible in my scenario? I didn't say I was disagreeing with you; you stated that you didn't quite understand what was going on, and assumptions you seemed to make about what's done where were incorrect, so I was explaining. I totally agree there is a huge hole in the AES key derivation method.
Jan 23	comment	Understanding padding oracles - is an attack plausible in my scenario? As built, however, there is no service layer performing any validation, so data is easy to get, and an attack could then be performed offline. The vector is still brute-forcing the password, not trying to reverse-engineer the plaintext. I still see no vector for a padding oracle attack that wouldn't require enough control over a legitimate user's system to simply install a keylogger.
Jan 23	comment	Understanding padding oracles - is an attack plausible in my scenario? As designed, the scheme uses a service layer to do the BCrypting and initial password validation, before returning the encrypted credentials for decryption by the client. So, the initial round of SHA-512 was partially to obfuscate the password on its way to the server. Pre-imaging this hash naively with just the data seen on the wire would be difficult and would not necessarily produce the correct other half of the actual hash (but trying common passwords might). The encrypted data coming back is, well, encrypted, and the key is never sent over the wire, so that data's safe as well.
Jan 23	comment	Understanding padding oracles - is an attack plausible in my scenario? The symmetric decryption happens in a thick client application accessing a database server. Theoretically, this all happens inside a trusted network in the first place, but I'm trying to add some defense in depth because we've seen a few holes, and plaintext credentials in the DB are just a Very Bad Thing. The original scheme as designed assumed that connections from client to server couldn't use TLS, which currently holds. Therefore, the idea was that an attacker who'd penetrated the outer defense could never sniff credentials as they were passed back and forth inside our trusted network.
Jan 23	comment	Understanding padding oracles - is an attack plausible in my scenario? The user has a password to the application. That application must authenticate with a third party, in my case a cloud provider, using a separate set of credentials. These credentials must be secured in reversible fashion; they can't be BCrypted like the main application password, because the client app needs them in plain text to send to the cloud provider.
Jan 22	revised	How and why can a decryption program tell me that a key is incorrect? added 57 characters in body
Jan 22	asked	Understanding padding oracles - is an attack plausible in my scenario?
Jan 15	revised	How and why can a decryption program tell me that a key is incorrect? edited body
Jan 15	revised	How and why can a decryption program tell me that a key is incorrect? added 435 characters in body
Jan 15	answered	How and why can a decryption program tell me that a key is incorrect?
Dec 13	comment	Is AES in CBC mode secure if a known and/or fixed IV is used? ... Except that in my case I'm using a PBKDF, and SymmetricAlgorithm.CreateEncryptor() doesn't have an overload accepting only a key.
Dec 11	comment	How are primes generated for RSA? The generation of a random number of the proper length as a stream of bits is pretty much the same as flipping a coin 2048 times. While the hamming weight of the numbers produced (basically the number of "1"s in the bitstream) follows a binomial distribution (pretty much by definition), the actual numbers a CSPRNG produces are designed to be evenly distributed. There is theoretically an equal chance of getting the number 1 as there is of any other number. However, pseudorandomness isn't true randomness, and anyone that saw a PRNG produce a string of 2047 zeroes and one 1 would say it's broken.
Dec 3	comment	Weakness in using only one RSA key pair for two-way communication? As far as padding, see my edited question; let's assume OEAP padding. "Secure" is defined as Cindy not being able to discover the plaintexts of either message given only the ciphertexts; we can assume that Cindy has no access to Alice or Bob's plaintext messages on either end (before encryption or after decryption), or their keys.
Dec 3	revised	Weakness in using only one RSA key pair for two-way communication? added 300 characters in body
Dec 3	comment	Weakness in using only one RSA key pair for two-way communication? @CodesInChaos - Obviously there are other possible solutions when secure key transmission is possible. I was merely curious if the inverse-operation nature of the RSA scheme could be used as a two-way communication channel, or if being able to see messages enciphered using both keys would present a mathematical vulnerability.
Dec 3	comment	Weakness in using only one RSA key pair for two-way communication? @fgrieu - Cindy does not know any part of the keyset including the shared modulo. She does not know any plaintexts involved. All she can see are the ciphertexts passed back and forth.