285 reputation
18
bio website
location
age
visits member for 2 years
seen Dec 17 '13 at 18:46

Feb
21
awarded  Popular Question
Sep
5
awarded  Yearling
Feb
12
revised How and why can a decryption program tell me that a key is incorrect?
added 41 characters in body
Feb
6
accepted Understanding padding oracles - is an attack plausible in my scenario?
Jan
23
comment Understanding padding oracles - is an attack plausible in my scenario?
The vector I see for the padding oracle attack is to impersonate the server during a legitimate user's login, and pass back malformed chosen plaintexts. The server isn't encrypting or decrypting anything; it simply accepts, stores, then retrieved and sends data already encrypted by the client. The attacker would have to be "on" the computer receiving these packets as well, in order to get the error message. The client app won't tell the server that the data it was given was bad; it tells the user that decryption failed (in so many words).
Jan
23
comment Understanding padding oracles - is an attack plausible in my scenario?
Anyway, dropping the SHA-512 key-"lengthening" (I won't call it "stretching" anymore) in favor of PBKDF2 for the AES key derivation would require some other way to send the password securely. BCrypting it on the client before sending it is totally an option (it's what we're doing now). So is knuckling under and setting up a PKI in our network, giving the DB a certificate and using TLS-secured communications to the DB server.
Jan
23
comment Understanding padding oracles - is an attack plausible in my scenario?
I didn't say I was disagreeing with you; you stated that you didn't quite understand what was going on, and assumptions you seemed to make about what's done where were incorrect, so I was explaining. I totally agree there is a huge hole in the AES key derivation method.
Jan
23
comment Understanding padding oracles - is an attack plausible in my scenario?
As built, however, there is no service layer performing any validation, so data is easy to get, and an attack could then be performed offline. The vector is still brute-forcing the password, not trying to reverse-engineer the plaintext. I still see no vector for a padding oracle attack that wouldn't require enough control over a legitimate user's system to simply install a keylogger.
Jan
23
comment Understanding padding oracles - is an attack plausible in my scenario?
As designed, the scheme uses a service layer to do the BCrypting and initial password validation, before returning the encrypted credentials for decryption by the client. So, the initial round of SHA-512 was partially to obfuscate the password on its way to the server. Pre-imaging this hash naively with just the data seen on the wire would be difficult and would not necessarily produce the correct other half of the actual hash (but trying common passwords might). The encrypted data coming back is, well, encrypted, and the key is never sent over the wire, so that data's safe as well.
Jan
23
comment Understanding padding oracles - is an attack plausible in my scenario?
The symmetric decryption happens in a thick client application accessing a database server. Theoretically, this all happens inside a trusted network in the first place, but I'm trying to add some defense in depth because we've seen a few holes, and plaintext credentials in the DB are just a Very Bad Thing. The original scheme as designed assumed that connections from client to server couldn't use TLS, which currently holds. Therefore, the idea was that an attacker who'd penetrated the outer defense could never sniff credentials as they were passed back and forth inside our trusted network.
Jan
23
comment Understanding padding oracles - is an attack plausible in my scenario?
The user has a password to the application. That application must authenticate with a third party, in my case a cloud provider, using a separate set of credentials. These credentials must be secured in reversible fashion; they can't be BCrypted like the main application password, because the client app needs them in plain text to send to the cloud provider.
Jan
22
revised How and why can a decryption program tell me that a key is incorrect?
added 57 characters in body
Jan
22
asked Understanding padding oracles - is an attack plausible in my scenario?
Jan
15
revised How and why can a decryption program tell me that a key is incorrect?
edited body
Jan
15
revised How and why can a decryption program tell me that a key is incorrect?
added 435 characters in body
Jan
15
answered How and why can a decryption program tell me that a key is incorrect?
Dec
13
comment Is AES in CBC mode secure if a known and/or fixed IV is used?
... Except that in my case I'm using a PBKDF, and SymmetricAlgorithm.CreateEncryptor() doesn't have an overload accepting only a key.
Dec
11
comment How are primes generated for RSA?
The generation of a random number of the proper length as a stream of bits is pretty much the same as flipping a coin 2048 times. While the hamming weight of the numbers produced (basically the number of "1"s in the bitstream) follows a binomial distribution (pretty much by definition), the actual numbers a CSPRNG produces are designed to be evenly distributed. There is theoretically an equal chance of getting the number 1 as there is of any other number. However, pseudorandomness isn't true randomness, and anyone that saw a PRNG produce a string of 2047 zeroes and one 1 would say it's broken.
Dec
3
comment Weakness in using only one RSA key pair for two-way communication?
As far as padding, see my edited question; let's assume OEAP padding. "Secure" is defined as Cindy not being able to discover the plaintexts of either message given only the ciphertexts; we can assume that Cindy has no access to Alice or Bob's plaintext messages on either end (before encryption or after decryption), or their keys.
Dec
3
revised Weakness in using only one RSA key pair for two-way communication?
added 300 characters in body