meta user
network profile
| bio | website | touset.org |
|---|---|---|
| location | San Francisco, CA | |
| age | 29 | |
| visits | member for | 7 months |
| seen | 2 hours ago | |
| stats | profile views | 14 |
Cyclist. Rubyist.
|
Mar 17 |
answered | How to use GCM mode and associated-data properly |
|
Mar 17 |
comment |
What are the constraints for an IV using AES in CBC mode? Yes. GCM mode is essentially a mode that natively combines CTR mode and an authenticator. You get secrecy and authentication. |
|
Mar 15 |
comment |
What are the constraints for an IV using AES in CBC mode? In short, just because something is encrypted doesn't mean it hasn't been tampered with. There are tons of ways attackers can predictably manipulate the plaintext contents of a ciphertext. You also need to verify that the contents haven't been tampered with. |
|
Mar 15 |
comment |
What are the constraints for an IV using AES in CBC mode? If you're designing this protocol, you really should consider using authenticated encryption (CBC with an HMAC is fine, assuming you get the details correct, but something like GCM mode is better) if at all possible. |
|
Mar 11 |
comment |
How to communicate authentication tag for GCM? Perhaps more future-proof is to prepend the tag, since it's of a fixed width. I generally prefer to keep fixed-width fields in front, protocol-wise, if there's a variable length field. |
|
Mar 6 |
comment |
XOR cipher for encrypting compiled C code Like @fgrieu pointed out, a repeating keystream allows an attacker who can make guesses about the plaintext to recover your key. Especially given things like ELF headers at the beginning of binaries that contain mostly-static data. Rotating the key doesn't change this fundamental property — once somebody's uncovered the key once, it even becomes significantly easier to guess the key in the future. |
|
Mar 6 |
comment |
XOR cipher for encrypting compiled C code Like he said, why not use true cryptography? It actually solves the problem, and doesn't just put a band-aid over the gaping wound that is XOR with a repeating key stream. |
|
Mar 5 |
comment |
is AES secure for java application licensing @dendini The advantage to RSA is that an attacker can't create a program to automatically generate valid keys for everybody else (commonly known in cracking communities as a keygen). You can't stop individual attackers from bypassing your licensing requirements. But you can stop attackers from helping everyone else trivially bypass them. |
|
Mar 5 |
comment |
is AES secure for java application licensing His answer to B appears to be that your code is completely unsafe, because a single attacker will be able to trivially build an application that allows any user to bypass your licensing. |
|
Mar 1 |
comment |
Is it safe for the ChaCha8 nonce to be deterministic? Apologies. I wasn't able to find any real documentation on chacha, so went to the source. I've obviously misread something in the implementation. |
|
Mar 1 |
answered | Is it safe for the ChaCha8 nonce to be deterministic? |
|
Mar 1 |
comment |
Is SHA-512 bijective when hashing a single 512-bit block? It still astonishes me to consider that given the hundreds of zetabytes of data our species has ever stored digitally, we haven't even made perceptible progress in representing all the values capable of being stored in 32 bytes of the tiniest chip of RAM ever created. |
|
Feb 28 |
comment |
Is SHA-512 bijective when hashing a single 512-bit block? Not even then. I won't detail the math in a comment, but if we were to construct the most energy-efficient computer theoretically possible, it would require all of the output from a supernova in order to cycle a 219-bit counter. And that's an almost imperceptible fraction of the energy necessary to run a counter through 256 bits. |
|
Feb 26 |
answered | What is the difference between a HMAC and a hash of data? |
|
Feb 24 |
comment |
Bad/Crackable Encryption Example? You could encrypt a string in CBC mode and provide a padding oracle. |
|
Feb 21 |
comment |
Why do we assume un-security of communication channel on every cryptography system Don't forget fair coin tosses. |
|
Feb 21 |
comment |
Why do we assume un-security of communication channel on every cryptography system Additionally, if we can find ways of solving problems without having to rely on a secure channel, that's one fewer point of failure. What happens when our "secure" channel turns out not to be? |
|
Feb 21 |
comment |
Validating successful decryption in AES Python has bindings to OpenSSL, does it not? If you have access to OpenSSL >= 1.0.1, it supports AES in GCM mode. |
|
Feb 20 |
answered | Validating successful decryption in AES |
|
Feb 19 |
comment |
AES Key Length vs Block Length I'm not sure how I missed that on my first read-through. Apologies. |
