Stephen Touset

1,251 reputation

215

bio	website	touset.org
	location	San Francisco, CA
	age	29
visits	member for	7 months
	seen	3 hours ago
stats	profile views	14

Cyclist. Rubyist.

	1,251 reputation	bio	website	touset.org	visits	member for	7 months
215 badges		location	San Francisco, CA		seen	3 hours ago

summary answers questions tags badges favorites bounties reputation activity

162 Comments

suggestions reviews revisions comments badges posts accepts all

Apr 24	comment	Tamper-proofing log files More cryptography is not automatically better — in fact, it is usually worse. Nowhere in your question have you indicated that secrecy of the contents of the logfiles is important, so encryption should be considered unnecessary. So I turn the question back on you: in what way is authenticated encryption better? And file deletion can be detected simply by the lack of presence of a file for a particular date.
Apr 24	comment	Tamper-proofing log files Why not just use `HMAC(key, filename \|\| contents)`? There's no need for a unique key for every file. There's no need for encryption. You can also use something like `chattr` to set the immutable flag, which can only be removed on reboot.
Apr 18	comment	Can prepending “junk” be equivalent to an IV when encrypting using CBC? Why do you want to do this? Storing and transmitting an IV requires an extra 32 bytes. Why spend time, effort, and energy brainstorming ways to avoid dealing with thirty two bytes? I'm sure you have tons of problems that actually require solving, and I can't imagine that figuring out how to handle thirty two bytes is one of them.
Apr 12	comment	Proper uses for CTR and CBC AES block cipher modes Go has OpenSSL bindings, does it not? OpenSSL has support for GCM since at least 1.0.1c.
Apr 9	comment	Why does a broken hash function undermine an HMAC? That said, new implementations should probably default to something like HMAC-SHA2 out of an abundance of caution.
Apr 8	comment	Does the IV need to be known by AES (CBC mode)? No worries. Glad to help.
Apr 8	comment	Does the IV need to be known by AES (CBC mode)? The IV is not prepended to the plaintext. It is XORed against the plaintext block, as the second sentence in that section clearly states. When you decrypt the first ciphertext block, you now have a message that was XORed against the IV; good luck retrieving the original message if the IV is unknown.
Apr 8	comment	Does the IV need to be known by AES (CBC mode)? Look at the images. The previous ciphertext block is always used as the "IV" for the next block, both during encryption and decryption. The initialization vector acts as the first "previous block" when none would otherwise be there.
Apr 8	comment	Does the IV need to be known by AES (CBC mode)? This can pretty much be answered trivially by reading the relevant Wikipedia article. Note that attempting decryption without the IV is the logical equivalent of trying to compare a password against a salted hash, without having access to the salt.
Mar 31	comment	Single-purpose symmetric encryption scheme for single files Interesting. It looks like `EVP_BytesToKey` tries to approximate something like PBKDF2... except the `enc` caller only uses 1 count. facepalm
Mar 30	comment	Single-purpose symmetric encryption scheme for single files @dchest The OpenSSL command line uses PBKDF2 for password-based key derivation. Try again.
Mar 30	comment	Single-purpose symmetric encryption scheme for single files What is the advantage over `openssl enc -aes-128-gcm -in infile -out outfile -k password?
Mar 28	comment	It is reasonably safe to leave a SSH private key with a 30+ character passphrase public? I believe @JohnDeters' point is that your problem is equivalent to a secret sharing scheme with $m = n = 2$. Data derived from the passphrase would constitute one of the two shares, and each server would possess the single remaining share needed to reconstruct the key.
Mar 28	comment	It is reasonably safe to leave a SSH private key with a 30+ character passphrase public? How can the owning party store the password, then?
Mar 28	comment	It is reasonably safe to leave a SSH private key with a 30+ character passphrase public? Will the RSA key be unlocked and used on those machines? Or will it be transferred to a controlled environment first?
Mar 28	comment	It is reasonably safe to leave a SSH private key with a 30+ character passphrase public? What is the purpose of distributing an RSA private key? Why can't multiple hosts have their own keypair?
Mar 26	comment	which asymmetric cipher provide highest performance? @rsa When in doubt, benchmark on your own hardware with the implementations you have available. If performance is important, nobody can answer this question except for you.
Mar 25	comment	which asymmetric cipher provide highest performance? This can change drastically based on hardware support and the particular implementation you choose. When in doubt, benchmark.
Mar 18	comment	How to use GCM mode and associated-data properly Yep, I'm an idiot. The password is the only component that needs to be kept secret.
Mar 18	comment	How to use GCM mode and associated-data properly Sorry, the salt for the password should be kept secret. Not the nonce for encryption.