network profile
| bio | website | antineutral.com |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 5 months |
| seen | Dec 25 '12 at 2:15 | |
| stats | profile views | 4 |
|
Dec 21 |
comment |
Double Encrypting with two different keys Paulo, Hunter, Dennis, and Stephen thanks for clarifying all of this to me. Special thanks to Stephen for practical advice, and to Paulo for explaining how cascading algorithms with different length keys CAN be executed safely. Am I correct in that you need to cascade the key lengths in order (i.e. 64 + 128 + 192) or can they be (128 + 64 + 192)? Also, If AES will be my primary alg, and RC4 will be my intermediary stream cipher, what algs are dissimilar enough to use next to AES? |
|
Dec 21 |
accepted | Double Encrypting with two different keys |
|
Dec 20 |
comment |
Double Encrypting with two different keys User 1 enters UID/PWD and Token to retrive key hash (hmac). User then decodes say the serpent encryption with the serpent key. A 90 min timer starts to allow User 2 to sign in. User 2 Repeats the UID/PWD and token, but the key hash given includes the first hash generated, as well as seeded and locked w/ hmac. Then it takes the decrypted serpent data, leaving AES, and decrypts the AES. It is a security measure, two different users with auth to access raw data. |
|
Dec 19 |
comment |
Double Encrypting with two different keys Key 1 needs to be a part of the 2nd Key. How would I implement "secret sharing" with my keys in a more efficient / less homebrew way? Fear not, I'm not playing with the solid crypto functions like AES -- I just need a dual level security where user one logs in, opens a session for 90 min that stores that "decrypted" yet encrypted data. Then user 2 can come along and finish the protocol. XORing two password for a "true" password doesn't allow this. Per implementation, if I just used MCRYPT AES and SERPENT (or AES and AES again) for these purposes, where are potential failure points? |
|
Dec 18 |
revised |
Double Encrypting with two different keys BIG change to explain scenario. |
|
Dec 18 |
comment |
Double Encrypting with two different keys So when person one logs in and enters their key, it opens the first "vault" of encryption, only to leave another layer for a different person with a second key. Would it make sense just to do AES twice with good crypto hashes if I need this approach? Or is it a better idea to use two different Crypto's like Serpent then AES? |
|
Dec 18 |
comment |
Double Encrypting with two different keys For my application, I need my first key to unlock the second key, and the first key would be entered automatically via a login + a security token (like a RSA SecurID -- but on a thumb drive). The second key would require a second person with his/her key, his/her uid/token, and must login second. |
|
Dec 18 |
awarded | Scholar |
|
Dec 18 |
comment |
Double Encrypting with two different keys Thanks 4544, So if key size is different, there would be an increase in security? |
|
Dec 18 |
awarded | Editor |
|
Dec 18 |
revised |
Double Encrypting with two different keys added 89 characters in body |
|
Dec 18 |
comment |
Double Encrypting with two different keys It wasn't completely answered; I am using mcrypt_create_iv / MCRYPT_RAND to generate random entropy, which, I have heard is a good source of data for keys. OpenSSL is another option. No one ever told me if data would collide --- whether it would be easier or harder to decrypt using two systems and dual keys. And no, I'm not confused about public and private keys such as RSA, etc, I'm simply trying to get a straight answer: with proper key entropy, does dual encryption hurt or help. Stephen, you are clearly an expert here, I am not. |
|
Dec 17 |
asked | Double Encrypting with two different keys |
|
Dec 10 |
comment |
RC4 encryption -> AES encryption = more or less secure than RC4 or AES alone? Is there any other asymmetric encryption systems beside RSA? I need a two-key system, although the above example is symmetric, asymmetric is preferred. |
|
Dec 10 |
comment |
RC4 encryption -> AES encryption = more or less secure than RC4 or AES alone? I didn't think that using RC4 with one key, and then encrypting the result in AES with another key would be considered making your own cryptography. I see encryption modules that use AES + Blowfish or Twofish. How is this different? Using an existing RC4 module and encrypting the output with a different key using AES. I'm not inventing my own cipher -- it is simply encrypting with RC4 (with one key) and encrypting the result with AES. |
|
Dec 10 |
asked | RC4 encryption -> AES encryption = more or less secure than RC4 or AES alone? |
