amaterasu

Unregistered less info
8 reputation
3
bio website
location
age
visits member for 1 year, 2 months
seen Feb 18 '13 at 5:20

Feb
16
awarded  Scholar
Feb
16
accepted Use of CBC-AES-256 to encrypt usernames
Feb
14
awarded  Editor
Feb
14
revised Use of CBC-AES-256 to encrypt usernames
added 284 characters in body
Feb
14
comment Use of CBC-AES-256 to encrypt usernames
Yes, only one IV is being used. If the encryption works with 32byte blocks and usernames are always shorter than that, what is the point in using CBC over ECB if there is only one IV being used?
Feb
14
comment Use of CBC-AES-256 to encrypt usernames
They key and IV are hardcoded and used for every username. An attacker is able to register new usernames and see the ciphertext of them if he has access to the SQL db.
Feb
14
comment Use of CBC-AES-256 to encrypt usernames
The idea is to protect the privacy of usernames (which are actually real names) against attacks on the web application (SQL injections leading to leaking of usernames). The encrypted usernames themselves are stored in the database, the key and IV are in the web application. I know this is ridiculous, but I'm interested in trying to fix this as much as possible while not going against the ridiculous design requirements.
Feb
14
awarded  Student
Feb
14
asked Use of CBC-AES-256 to encrypt usernames