148 reputation
16
bio website
location
age
visits member for 1 year, 8 months
seen Jul 18 at 7:39

Apr
4
awarded  Scholar
Apr
4
comment How can mega store my login details and still be secure?
Thanks for that :)
Apr
4
comment How can mega store my login details and still be secure?
The attacker would know when they have generated a password that matches the hash. I get the hash, and the salt. Then I bruteforce every combination until I get the hash stored in the database. Now I have password, I can simply decrypt the key used to encrypt all my files.
Apr
4
comment How can mega store my login details and still be secure?
Also, what do you mean by the password-hash and the symmetric password hash? Are they not the same thing?
Apr
4
comment How can mega store my login details and still be secure?
I'm assuming that the symmetric key being encrypted is a string of 16 or 32 pseudo-random bytes, so there's no way for an attacker to verify that they've decrypted the key successfully without actually attempting to decrypt your data with it In my opinion is wrong. Lets say they use MD5 as a hasing algo (I know, its not secure but meh). All I would need to do is bruteforce that MD5 and I would have the password used to encrypt my symmetric key.
Apr
3
asked How can mega store my login details and still be secure?
Feb
17
comment AES encryption with shared IV
Forget that last comment. Of course the IV needs to be known, otherwise AES would be unable to "un-XOR" the message when decrypting.
Feb
17
comment AES encryption with shared IV
Thanks, your idea for the random number generator is a good one! I am using CBC mode so this sounds good. However I have a question, everywhere I read, it seems as if (at least to me) that the IV is not important in the decryption of the ciphertext. What I mean is, if I just use random crap for the IVs would this work or not? I've seen people using timestamps as IVs however how would you get that to the other end without sending it in the message?
Feb
17
comment AES encryption with shared IV
@Thomas When I say packet, I mean message.
Feb
16
asked AES encryption with shared IV