13 reputation
3
bio website
location
age
visits member for 7 months
seen Aug 28 '13 at 1:23

Aug
28
comment Multiple parties must encrypt and get the same result
Thanks John - I definitely am not planning to implement this myself any time soon. I'll wait and see what decision is made.
Aug
26
comment Multiple parties must encrypt and get the same result
Yes that's true. We'll need to talk about this more here, it sounds like a tokeniser service is the best way forward though.
Aug
22
comment Multiple parties must encrypt and get the same result
Thanks guys - the assumptions above sound correct to me. I thought about it overnight and the attacker only needs to check a few digits as you've said. I had thought a significant work factor (e.g. 1 second to compute a hash) could help, but then again - any attacker will have access to more power than us, it's not future proof, and we have processing deadlines which they don't. I will read the information on multi-use tokens, thanks for the pointer, I didn't know what to look for earlier as I'm far from an expert.
Aug
22
comment Multiple parties must encrypt and get the same result
Yes that's the problem, a brute force check for a small string of 8 characters. I was wondering whether something with a work factor like bcrypt makes this less of a problem.
Aug
22
comment Multiple parties must encrypt and get the same result
Yes - but for now we can assume a very low chance hash collision is probably acceptable, as users can view the documents to find what they are looking for.