24 reputation
7
bio website
location Farmville, VA
age
visits member for 11 months
seen Dec 17 '13 at 19:58

Oct
12
revised What security differences are there between E(p',“well-known-plaintext”) vs. hash(p') where p'=KDF(p)
added 1281 characters in body
Sep
27
comment What security differences are there between E(p',“well-known-plaintext”) vs. hash(p') where p'=KDF(p)
Yes, the KDF is run first. I am assuming that entropy(p)>80 bits (diceware). Is there a known preimage attack on SHA256 (full rounds) that is better than brute force?
Sep
27
revised What security differences are there between E(p',“well-known-plaintext”) vs. hash(p') where p'=KDF(p)
bcrypt is just an example
Sep
27
asked What security differences are there between E(p',“well-known-plaintext”) vs. hash(p') where p'=KDF(p)
Sep
27
comment Can padding length, and thus plaintext length, be considered public information when using aes-cbc?
Kenneth G. Paterson; Gaven J. Watson (2008). "Immunising CBC Mode Against Padding Oracle Attacks: A Formal Security Treatment". Security and Cryptography for Networks – SCN 2008, Lecture Notes in Computer Science (Springer Verlag) (5229): 340–357. cited in Wikipedia:Block cipher No, I haven't read the paper. I am (perhaps foolishly) assuming the Wikipedia article is correct.
Sep
27
comment Can padding length, and thus plaintext length, be considered public information when using aes-cbc?
Colin Percival recommends using AES in CTR mode, completely bypassing the padding issues with CBC.
Sep
26
answered Can padding length, and thus plaintext length, be considered public information when using aes-cbc?
Sep
3
comment How terribly flawed is this design for key storage?
"Get rid of 'magic'" I agree. It seemed like a good idea at first, but quickly fell apart under scrutiny.
Sep
3
comment How terribly flawed is this design for key storage?
SecretBox uses XSalsa20 with Poly1305 for authentication. AES is available but not the default. nonce is for SecretBox, not for the KDF.
Sep
3
awarded  Teacher
Sep
2
comment How terribly flawed is this design for key storage?
I am accepting this answer because it is turning into a discussion, but I am still open to ideas. Thank you for all of your feedback.
Sep
2
awarded  Scholar
Sep
2
accepted How terribly flawed is this design for key storage?
Sep
2
comment How terribly flawed is this design for key storage?
re: why store the keyfile separately? After considering the comments and answers, I think there is no security advantage to doing so if the storage server is untrusted. I does make some sense if it is the keyfile for a 2 TB hard disk that you are planning to carry across a national border.
Sep
2
awarded  Commentator
Sep
2
comment How terribly flawed is this design for key storage?
re #3: I am OK with 192 bits. If someone really wants to use a 256-bit diceware password for their masterkey, then a single round of sha256 is going to be a good-enough kdf, and they are probably not going to trust me enough to be using my software. ;-) I will certainly make this point in my documentation.
Sep
2
comment How terribly flawed is this design for key storage?
MAGIC is indeed a hard coded constant. I was using it to be able to store the work factor. The more I think about this, the worse the idea looks. A better solution is to treat the work factor as an additional user-supplied secret. If I set the default work factor to 31, the attacker is in pretty sad shape.
Sep
2
comment How terribly flawed is this design for key storage?
work factor: 8 gives about 1 second per guess on my box. 9 gives 2 seconds, which is still reasonable IMO (but would not be in a server-side scenario) If my password has 80 bits of entropy to start with, this gives 89 bits after stretching. The impression I get from my reading is that it is better to add entropy to the password than to the work factor.
Sep
2
comment How terribly flawed is this design for key storage?
SecretBox adds structure to the file that is only visible to someone with the key. If the key works, then the key works, and the attacker is going to know it (unless I do something silly like encrypting random data just to make the attacker pull out his hair).
Sep
2
comment How terribly flawed is this design for key storage?
@owlstead yes, you are right. I started using Lastpass base on Steve Gibson's glowing recommendation. It is definitely better than what I was doing before, and I am grateful for it. The more I study, however, the more I find myself wishing they had made different design decisions. This is why I am pursuing this project.