Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: InstantCryptor – AES256 Encryption for Dropbox and Google Drive

instantcryptor.com

Post reply on HN
Print view View original

51–52 of 52 posts

Re: Show HN: InstantCryptor – AES256 Encryption for Dropbox and Google Drive

#51

Post by higherpurpose »

licobo wrote: post #48

@all: thanks a lot for your feedback! It's good to see that so many people care about security. To quickly summarize your questions: We are using the secure CBC mode and have always used it ;) You can have a look on the source code directly on the website (because it's all client side JavaScript), but some parts of it are minified. We are working on a detailed description of the technology behind InstantCryptor and w…

It seems you have an authentication problem:

https://www.grc.com/sn/SN-497-Notes.pdf

There should be more details here after the show will be recorded (live now): http://twit.tv/show/security-now/497

I think using ChaCha20-Poly1305 instead of AES-CBC would solve that problem.

https://www.imperialviolet.org/2013/10/07/chacha20.html

Re: Show HN: InstantCryptor – AES256 Encryption for Dropbox and Google Drive

#52

Post by jjarmoc »

higherpurpose wrote: post #51
licobo wrote: post #48

@all: thanks a lot for your feedback! It's good to see that so many people care about security. To quickly summarize your questions: We are using the secure CBC mode and have always used it ;) You can have a look on the source code directly on the website (because it's all client side JavaScript), but some parts of it are minified. We are working on a detailed description of the technology behind InstantCryptor and w…

It seems you have an authentication problem: https://www.grc.com/sn/SN-497-Notes.pdf There should be more details here after the show will be recorded (live now): http://twit.tv/show/security-now/497 I think using ChaCha20-Poly1305 instead of AES-CBC would solve that problem. https://www.imperialviolet.org/2013/10/07/chacha20.html

I don't know that I'd necessary push for ChaCha20, but lack of ciphertext authentication is a clear problem. AES-GCM or even AES-CBC with an HMAC that's validated prior to decryption can provide the needed authenticity checks.
Post reply on HN