11–20 of 46 posts
This is a really great writeup. But CTR+HMAC is, in fact, a composed authenticated encryption mode. If you have a working system with CTR+HMAC, I'd recommend against spending effort switching to GCM, which is actually harder to get right.
Also, the code for chacha is easily available.
This is a really great writeup. But CTR+HMAC is, in fact, a composed authenticated encryption mode. If you have a working system with CTR+HMAC, I'd recommend against spending effort switching to GCM, which is actually harder to get right.
I thought AES-GCM was on its way out? Isn't poly1305-chacha20 what we should use now, given that it's quite a bit cheaper in terms of cost, and the keys are much smaller (32 bytes)? Also, the code for chacha is easily available.
Still recall running across a vendor that was hashing credit cards using MD5. Asked them why, and their response was that they were PCI compliant. Called the main PCI line, asked them if MD5 hash was an acceptable way to store credit cards securely, and the answer was yes.
> "First it is important to understand what this encryption module is actually supposed to do and understand the threat scenario. The encryption provides no security against a malicious server operator, because the encryption happens on the server. The only scenario where this encryption helps is if one has a trusted server that is using an untrusted storage space." While it's a good finding that even in this specifi…
So what is the implication of this? The major reason to use the crypto module is that my users can add their google drives to owncloud and its encrypted on there. Whats the recommended course of action?
If you want to go along with owncloud (and I don't know a proper alternative) there's not much you can do then upgrading to Owncloud 9 and hope that the fix was done right. In the meantime you could encourage your users to use their own client-side encryption while giving up the idea of an easy setup.
Still recall running across a vendor that was hashing credit cards using MD5. Asked them why, and their response was that they were PCI compliant. Called the main PCI line, asked them if MD5 hash was an acceptable way to store credit cards securely, and the answer was yes.
This is a really great writeup. But CTR+HMAC is, in fact, a composed authenticated encryption mode. If you have a working system with CTR+HMAC, I'd recommend against spending effort switching to GCM, which is actually harder to get right.
I thought AES-GCM was on its way out? Isn't poly1305-chacha20 what we should use now, given that it's quite a bit cheaper in terms of cost, and the keys are much smaller (32 bytes)? Also, the code for chacha is easily available.
You'll more than likely make a mistake.
Libsodium offers both (but AES-256-GCM is only available if you have hardware support for constant-time implementations).
crypto_aead_chacha20poly1305_encrypt()
crypto_aead_chacha20poly1305_decrypt()
crypto_aead_aes256gcm_encrypt()
crypto_aead_aes256gcm_decrypt()
Still recall running across a vendor that was hashing credit cards using MD5. Asked them why, and their response was that they were PCI compliant. Called the main PCI line, asked them if MD5 hash was an acceptable way to store credit cards securely, and the answer was yes.
How many bit of entropy are in a credit card? I ran the numbers a few years ago but don't remember now. Well within a very small rainbow table in any case.
Still recall running across a vendor that was hashing credit cards using MD5. Asked them why, and their response was that they were PCI compliant. Called the main PCI line, asked them if MD5 hash was an acceptable way to store credit cards securely, and the answer was yes.