11–20 of 28 posts
Didn't Bruce Schneier publish a provably secure scheme in which multiple encryption algorithms could be combined such that a weakness in any single one of them was not sufficient to reduce the security of the message?
I may be wrong as I'm no security researcher, but I was under the impression that combining things like this (and rolling your own crypto in general) could potentially make things weaker. Is this the case here? Edit: Reading it more, I'm more convinced. It looks like there was a discussion a few days ago: https://news.ycombinator.com/item?id=6401057
Combining algorithms, if done properly, isn't necessarily going to make things weaker. But doing it properly isn't trivial (which goes for crypto in general) and the more complex the construction, the more opportunities for screwing it up. But at the end of the day it's still trying to solve the wrong problem. The chance of a well studied algorithm like AES having a significant weakness is much, MUCH lower than the c…
Any encrypted data you put onto a remote-server will live there forever, so your encryption has to be future-proof. I think it pays to hedge your bets here.
All of our implementations are tested against known test vectors. Side-channel attacks could be a problem though.
I like this idea to reduce dependence on trusting any given algorithm. If I'm a global passive adversary, I would try to attack your blobs in these ways: 1) weaken your random number generators 2) guess your password by running massive dumps of passwords and passwords mutated with rules against pbkdf2 (why didn't you use scrypt?) 3) try to convince you or your system to decrypt a blob and reveal the plaintext to me s…
For passwords, I recommend using a sequence of 4-5 random words chosen from a ~20k word dictionary. This gives you about 58 to 72 bits of entropy.
I also recommend https://oneshallpass.com for giving random PWs to different Web sites, but that's a slightly different problem.
Don't use this thing.
Again, I am open to valid criticisms. Those of the form "this is stupid because XSS isn't solved" aren't valid in my book because they are orthogonal problems, and progress along either axis is good.
Don't upvote advice without explanation.
Don't use this thing.
Is there any justification to your comments? Your criticisms on the crypto have all been debunked by those who know the crypto. See here for an example: http://d3j5vwomefv46c.cloudfront.net/photos/large/810438785.... Again, I am open to valid criticisms. Those of the form "this is stupid because XSS isn't solved" aren't valid in my book because they are orthogonal problems, and progress along either axis is good.
Here's the problem I have with your design: it doesn't make any sense to me. So worried are you about the NSA's ability to break AES or Salsa20 --- a worry not apparently shared by cryptographers, so far as I can tell --- that you resurrect Bruce Schneier's 1990s-era block cipher cascade, chaining Twofish(?!), a modified(?!) Salsa20, and AES. But so confident are you in the safety of Javascript crypto that... you deliver that code over an AES-encrypted TLS channel. I don't get it. What was the point of this again? How is anything you're doing making it harder for the NSA to subvert your comms? They're a single AES key away from rewriting your entire cryptosystem.
Earlier quoted context omitted.
Is there any justification to your comments? Your criticisms on the crypto have all been debunked by those who know the crypto. See here for an example: http://d3j5vwomefv46c.cloudfront.net/photos/large/810438785.... Again, I am open to valid criticisms. Those of the form "this is stupid because XSS isn't solved" aren't valid in my book because they are orthogonal problems, and progress along either axis is good.
What a weird comment. All Adam Langley seems to have to say about your system is that you didn't use a weak cipher composition but did use a weak MAC composition, and all I have to say in that thread is that I didn't think the Joux multicollision attack he was referring to applied. And yet somehow, presumably by ignoring the other cryptographers criticizing this design at the same time, you synthesized a narrative ab…
Other concerns aside, XSalsa20 is undeserving of your indignant reaction: it was created by DJB himself and was proven by him to be secure if Salsa20 is.
