Hot answers tagged

23

I think it's easier to split this into its component parts, and consider them as separate entities: AES and CBC. AES itself does not "basically consist of XORing together chunks of the block" - it's a much more complicated affair. Ignoring the internals of it for a moment, AES is considered secure in that without knowing the key, it's practically impossible ...


19

First, Apple's Secure Enclave is a module which ensures that the boot loader only runs code signed by Apple. That's not what you're doing, you are trying to build a Hardware Security Module (HSM). As you figured out, the proper way to do this is to have the HSM do all the crypto operations internally so that no keys ever leave the device - as you point ...


10

TL;DR: You can relax - your database is absolutely secure. Technical details: The encryption used by KeePass is not broken as of today. Brute-Forcing the AES-256 key is infeasible. Assuming your password has more than about 80 bits of entropy the millions of key derivation rounds render brute-forcing the password infeasible, too. The entropy of your ...


9

For hash functions (like SHA-1) being used to sign SSL certificates, the security is completely undermined if you have successful collision attacks. Due to the birthday paradox, a N-bit hash function effectively provides about N/2 bits of security against collision attacks. That is a brute-forcer can create collisions for a N-bit hash function after ...


8

Main answer In summary, you are completely right with your first assumption: It is probably more good practice to not show any hint of the password. There are a few issues with the rest of your question though: You do not want to encrypt passwords. Usually, that is, at least. schroeder rightfully asks in the comments Side question: why are ...


8

No, because the key is secret. The "block cipher encryption" block in the diagram scrambles the data depending on the key. The XOR in the diagram does not provide the security, the encryption does. The XOR and the IV are just to make sure the same plaintext encrypts as different ciphertext for each block.


5

All modern encryption methods (AES, blowfish etc.) are designed to be much more secure than you seem to expect. Let us quickly look at some attacks which such ciphers are designed to be resistant against. Known plain text attack - In this case we assume the attacker has access to many plain text blocks along with corresponding cipher text blocks encrypted ...


5

AES is a symmetric encryption algorithm. SHA-1 is a hashing function. They are completely different beasts. The issue is not the number of bits but the functions themselves. As an example you can take MD5. It also has 128 bits, yet creating two colliding strings is now trivial. The issue is not being able to bruteforce the 128-bit possibilities, but ...


4

Explanations of AES start with bits because that's what AES, and more general encryption, does: it processes data which is a sequence of bits. We human beings have been representing information with another mechanism for more than 5000 years, with "glyphs", now often called "characters" (these two terms designate slightly different concepts but let's not ...


3

This is actually a quite tricky problem with no perfect solution. If the file system was one were data is written only once and written entirely sequential, a single CBC encryption all the way from the start of the media to the end would be suitable. You can do random access decryption of CBC, you just need to read one additional cipher block. This could ...


3

The IV has the same security requirements as the encrypted blocks. For CBC to work, you need to XOR the unencrypted data in the current block with the encrypted data from the previous block. Because there is no block before the first block (so no encrypted block can be obtained) an IV is used instead.


3

What you call Push Notifications (the ones you see in your notification center) are not exactly the same thing as Remote Notifications (the ones sent via APNs). On Android the two are totally different. First one is called Notification, the second one is called Message or Downstream Message. But back on iOS the application can generate Local ...


2

DPAPI stores protected data encrypted with the user's DPAPI key, which is in turn encrypted with a derivative (via PBKDF2) of the NTLM password. Furthermore, the DPAPI-related key information is stored in a protected memory region within the security subsystem (LSA), making it particularly difficult to compromise the master keys outside of an administrative ...


1

I realize the post is from 2013, but I happened upon this post when researching a patch for the latest openSSL vulnerability announced 3 May 2016 (Info - https://www.openssl.org/news/secadv/20160503.txt). The recommended patch is TLS1.2+AES-GCM cipher suite. The latest browser on the latest OS should have support for AES-GCM at this point. If you'd still ...


1

Another big problem here is that such a device is not temper-proof. Anyone with physical access to the device can bypass your code and read any secret directly. A determined hacker can also try to reprogram the device (if you leave the capability open) and achive the same as above. I wonder what's the value in reinventing the wheel instead of using ...



Only top voted, non community-wiki answers of a minimum length are eligible