Tag Info

New answers tagged

6

No, this is not secure. The HMAC check is vulnerable to timing attacks. Since the author uses a standard string comparison, the check stops as soon as one character from the provided HMAC doesn't match the corresponding character from the expected HMAC. So the longer the common prefix, the longer the check takes. By carefully observing those time ...


1

The Pixelfck/SymmetricEncryption class seems to hit everything I would look for in a mcrypt abstraction system. It is using derived keys using what looks to be a standard algorithm (PBKDF2), employes AES128 in CFB mode, and uses a hash_hmac of SHA256. I would say it is reasonable to expect this class provides Authenticated Encryption and doesn't appear to ...



Top 50 recent answers are included