Tag Info

New answers tagged

0

This approach works, if you derive the session key in a secure manner (using a cryptographic hash function or some construction built on a cryptographic hash function). As only the two parties know the key, only the two parties will know subsequent keys. It may even be possible to omit the the synced random number generator and just use some session ...


1

When a Director sends an Agent with id (A) on a mission, he generates a timestamp (B) and an HMAC of A and B (C), using his secret key. He gives B, and C to the Agent. C becomes the secret key of the Agent. When an Agent sends a message, he calculates an HMAC of it (D) using C and includes it in the message. He also includes A and B. C is of course secret ...


3

Since this doesn't seem to have been done yet, I am going to suggest an answer from a purely information theoretical point of view: Let X, Y be two random variables in {0,1}^n. Let f(x,y) = x XOR y Now, H(X,Y) = H(X)+H(Y|X) = H(Y)+H(X|Y), and since the information entropy is always nonnegative, we have H(X,Y)>=H(X) and H(X,Y)>=H(Y). So the join random ...


1

It is quite possible to create a stronger RNG using the suggested method, however it is also possible to create a weaker RNG, or one that does not improve. The end result depends on the properties of the weaker RNGs. Bit distribution and bias has just as much effect as the entropy level. Only careful analysis and knowledge of the entire scheme can tell if ...


1

The quick but overly vague answer to your original question is: Yes. However, as most people have indicated: more secure != secure. The purpose behind RNGs/PRNGs is to produce sufficient entropy to make it infeasible for an attacker to guess enough information to recover sufficient protected data. Most sources of entropy are tested to determine whether ...


3

This probably sounds like snark, but your solution only improves the situation if the two PRNGs are themselves chosen with sufficient randomness. Think of the reason that we consider a weak PRNG to be insecure: the result is statistically easy to guess some/all of, resulting in crypto and other operations that can be attacked by knowing part of the input ...


1

Unless one is perfectly random, the end results is unclear. But if one were perfectly random, it would not be weak any more. Edit: Unless you're sure the two are completely independent of each other, the benefits may be unclear.


0

Let me make sure I understand. Your user will run a local application that is capable of decrypting your encrypted file and of storing it (or parts of it) in memory in a readable format. Your adversary is the user; the user is assumed to want to hijack those permissions stored in the encrypted file. I also assume the user is root on that machine so she can ...



Top 50 recent answers are included