138 reputation
4
bio website leidegren.se
location Sweden
age 29
visits member for 1 year, 6 months
seen May 12 at 11:21

Nothing is true everything is permitted. This is the creed that every programmer lives by.

Best practices be damned.


Apr
11
answered Is leaking the hash of your encryption key a security risk?
Apr
8
awarded  Scholar
Apr
8
accepted Is leaking the hash of your encryption key a security risk?
Apr
8
comment Is leaking the hash of your encryption key a security risk?
I will carefully consider incorporating an MAC (which I currently haven't thought about) and you are dead on, I foresee a small set of keys to ever be circulated at any given moment and even if this is not the case there are other things I could do to optimize successful key usage.
Apr
8
comment Is leaking the hash of your encryption key a security risk?
The only reservation I had was to keep it simple, and with that I was even willing to sacrifice some security in order to make it hard, not impossible to peer into the encrypted message. It's not necessarily even a hard requirement to wholly protect the message from an attack as such, just to make it reasonable difficult and reasonable practical to use. Actually, it would be sufficient for it to just be a sound approach, which would be an improvement of what I have today. BTW, I'm fully aware of just how deep the water is...
Apr
8
comment Is leaking the hash of your encryption key a security risk?
@TomMarthenal that could work. Didn't think of it that way, was too caught up with idea of RSA being a handshake thing. Which clearly it does not have to be.
Apr
8
awarded  Supporter
Apr
8
comment Is leaking the hash of your encryption key a security risk?
SHA-1 will be supported as a weaker alternative and in this case we truncate the key as well, simply finding a collision won't mean you've found the encryption key but it's a good guess. Anyway, it's leaking a lot of information about the actual key used... and I guess that's the real issue.
Apr
8
comment Is leaking the hash of your encryption key a security risk?
@kinunt As the message is passed forward, it might travel through nodes that knows nothing about the encryption key used and they are supposed to simply forward the message further up the food chain. I guess it's less than ideal but that's why I'm bound to some sort of key identification rather than key exchange. Also, the symmetric key might have a rather long life-span.
Apr
8
comment Is leaking the hash of your encryption key a security risk?
@kinunt You are right, I could definitely use a RSA like approach but what I haven't told you is that the message in this case is not being sent over a traditionally channel that allows back and forth communication, it is strictly one way, sender to receiver. It is not necessarily the case than I can relay any information back to the original sender as the message might pass through several intermediates that I do not have any control over and I don't think it's possible to use asymmetric encryption without some back and forth.
Apr
8
awarded  Student
Apr
8
asked Is leaking the hash of your encryption key a security risk?
Apr
8
awarded  Autobiographer