3 ms·
I suppose you can make any at rest encryption scheme negotiate (even PGP) if you create such a negotiation system that uses the scheme as a primitive. I was onl
by upofadown 6y ago
I suppose you can make any at rest encryption scheme negotiate (even PGP) if you create such a negotiation system that uses the scheme as a primitive. I was only referring to the way such things are normally used. You make an encrypted file. After that the only way to decrypt it is the way it was encrypted.
- FiloSottile 6y ago> You make an encrypted file. After that the only way to decrypt it is the way it was encrypted. Check out the linked S3 SDK vulnerability, it's precisely about decrypting a file in a different way from how it was encrypted :)
- upofadown 6y agoLooks like an oracle attack against malleable encryption. It does something clever to enhance the effectiveness of that attack but nothing there could reasonably be considered negotiation.
- FiloSottile 6y ago> Title: In-band key negotiation issue in AWS S3 Crypto SDK for golang