4 ms·
In a class we had to reverse-engineer an application that had encrypted some text file — we had to decrypt it without the key. Turned out the application just u
by tomsmeding 2y ago
In a class we had to reverse-engineer an application that had encrypted some text file — we had to decrypt it without the key. Turned out the application just used the current unix timestamp as the key. A brute-force search of the past few months didn't take very long.
If you include nanoseconds in your key then you have more entropy, of course, but timestamps are guessable, so it's risky.
- sverhagen 2y agoThose nanoseconds aren't really entropy then, are they?
- lmm 2y agoThey're entropy for most practical purposes. But there's only 1000 possibilities, so that's less than 10 bits' worth.
- boothby 2y agoEspecially if you're writing a file, the creation time is a big hint! Even nanoseconds won't help if you're leaking that many bits from your seed.
- tomsmeding 2y agoThat's milliseconds; nanoseconds are 1e-9 seconds. Still, the file creation time remark of sibling is pertinent.
- lmm 2y agoI was thinking of the step from milli to nano, so yeah 1e6 not 1e3, 20 bits not 10. But the point stands.