3 ms·

I'm not security expert, but isn't this: "128-bit client-side Rabbit encryption" obsolete practice? Doesn't mega use 2048? This is kind of big deal. And, of c

I'm not security expert, but isn't this: "128-bit client-side Rabbit encryption" obsolete practice? Doesn't mega use 2048? This is kind of big deal. And, of course, mega interface is a lot more than a simple "cryptolink" service. I actually feel that if mega will come up with good APIs (as well as with a client for dummies), and nobody will raid Kim for a second time, dropbox and alikes are gonna have bad times.

chmars 14y ago
Aren't you comparing apples and oranges? More bits don't equal better encryption … In the case of Mega, the claim of 'military-grade encryption' sounds too much of snake oil as I would want to try the service. Kim Schmitz' past isn't a reason to trust him either.
- STRML 14y ago
  In addition, 128-bit encryption is more than safe. In order to brute force it (and you will have to, there are no known vulnerabilities in Rabbit), you need to try up to 3.410^38 keys. The fastest supercomputers in the world would take about 1.0210^18 years to crack 128-bit encryption. See more on this topic (article is about AES, but the basics apply): http://www.eetimes.com/design/embedded-internet-design/4372428/How-secure-is-AES-against-brute-force-attacks- http://www.eetimes.com/design/embedded-internet-design/43724...
  - mentat 14y ago
    The basics of a well reviewed cipher do not apply to a random experimental cypher you've chosen instead. Why would you not use AES? It's the best understood cipher in the world right now. "more than safe" just doesn't make sense. Please read all of parent's posts in this thread and do not use their product.
  - nwh 14y ago
    Just because they can't be cracked publicly, doesn't mean that there isn't a way to do it. There could be any number of weaknesses in any algorithm that mean that the computation time can be drastically reduced. WEP is a prime example, which you should probably be familiar with.
saurik 14y ago
Rabbit is a symmetric cypher, and Mega's mention of 2048 is in respect to RSA, an asymmetric cypher. Even if Mega were using RSA to encrypt the entire file (as opposed to an encryption key which is then used to encrypt the file, which I personally find more likely, given the performance constraints and various other limitations of RSA, but maybe they really are doing that: I'm not an expert ;P), 2048-bit RSA is said by RSA themselves to be equivalent to a symmetric cypher with a 112-bit key. > As of 2003 RSA Security claims that 1024-bit RSA keys are equivalent in strength to 80-bit symmetric keys, 2048-bit RSA keys to 112-bit symmetric keys and 3072-bit RSA keys to 128-bit symmetric keys. -- http://en.wikipedia.org/wiki/Key_size http://en.wikipedia.org/wiki/Key_size (Although, this is almost certainly ignoring mathematical attacks, as those would make things highly variable: one could imagine a really lame cypher that doesn't effectively utilize the key, or which leaks the key into the cyphertext. The choice "Rabbit" is thereby important, and Wikipedia mentions that if you want to break a large number of keys, such as for a large number of related files/accounts on a file-storage service, and just need to break any one, a 128-bit key is only about as effective as a 96-bit one.) > Rabbit claims 128-bit security against attackers whose target is one specific key. If, however, the attacker targets a large number of keys at once and does not really care which one he breaks, then the small IV size results in a reduced security level of 96 bit. This is due to generic TMD trade-off attacks. -- http://en.wikipedia.org/wiki/Rabbit_(cipher) http://en.wikipedia.org/wiki/Rabbit_(cipher)
comex 14y ago
As a rule, asymmetric encryption requires more bits than symmetric encryption - RSA-1024 and AES-128 are both standard. I'm not sure what Mega is using asymmetric encryption for, but it doesn't seem to be necessary for this use case; that said, Rabbit is not a commonly used algorithm.

chmars 14y ago

Aren't you comparing apples and oranges? More bits don't equal better encryption … In the case of Mega, the claim of 'military-grade encryption' sounds too much of snake oil as I would want to try the service. Kim Schmitz' past isn't a reason to trust him either.

STRML 14y ago
In addition, 128-bit encryption is more than safe. In order to brute force it (and you will have to, there are no known vulnerabilities in Rabbit), you need to try up to 3.410^38 keys. The fastest supercomputers in the world would take about 1.0210^18 years to crack 128-bit encryption. See more on this topic (article is about AES, but the basics apply): http://www.eetimes.com/design/embedded-internet-design/4372428/How-secure-is-AES-against-brute-force-attacks- http://www.eetimes.com/design/embedded-internet-design/43724...
- mentat 14y ago
  The basics of a well reviewed cipher do not apply to a random experimental cypher you've chosen instead. Why would you not use AES? It's the best understood cipher in the world right now. "more than safe" just doesn't make sense. Please read all of parent's posts in this thread and do not use their product.
- nwh 14y ago
  Just because they can't be cracked publicly, doesn't mean that there isn't a way to do it. There could be any number of weaknesses in any algorithm that mean that the computation time can be drastically reduced. WEP is a prime example, which you should probably be familiar with.

saurik 14y ago

Rabbit is a symmetric cypher, and Mega's mention of 2048 is in respect to RSA, an asymmetric cypher. Even if Mega were using RSA to encrypt the entire file (as opposed to an encryption key which is then used to encrypt the file, which I personally find more likely, given the performance constraints and various other limitations of RSA, but maybe they really are doing that: I'm not an expert ;P), 2048-bit RSA is said by RSA themselves to be equivalent to a symmetric cypher with a 112-bit key. > As of 2003 RSA Security claims that 1024-bit RSA keys are equivalent in strength to 80-bit symmetric keys, 2048-bit RSA keys to 112-bit symmetric keys and 3072-bit RSA keys to 128-bit symmetric keys. -- http://en.wikipedia.org/wiki/Key_size http://en.wikipedia.org/wiki/Key_size (Although, this is almost certainly ignoring mathematical attacks, as those would make things highly variable: one could imagine a really lame cypher that doesn't effectively utilize the key, or which leaks the key into the cyphertext. The choice "Rabbit" is thereby important, and Wikipedia mentions that if you want to break a large number of keys, such as for a large number of related files/accounts on a file-storage service, and just need to break any one, a 128-bit key is only about as effective as a 96-bit one.) > Rabbit claims 128-bit security against attackers whose target is one specific key. If, however, the attacker targets a large number of keys at once and does not really care which one he breaks, then the small IV size results in a reduced security level of 96 bit. This is due to generic TMD trade-off attacks. -- http://en.wikipedia.org/wiki/Rabbit_(cipher) http://en.wikipedia.org/wiki/Rabbit_(cipher)

comex 14y ago

As a rule, asymmetric encryption requires more bits than symmetric encryption - RSA-1024 and AES-128 are both standard. I'm not sure what Mega is using asymmetric encryption for, but it doesn't seem to be necessary for this use case; that said, Rabbit is not a commonly used algorithm.