4 ms·
Is the argument whether using either of the proposed IV generation modes is wrong or if it was do to NSA tampering? It certainly is wrong to do so (and should
by anologwintermut 13y ago
Is the argument whether using either of the proposed IV generation modes is wrong or if it was do to NSA tampering? It certainly is wrong to do so (and should have been known to be wrong by the time of Rogaway's comment).
- tptacek 13y agoI don't believe it was broadly known to be wrong during IPSEC standardization.
- anologwintermut 13y agoIs that true for the LFSR proposal?I thought LFSRs were basically never thought to be cryptographically secure.
- tptacek 13y agoI don't know the specific proposal, but I know how CBC designs with LFSR-generated IVs work, and why you'd want a deterministic generator for your IVs, and it's because it allows both sides to agree on a non-repeating progression of IVs without actually sending the extra block on every message. LFSRs are also sometimes used in counter mode, too. Again: obviously, a simple LFSR isn't cryptographically secure, and anyone who would deploy one in a cryptosystem probably already knows that. The question is: how are you mounting the attack you're talking about?
- anologwintermut 13y agoDo you know of protocols that use LFSRs for IV generations of cryptographic purposes? Can you link to them ? I'd like to see if they are breakable.
- tptacek 13y agoI've got nothing I can cite to you; it's also true that a lot of bespoke crypto enjoys a lack of usable attacker chosen plaintext, which is admittedly not a good property to rely on for a standard.