4 ms·
Is that true for the LFSR proposal?I thought LFSRs were basically never thought to be cryptographically secure.
by anologwintermut 13y ago
Is that true for the LFSR proposal?I thought LFSRs were basically never thought to be cryptographically secure.
- tptacek 13y agoI don't know the specific proposal, but I know how CBC designs with LFSR-generated IVs work, and why you'd want a deterministic generator for your IVs, and it's because it allows both sides to agree on a non-repeating progression of IVs without actually sending the extra block on every message. LFSRs are also sometimes used in counter mode, too. Again: obviously, a simple LFSR isn't cryptographically secure, and anyone who would deploy one in a cryptosystem probably already knows that. The question is: how are you mounting the attack you're talking about?
- anologwintermut 13y agoDo you know of protocols that use LFSRs for IV generations of cryptographic purposes? Can you link to them ? I'd like to see if they are breakable.
- tptacek 13y agoI've got nothing I can cite to you; it's also true that a lot of bespoke crypto enjoys a lack of usable attacker chosen plaintext, which is admittedly not a good property to rely on for a standard.