5 ms·
We are using CBC as block cipher mode. I totally understand that open sourcing the complete code is the only way for you to review it and trust it completely. W
by licobo 12y ago
We are using CBC as block cipher mode. I totally understand that open sourcing the complete code is the only way for you to review it and trust it completely. We decided to write a detailed report about the encryption and how we use it and will publish the report soon via Twitter.
- licobo 12y agovia @cloudrail
- diafygi 12y ago"We decided to write a detailed report about the encryption and how we use it and will publish the report soon via Twitter." That doesn't sound like releasing the source code...
- tptacek 12y agoCBC mode by itself is insecure.
- sarciszewski 12y agoOP: You should listen to tptacek. He's forgotten more about crypto than some people have ever learned. :)
- netheril96 12y agoHow do you generate the initialization vector? CBC mode requires an unpredictable IV, which usually equals cryptographic random number. > var hash = crc.Crypto.Hash.SHA256.hash(password.value), > crypter = new Crypt.Mode.Licobo(new Crypt.Rijndael256(hash)), From the code I cannot see any generation of IV, so I can only assume that the same IV is used every time. A predictable IV leads to many kinds of attacks. In particular, since the key is generated without salting, this means that a combination of the same key and IV will be used for multiple files, completely defeats the confidentiality. And no integrity protection whatsoever? So vulnerable to bit flipping attacks?