4 ms·
@all: thanks a lot for your feedback! It's good to see that so many people care about security. To quickly summarize your questions: We are using the secure CBC
by licobo 12y ago
@all: thanks a lot for your feedback! It's good to see that so many people care about security. To quickly summarize your questions: We are using the secure CBC mode and have always used it ;) You can have a look on the source code directly on the website (because it's all client side JavaScript), but some parts of it are minified. We are working on a detailed description of the technology behind InstantCryptor and will publish it soon via Twitter (@cloudrail). If you are interested in the technology to easily add cloud storage into your application visit cloudrail.com to get a free copy.
- jjarmoc 12y agoCBC mode is not inherently secure. Details matter and can often introduce catastrophic problems.
- higherpurpose 12y agoIt seems you have an authentication problem: https://www.grc.com/sn/SN-497-Notes.pdf https://www.grc.com/sn/SN-497-Notes.pdf There should be more details here after the show will be recorded (live now): http://twit.tv/show/security-now/497 http://twit.tv/show/security-now/497 I think using ChaCha20-Poly1305 instead of AES-CBC would solve that problem. https://www.imperialviolet.org/2013/10/07/chacha20.html https://www.imperialviolet.org/2013/10/07/chacha20.html
- jjarmoc 12y agoI don't know that I'd necessary push for ChaCha20, but lack of ciphertext authentication is a clear problem. AES-GCM or even AES-CBC with an HMAC that's validated prior to decryption can provide the needed authenticity checks.