2 ms·
It seems you have an authentication problem: https://www.grc.com/sn/SN-497-Notes.pdf https://www.grc.com/sn/SN-497-Notes.pdf There should be more details here
by higherpurpose 12y ago
It seems you have an authentication problem:
https://www.grc.com/sn/SN-497-Notes.pdf https://www.grc.com/sn/SN-497-Notes.pdf
There should be more details here after the show will be recorded (live now): http://twit.tv/show/security-now/497 http://twit.tv/show/security-now/497
I think using ChaCha20-Poly1305 instead of AES-CBC would solve that problem.
https://www.imperialviolet.org/2013/10/07/chacha20.html https://www.imperialviolet.org/2013/10/07/chacha20.html
- jjarmoc 12y agoI don't know that I'd necessary push for ChaCha20, but lack of ciphertext authentication is a clear problem. AES-GCM or even AES-CBC with an HMAC that's validated prior to decryption can provide the needed authenticity checks.