3 ms·

Hello, I created some time ago http://secretdiary.org/ http://secretdiary.org/ [now deleted]. It was basically the same idea but implemented server-side since t

Hello, I created some time ago http://secretdiary.org/ http://secretdiary.org/ [now deleted]. It was basically the same idea but implemented server-side since that was what I wanted to learn at the moment, using the encryption MCRYPT_RIJNDAEL_256 from PHP [1] I think that the double encryption is not needed, but since I am not an expert (just an enthusiast) I dig in the past about it and the experts and enthusiasts say the same [2][3] I just re-bought the name so that no one could buy it when I made it public. If you want it, I have no problem in giving it for free since it reminds me a lot to my project and I think the name could be more suitable and you are indeed much more advanced that my project ever was and actively developing it (: [1] https://github.com/FranciscoP/secretdiary https://github.com/FranciscoP/secretdiary [2] http://security.stackexchange.com/a/32260/9161 http://security.stackexchange.com/a/32260/9161 [3] http://www.reddit.com/r/crypto/comments/1nhi4m/why_encrypting_twice_is_not_much_better/ http://www.reddit.com/r/crypto/comments/1nhi4m/why_encryptin...

some_furry 12y ago
> MCRYPT_RIJNDAEL_256 I hope you realize this isn't AES-256. I strongly encourage you and anyone else who wants to play with encryption in PHP to just use https://github.com/defuse/php-encryption https://github.com/defuse/php-encryption Also, encryption isn't authentication. You'll probably quickly hear about Moxie Marlinspike's Cryptographic Doom Principle from others. Basically it means that you should be authenticating your ciphertexts. Welcome to crypto, a lot can go wrong and some people have very strong opinions about it. I highly recommend taking the time to go through the challenges on cryptopals.com (by the fine folks at Matasano) and learn more about it. :) EDIT: https://github.com/FranciscoP/secretdiary/blob/d5a04a7053597a3d2df0d116efbddd3577aa07af/class.cipher.php#L11 https://github.com/FranciscoP/secretdiary/blob/d5a04a7053597... In your library, you're using ECB mode, with an IV, and not MACing anything...
- franciscop 12y ago
  It was one of my first projects and the first time I did anything with cryptography. I expected it to have some security holes but discontinued it for lack of time, I was just offering the domain here (;
  - some_furry 12y ago
    Understood. If you're interested in learning more about crypto I encourage you to check cryptopals out :)
- franciscop 12y ago
  It was one of my first projects and the first time I did anything with cryptography. I expected it to have some security holes but discontinued it for lack of time, I was just offering the domain here (;

some_furry 12y ago

> MCRYPT_RIJNDAEL_256 I hope you realize this isn't AES-256. I strongly encourage you and anyone else who wants to play with encryption in PHP to just use https://github.com/defuse/php-encryption https://github.com/defuse/php-encryption Also, encryption isn't authentication. You'll probably quickly hear about Moxie Marlinspike's Cryptographic Doom Principle from others. Basically it means that you should be authenticating your ciphertexts. Welcome to crypto, a lot can go wrong and some people have very strong opinions about it. I highly recommend taking the time to go through the challenges on cryptopals.com (by the fine folks at Matasano) and learn more about it. :) EDIT: https://github.com/FranciscoP/secretdiary/blob/d5a04a7053597a3d2df0d116efbddd3577aa07af/class.cipher.php#L11 https://github.com/FranciscoP/secretdiary/blob/d5a04a7053597... In your library, you're using ECB mode, with an IV, and not MACing anything...

franciscop 12y ago
It was one of my first projects and the first time I did anything with cryptography. I expected it to have some security holes but discontinued it for lack of time, I was just offering the domain here (;
- some_furry 12y ago
  Understood. If you're interested in learning more about crypto I encourage you to check cryptopals out :)
franciscop 12y ago
It was one of my first projects and the first time I did anything with cryptography. I expected it to have some security holes but discontinued it for lack of time, I was just offering the domain here (;