lkml.org 
[lkml]   [1998]   [Nov]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: kerneli blowfish/twofish compromised?
The code in question restarts the CFB encryption each 512 bytes so that
the blocks can be independently decrypted. Otherwise you would only be
able to write the device once, from the beginning. This is not very useful.

For better security, the IV should not be all-zero, because that reveals
identical blocks. Instead, it should depend on the block number.

To improve things even more, it should be a function of the contents of
the block. See Peter Gutmann's SFS documentation for a description of
a working technique and a fuller explanation of the reasons why.
(http://www.cs.auckland.ac.nz/~pgut001/sfs/)

Basically, it is bad practice to ever use the same key and IV to encrypt two
different messages. An attacker can see the length of the common prefix
between thge two messages if you do that.

The tricky part is that when encrypting a disk, an attacker who has
repeated access to the encrypted disk can see the changes over time.
You can't stop this from happening at block boundaries, but you can hide
the details of how much a block has changed.

Doing this without explicit storage space for an IV is tricky, since the
IV has to change whenver the block is changed, so something implicit
from the block number won't do. It turns out, however, to be possible to
checksum the plaintext and use that as an IV.
--
-Colin

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:45    [W:0.037 / U:0.380 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site