lkml.org 
[lkml]   [1998]   [Nov]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: kerneli blowfish/twofish compromised?
    The code in question restarts the CFB encryption each 512 bytes so that
    the blocks can be independently decrypted. Otherwise you would only be
    able to write the device once, from the beginning. This is not very useful.

    For better security, the IV should not be all-zero, because that reveals
    identical blocks. Instead, it should depend on the block number.

    To improve things even more, it should be a function of the contents of
    the block. See Peter Gutmann's SFS documentation for a description of
    a working technique and a fuller explanation of the reasons why.
    (http://www.cs.auckland.ac.nz/~pgut001/sfs/)

    Basically, it is bad practice to ever use the same key and IV to encrypt two
    different messages. An attacker can see the length of the common prefix
    between thge two messages if you do that.

    The tricky part is that when encrypting a disk, an attacker who has
    repeated access to the encrypted disk can see the changes over time.
    You can't stop this from happening at block boundaries, but you can hide
    the details of how much a block has changed.

    Doing this without explicit storage space for an IV is tricky, since the
    IV has to change whenver the block is changed, so something implicit
    from the block number won't do. It turns out, however, to be possible to
    checksum the plaintext and use that as an IV.
    --
    -Colin

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:45    [W:0.027 / U:0.004 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site