Messages in this thread | | | Date | Sun, 22 Nov 1998 00:33:27 -0700 (MST) | From | Colin Plumb <> | Subject | Re: kerneli blowfish/twofish compromised? |
| |
The code in question restarts the CFB encryption each 512 bytes so that the blocks can be independently decrypted. Otherwise you would only be able to write the device once, from the beginning. This is not very useful.
For better security, the IV should not be all-zero, because that reveals identical blocks. Instead, it should depend on the block number.
To improve things even more, it should be a function of the contents of the block. See Peter Gutmann's SFS documentation for a description of a working technique and a fuller explanation of the reasons why. (http://www.cs.auckland.ac.nz/~pgut001/sfs/)
Basically, it is bad practice to ever use the same key and IV to encrypt two different messages. An attacker can see the length of the common prefix between thge two messages if you do that.
The tricky part is that when encrypting a disk, an attacker who has repeated access to the encrypted disk can see the changes over time. You can't stop this from happening at block boundaries, but you can hide the details of how much a block has changed.
Doing this without explicit storage space for an IV is tricky, since the IV has to change whenver the block is changed, so something implicit from the block number won't do. It turns out, however, to be possible to checksum the plaintext and use that as an IV. -- -Colin
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |