lkml.org 
[lkml]   [1996]   [Aug]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: DES AND IDEA IN THE KERNEL _VERY_ BROKEN!
Date
-----BEGIN PGP SIGNED MESSAGE-----

In article <9607211110.AA22096@nyx.net>, Colin Plumb <colin@nyx.net> wrote:
>I'd like to remind folks that a cenreal tenet in cryptography is that
>you don't want to encrypt two messages with the same key *and IV*.
>It cauese information leakage. The leakage is low enough that if it
>happens by accident, there's no great cause for alarm, but you shouldn't
>do it in a regular basis.
>
>And if you use an encrypted device on a machine which someone else
>can read the hard drive of, then over time, as you modify the
>drive, if the IV you use for encrypting each block depends only
>on the block number, you are creating messages (each subsequent
>version of the block) which are encrypted with the same key and IV.
>Lots of them.
>
>Now, OFB and counter mode are *particularly* bad, as you can XOR
>two versions of a block together and recover the XOR of the
>plaintexts. Generally a bad idea. CFB mode has problems,
>but even CFB mode reveals the location of an alteration.
>
>The hack used in Peter Gutmann's MS-DOS SFS device driver of
>using a checksum of the plaintext (and the block offset, and
>some per-volume unique information) is advisable.

But how do you _read_ the block if the IV you need to decrypt it is based
on the plaintext? (Unless there's some checksum that remains invariant
under encryption, which seems unlikely...)

- Ian

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMgIds0ZRiTErSPb1AQGRlAP/fV4VDdF2I+ylbOE0TToZCCIQb49MfkhV
y3k89VtsnyP5d4wxLG7R+u4uGmOFJ9dl4oc9ZaaKh+/elzBaLOs14QG7kwaOBGmq
AsTtopXGN4an+1JVj7p/yZkqDhPbLS6Oy0W0u/c22ajoLbL7ZhOu35t3zwfDcmiN
l4eWDIzoIyw=
=80cA
-----END PGP SIGNATURE-----


\
 
 \ /
  Last update: 2005-03-22 13:37    [W:0.039 / U:0.016 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site