Re:CrypTweet: Strong Encryption for Twitter DMs
by ctz on Monday February 20, 2012 @02:40AM
(#3611666)
- Website contains no details of the cryptography.
- Stores private key by: a) SHA384-ing your passphrase, and choosing a sub-sequence of the output depending on one bit of the output (this is poor for brute-force resistance compared to PB-KDF2), b) DES3 in CBC mode with a fixed IV and PKCS5 padding (insecure for CCA2 and providing no authenticity. This is vulnerable to recovery using the padding oracle attack).
- Messages are encrypted with RSA-PKCS1.5 in signing mode (in other words, RSASSA-PKCS1-v1_5, not RSAES-PKCS1-v1_5). That means messages are trivially recoverable through KPA.
So: don't use this for anything other than a toy. The crypto is misdesigned.
- Stores private key by: a) SHA384-ing your passphrase, and choosing a sub-sequence of the output depending on one bit of the output (this is poor for brute-force resistance compared to PB-KDF2), b) DES3 in CBC mode with a fixed IV and PKCS5 padding (insecure for CCA2 and providing no authenticity. This is vulnerable to recovery using the padding oracle attack).
- Messages are encrypted with RSA-PKCS1.5 in signing mode (in other words, RSASSA-PKCS1-v1_5, not RSAES-PKCS1-v1_5). That means messages are trivially recoverable through KPA.
So: don't use this for anything other than a toy. The crypto is misdesigned.