Re:Show HN: 1-FPS encrypted screen sharing for introverts
by hatsunearu on Tuesday August 06, 2024 @07:50PM
(#41176769)
Is the statement just that if you use a random value for a nonce rather than some guaranteed never-used-once value, it's possible to get a collision faster than the "natural" block collision complexity (half block size or something like that)?
Re:Show HN: 1-FPS encrypted screen sharing for introverts
by conradludgate on Wednesday August 07, 2024 @03:25AM
(#41179008)
It's a birthday attack principle. With only 96bits after roughly a billion messages with the key and random IVs, you start reaching realistic probabilities that you will reuse an IV
Re:Show HN: 1-FPS encrypted screen sharing for introverts
by irundebian on Wednesday August 07, 2024 @08:35AM
(#41180734)
And how you will get a billion messages with 1 frame per second?
Background: the key+IV define a keystream which is xor-ed against the message. The same key+IV generate the same keystream. Thus you can XOR two cipher texts and reveal information from the two plaintext.
AES-GCM is authenticated encryption. To combat known-ciphertext-attacks, you want to have authenticated cipher texts. AES-GCM specifically is vulnerable to an attack with a reused IV to recover the authentication key. Allowing you to forge authentication tags and employ a KCA.
The solution, if you're stuck with aes, is to switch to XAES-GCM or better AES-GCM-SIV. Alternatively you must use a counter or checkes system to not reuse IV. Since this is in the context of 1fps, you could use unix timestamp + random bytes to reduce the chance of collisions.