News for hackers. Stuff that matters.

A comment on Encryption is less secure than we thought. Parent comment

Re:Encryption is less secure than we thought by rmidthun on Wednesday August 14, 2013 @02:05PM (#6213160)
Obvious? Didn't that word already cause enough trouble?

What are you going to pad it with? Random values? In that case, I'll just make two requests for the same information and clip it where they differ. Some sort of value based on the message? That also has issues, see link below. So far it doesn't seem like there are any obvious crypto ideas that are not also wrong.

http://en.wikipedia.org/wiki/Padding_oracle_attack

[ Parent | on HN ]
Re:Encryption is less secure than we thought by nknighthb on Wednesday August 14, 2013 @09:48PM (#6215679)
> I'll just make two requests for the same information and clip it where they differ.

So, byte 0? You're not really using ECB, are you?

[ Parent | on HN ]
Re:Encryption is less secure than we thought by rmidthun on Thursday August 15, 2013 @01:32PM (#6219381)
D'oh. Good point.

At least I can point to it as another example of someone not expert in the field making a stupid statement about crypto...

I think the general problem of padding with random values resulting in non-determinism would still matter in some cases, but IANAC.

[ Parent | on HN ]