5 ms·
Thanks, Thomas. I just finished implementing my own crypto in a webapp I am working on. (AES, with Diffie Hellman for a shared secret we needed) You've made me
by jameskpolk 17y ago
Thanks, Thomas. I just finished implementing my own crypto in a webapp I am working on. (AES, with Diffie Hellman for a shared secret we needed)
You've made me so nervous about everything I thought was true that I did a hg revert and am looking at gpgme bindings.
You've done a good deed, I think.
- tptacek 17y agoDiffie Hellman is also remarkably easy to screw up. Here's an old post of mine I don't think ever made it on to Hacker News: http://www.matasano.com/log/962/adam-bozanovich-did-not-uncover-an-nsa-ipsec-conspiracy-diffie-hellman-parameter-validation-explained/ http://www.matasano.com/log/962/adam-bozanovich-did-not-unco...
- three14 17y agoOff topic of the main thread, but isn't the attack mentioned in that post still problematic if you can't reliably act as a MITM for a whole session, but you can disrupt the session long enough to confuse both sides into agreeing on an insecure session key?
- tptacek 17y agoIf you can manipulate a DH exchange, you definitely have bigger problems than forgetting to check DH parameters. It's worth noting that DH is one of those crypto building blocks that by itself provides basically no security (for instance, DH in SSL/TLS is secure because it's backed by an RSA trust anchor). It's just a tool for making other crypto primitives more flexible.
- three14 17y agoAgreed. Still, I can't decipher the IKE spec, but does it really prevent this - i.e. do any of the other building blocks actually prevent the conversation from continuing using a compromised shared key?