The construction of the cipher doesn't solve the biggest problem with using these stream ciphers, re-use of the IV.
The construction of the cipher doesn't solve the biggest problem with using these stream ciphers, re-use of the IV. Depending on your architecture it is very hard to guarantee that you'll never re-use an {IV, Key} pair. Encrypting results in P xor S xor T xor A (where P is plaintext, S is Salsa, T is Twofish, A is AES (or rather, the key streams produced by each cipher)). If two different plaintexts were encrypted with the same IV and key pair then I can xor these two cipher texts together: (P1 xor S xor T xor A) xor (P2 xor S xor T xor A) -> P1 xor P2 And I've now removed all of the crypto. AES-SIV aims to solve this problem, but is slower than something like AES-GCM because it needs to process the plaintext twice. Obviously, it is much faster than the scheme proposed here and removes the biggest implementation flaw in nonce-based stream ciphers. Another pitfall here is that encryption == decryption (modulo the HMAC step) which means that if I have an encryption oracle that I can feed {IV, Key} that automatically becomes a decryption oracle. (The YubiHSM I believe was vulnerable to an attack like this, so they do happen in the real world)
Posted by axoltl on Jun 4, 2015, 12:19 AM
Tags
Related issues
- To be fair, Inform7 can't succeed, generally, because there is no market for the kind of games that you create with Inform7.
- > The notion that somehow LR reliability is misunderstood by Consumer Reports, JD Power, Car & Driver, Automobile etc.
- Custom trigger IDs are not displayed in the new 2026.10 trigger selector
- I hate that too, but I think it’s more the ux than the concept of a default.
- > The biggest problem with UX developers is they know better than you AND force you into their paradigm.
- "Focus follows mouse" is what I use to keep the file manager from popping up when click-dragging files.
Raise real-world problems, find people facing the same issue, and discuss solutions.6,000 issues0 comments
ux (Other)
To be fair, Inform7 can't succeed, generally, because there is no market for the kind of games that you create with Inform7.
> The notion that somehow LR reliability is misunderstood by Consumer Reports, JD Power, Car & Driver, Automobile etc.
Custom trigger IDs are not displayed in the new 2026.10 trigger selector
I hate that too, but I think it’s more the ux than the concept of a default.
> The biggest problem with UX developers is they know better than you AND force you into their paradigm.
"Focus follows mouse" is what I use to keep the file manager from popping up when click-dragging files.
The biggest problem with this is if the target URL doesn't load but also doesn't quickly error out, like e.g.
Google wants to build up a private web here.
The construction of the cipher doesn't solve the biggest problem with using these stream ciphers, re-use of the IV.
The construction of the cipher doesn't solve the biggest problem with using these stream ciphers, re-use of the IV. Depending on your architecture it is very hard to guarantee that you'll never re-use an {IV, Key} pair. Encrypting results in P xor S xor T xor A (where P is plaintext, S is Salsa, T is Twofish, A is AES (or rather, the key streams produced by each cipher)). If two different plaintexts were encrypted with the same IV and key pair then I can xor these two cipher texts together: (P1 xor S xor T xor A) xor (P2 xor S xor T xor A) -> P1 xor P2 And I've now removed all of the crypto. AES-SIV aims to solve this problem, but is slower than something like AES-GCM because it needs to process the plaintext twice. Obviously, it is much faster than the scheme proposed here and removes the biggest implementation flaw in nonce-based stream ciphers. Another pitfall here is that encryption == decryption (modulo the HMAC step) which means that if I have an encryption oracle that I can feed {IV, Key} that automatically becomes a decryption oracle. (The YubiHSM I believe was vulnerable to an attack like this, so they do happen in the real world)
Comments (0)
No comments yet. Start the discussion.