![]() ![]() You also need message authentication, to defend against chosen-ciphertext attacks. ![]() It is tempting to think, gee, I want to keep this secret, so if I encrypt it with a good encryption algorithm, I'll be fine. This is highly counter-intuitive, and a very common mistake. Encrypting data without also authenticating opens you up to subtle but serious attacks. Mistake #2: failure to include message integrity protection. It is better to use a standard format, like GPG or the OpenPGP Message Format. ![]() Usually, designing your own format for storing encrypted data is not a good idea you are likely to get something wrong. Mistake #1: inventing your own encryption format. Here are the main mistakes I can see so far: My main feedback: You don't provide enough technical detail to provide a complete critique of your proposal, but you have provided enough information that I can see that you are making several common mistakes. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |