Re: [9fans] crypto question

["Devon H. O'Dell " <dodell@offmyserver.com>]

[-- Attachment #1: Type: text/plain, Size: 1996 bytes --]

On Tue, Apr 12, 2005 at 12:54:20PM -1000, Tim Newsham wrote:
> Hi,
>   I noticed that the libc function encrypt() uses some non-standard form 
> of cipher chaining.  In the normal case one byte from the previous block 
> is reencrypted with 7 bytes from the new block. Additionally there is no 
> initialization vector used.
> 
> This chaining is not very strong (only slightly better than using ECB 
> mode).  In particular:
> 
>   - common prefixes will encrypt the same way.
>   - large common sequences within the middle or end of the
>     data have a reasonable chance of encrypting the same
>     way (2^-8 chance of rejoining at each encryption boundary).

Indeed, this provides means for so-called `birthday attacks' in
which repeating characters can be guessed which may help an
attacker gain further knowledge of the plaintext or key by 
effectively reducing the effort necessary to brute force (at
least part of) the plaintext.

> These weaknesses could open the way for attacks on the code where 
> encrypt() is used.  I was looking over the p9sk1 authentication and didn't 
> notice any obvious attacks, but I'm not particularly good at cryptography 
> (the fact that the challenge has to be matched in tickets encrypted by two 
> different keys offers some protection against splicing).

Doesn't p9sk1 still use DES? DES was nice, but has several
recognized ways to speed up cryptanalysis of the algorithm. 3DES
is an alternative, but with combinations such as Rijndael-256 in
CBC mode (or indeed, using a strong stream cipher -- Helix looks
neat, but it's still too new, I think), I really don't see why
we should stick with these things.

Of course, we can discuss this all we want, but without code it
remains a bikeshed :)

> Is there any reason this scheme was chosen over more traditional chaining 
> modes?
> 
> Tim Newsham
> http://www.lava.net/~newsham/

Perhaps just due to simplicity of implementation? I dunno :).

--Devon

[-- Attachment #2: Type: application/pgp-signature, Size: 194 bytes --]