Michael Sierchio wrote:
>
> Somebody wrote:
>
> > A 128 key is more than enough for the forseeable future. However your
> > original code used a fixed key with RC4. Since RC4 is a stream cipher
> > this is horribly insecure.
> >
> > A stream cipher is effectively a random stream of bytes derived from the
> > key. This is XOR'ed with the data to form the encrypted data or XOR'ed
> > with the encrytpted data to get the original data back. The result of
> > this is that if you know the data and the encrypted data for one record
> > you can recover part of the random stream. You can then decrypt that
> > part of any other record without any knowledge of the key!
>
> This is a VERY flawed exposition of stream ciphers. What precisely
> do you mean by " ... that part of any other record ...?
> " The concept
> of "record" does not apply to stream ciphers -- stream ciphers are
> effective block ciphers run in OFB mode with a block size of 1 octet.
> If you are talking about the case of reusing a single key -- that,
> combined with knowledge of a plaintext/ciphertext pair does directly
> yield a bad result -- so don't reuse keys. Key reuse is a BAD THING(tm)
> in any case.
>
Quite correct, the term record does not apply to stream ciphers. The
term 'record' applies to the context of the original query which was
about storing information independently in a database and the reuse of a
key (from the sample code).
The whole message was in response to a newbie query. As such describing
it as a behaving like block cipher in OFB mode, while accurate, would
not have been appropriate.
Steve.
--
Dr Stephen N. Henson. http://www.drh-consultancy.demon.co.uk/
Personal Email: [EMAIL PROTECTED]
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the OpenSSL project: http://www.openssl.org/
Business Email: [EMAIL PROTECTED] PGP key: via homepage.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
