On Mar 21, 2007, at 2:08 PM, S. Robert James wrote:
> > On Mar 21, 2:44 pm, Brad Ediger <[EMAIL PROTECTED]> wrote: >> I thought about the integrity issue, but wouldn't it be sufficient to >> just prepend a known string to the data and verify it on thaw? > > Not always. This is getting into very difficult crypto. Basically, > depending on the cipher, there may be cases where you can change one > part of the text without changing the other. > > WEP tried to do the trick you're talking about - for performance - and > got nailed. There's no reason to open up a can of worms like this. > If you want integrity, you need a good HMAC. I fold. :-) There's no easy and elegant way to fix this other than to clarify the assumption. --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "Ruby on Rails: Core" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/rubyonrails-core?hl=en -~----------~----~----~----~------~----~------~--~---
