Re: [Encfs-users] Security Audit

2014-02-27 Thread Ben RUBSON
2014-02-27 16:30 GMT+01:00 Taylor Hornby : > On 02/23/2014 10:43 AM, Ben RUBSON wrote: > >> > So, a solution could to use a block instead of a stream for the last > (partial) data block. > >> > The last partial block could be padded with random bytes, zeros… > >> > I don’t know wether number of bl

Re: [Encfs-users] Security Audit

2014-02-27 Thread Taylor Hornby
On 02/23/2014 10:43 AM, Ben RUBSON wrote: Issues 2.2 and 2.3, as well as reference [2] could be solved by using >>> random bytes. >>> How can this feature be enabled ? >>> >> >>> >> Random bytes won't solve reference [2] because the same amount of random >>> >> bytes (proportionally

Re: [Encfs-users] Security Audit

2014-02-23 Thread Ben RUBSON
>>> Issues 2.2 and 2.3, as well as reference [2] could be solved by using >>> random bytes. >>> How can this feature be enabled ? >> >> Random bytes won't solve reference [2] because the same amount of random >> bytes (proportionally) will be added to each file, so you can still >> figure out the

Re: [Encfs-users] Security Audit

2014-01-18 Thread Ben RUBSON
>> Issues 2.2 and 2.3, as well as reference [2] could be solved by using >> random bytes. >> How can this feature be enabled ? > > Random bytes won't solve reference [2] because the same amount of random > bytes (proportionally) will be added to each file, so you can still > figure out the relativ

Re: [Encfs-users] Security Audit

2014-01-16 Thread Taylor Hornby
On 01/16/2014 04:32 AM, Ben RUBSON wrote: > Issues 2.2 and 2.3, as well as reference [2] could be solved by using > random bytes. > How can this feature be enabled ? Random bytes won't solve reference [2] because the same amount of random bytes (proportionally) will be added to each file, so you

Re: [Encfs-users] Security Audit

2014-01-16 Thread Ben RUBSON
Hello Taylor, Thank you very much for this great analysis ! Issues 2.2 and 2.3, as well as reference [2] could be solved by using random bytes. How can this feature be enabled ? You say that as it is now, EncFS is not suitable for protecting mission-critical data. Then, just for information, wha

[Encfs-users] Security Audit

2014-01-15 Thread Taylor Hornby
Hi Valient and EncFS users, I have been hired to security audit EncFS. The first 10 hours of this audit are complete, and I've attached my first report below. Some problems have been found. Full disclosure is the best approach to disclosing crypto bugs, since they "go back in time" even after the