Re: Rijndael/AES implementations

From: Michel Gallant (neutron_at_NOSPAMistar.ca)
Date: 03/18/04 

Date: Thu, 18 Mar 2004 15:52:27 -0500

Pieter, thanks for the insightful response.
I think the reason WinZip did not include the asymmetric key protection
option was, well most people understand how to enter a password, but
not many know anything about a certificate or, horrors, that 3 letter work PKI :-(

Anyone else with comments?

- Mitch

"Pieter Philippaerts" <Pieter@nospam.mentalis.org> wrote in message
news:eOoHzBQDEHA.2424@TK2MSFTNGP09.phx.gbl...
> "Michel Gallant" <neutron@NOSPAMistar.ca> wrote in message
> > (1) Are there significant performance/implementation differences in the
> native versus
> > the managed version that developers or security-conscious folks should
> know about?
>
> Yes, there are a few differences you should be aware of. First of all, the
> AES CSP is little-endian [like all the other CSPs] and the RijndaelManaged
> class is big-endian. So make sure you reverse your key bytes when passing
> keys between the two. Also keep in mind that the AES CSP only implements a
> block size of 128bit because the AES standard only specifies this block
> size. The RijndaelManaged class implements block sizes of 128, 192 and 256
> bit.
> As far as performance is concerned, I've seen 7x speed-ups when using the
> CSP over the managed implementation, so yes, there's definitely a
> performance difference between the two.
>
> > (2) Considering that Rijndael has not had the benefit of the longer "soak"
> time other symmetric
> > ciphers like 3DES have had, are most security analysts satisfied based on
> best current knowledge
> > of Rijndael to recommend going ahead with architecture using Rijndael for
> business purposes?
>
> Actually, Rijndael already has more credibility than 3DES. Not only because
> you can use a much larger key, but also [and perhaps mainly] because the NSA
> recently approved the use of the AES to encrypt confidential and secret
> messages. 3DES has only been approved to encrypt non-confidential messages.
> This clearly shows that the NSA has a lot of confidence in the algorithm.
>
> > (3) WinZip 9 supports AES encryption via using B. Gladman's open source
> implementation of
> > AES:
> > http://www.winzip.com/aes_info.htm
> > Any views of this implementation in WinZip?
>
> Apparently WinZip used the code of a security researcher, so this is already
> a good sign. They also have a FIPS certification for their implementation.
> The only major problem with it is that it uses password based key
> generation. It's too bad they didn't implement some mechanism where the user
> could choose between password-based key generation or asymmetric key
> encryption.
>
> Regards,
> Pieter Philippaerts
> Managed SSL/TLS: http://mentalis.org/go.php?sl
>
>

Relevant Pages

  • Re: JumpDrive security?
    ... It sounds like you did not password protect (encrypt) the file. ... Dave ... |> WinZIP v9.0 and encrypt the files/folders. ...
    (alt.computer.security)
  • Re: How to generate a self extracting exe with password
    ... password and decrypts the file encrypted. ... A zip utility doesn't "encrypt" the password or the data. ... I believe that you'll need this this utility (along with WinZip): ... WinZip Self-Extractor is not an enhanced version of WinZip. ...
    (microsoft.public.scripting.vbscript)
  • Re: Password on a file
    ... If you are really concerned about secure file transmission look at ... winzip passwords which is a fairly trivial process. ... > secure means and the receiver would also have to have winzip or some other ... > packages to encrypt the file and then send that. ...
    (microsoft.public.security)
  • Re: JumpDrive security?
    ... Dave ... I talked to WinZip & they said it is normal for it to do ... |> It sounds like you did not password protect (encrypt) the file. ...
    (alt.computer.security)