Re: Decrypt CipherValue with different DES2 keys getting a correct padding ?

Hello Greg,

thank you for the detailed information.

So the attacker just has to try about 256 random
keys until he gets lucky (note he can check this
on his own).

But I'm not sure that just this last byte is
sufficient for correct padding. If I'm guessing
the padding scheme correctly, he might need it to
finish with "0x81 0x00". That would be 2^16 test
keys, still pretty trivial.


Padding is used as described in ISO/IEC 9797( method 2 ), there has to
be at least 1 byte padding (0x80).

If the messages need some more internal format
(like being readable ascii or something) the
number of keys the attacker has to try goes up,
until eventually he runs out of keys; this attack
is more possible to mount on a cipher with
*longer* keys.


The plain text is as well some cryptographic information, which will
be processed as given. So no further test (eg validation of ASN.1
structures) will be done. Just checking the padding.

Hope this makes some sense.

Yes it does. I was looking for some arguments, to move our customer to
siging the plain data first and the encrypt plain data and signature.
So we do not have to rely on a padding test to check if the decrypted
data is authentic.

Willy

.

Relevant Pages

  • Re: About padding with files in AES
    ... Upon decryption, the decrypting system just needs to look at ... The cyphertext could in a long ... a valid padding. ... added data as a check when only a small number of keys are involved. ...
    (sci.crypt)
  • Re: cSortedDictionary sort mode alphanumeric
    ... 'without padding Total time: 0.797 Seconds ... than just 700 Keys against it. ... Private oDicCounting As cPaddedCounting, oDict As cSortedDictionary ... Private Sub Form_Click ...
    (microsoft.public.vb.general.discussion)
  • Re: AES or Triple DES?
    ... > qualifications. ... > this padding can add up on lots of short messages. ... > My idea is to change keys every XXX messages (XXX to be ...
    (sci.crypt)
  • Re: How to construct variable key length prp from prp
    ... with keys those are bit length variable? ... My naive thought is seperating the key into fixed pieces with padding ... ,and then process the plaintext in a CBC-like way. ...
    (sci.crypt)