From: Eric Biggers <ebiggers@kernel.org> To: Pascal Van Leeuwen <pvanleeuwen@verimatrix.com> Cc: "linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org> Subject: Re: [RFC PATCH v2] md/dm-crypt - reuse eboiv skcipher for IV generation Date: Fri, 9 Aug 2019 13:56:15 -0700 Message-ID: <20190809205614.GB100971@gmail.com> (raw) In-Reply-To: <MN2PR20MB2973BE617D7BC075BB7BB1ACCAD60@MN2PR20MB2973.namprd20.prod.outlook.com> On Fri, Aug 09, 2019 at 08:29:59PM +0000, Pascal Van Leeuwen wrote: > > > > There's no proof that other attacks don't exist. > > > As you can't prove something doesn't exist ... Of course you can, that's what the security proofs for crypto constructions always do. They prove that no efficient attack exists (in some attack model) unless the underlying crypto primitives are weak. > > > If you're going to advocate > > for using it regardless, then you need to choose a different (weaker) attack > > model, then formally prove that the construction is secure under that model. > > Or show where someone else has done so. > > > I'm certainly NOT advocating the use of this. I was merely pointing out a > legacy use case that happens to be very relevant to people stuck with it, > which therefore should not be dismissed so easily. > And how this legacy use case may have further security implications (like > the tweak encryption being more sensitive than was being assumed, so you > don't want to run that through an insecure implementation). Obviously there are people already using bad crypto, whether this or something else, and they often need to continue to be supported. I'm not disputing that. What I'm disputing is your willingness to argue that it's not really that bad, without a corresponding formal proof which crypto constructions always have. - Eric
next prev parent reply index Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-08-07 5:50 Ard Biesheuvel 2019-08-07 7:28 ` Pascal Van Leeuwen 2019-08-07 13:17 ` Ard Biesheuvel 2019-08-07 13:52 ` Pascal Van Leeuwen 2019-08-07 15:39 ` Ard Biesheuvel 2019-08-07 16:14 ` Pascal Van Leeuwen 2019-08-07 16:50 ` Ard Biesheuvel 2019-08-07 20:22 ` Pascal Van Leeuwen 2019-08-08 8:30 ` Eric Biggers 2019-08-08 9:31 ` Pascal Van Leeuwen 2019-08-08 12:52 ` Milan Broz 2019-08-08 13:23 ` Pascal Van Leeuwen 2019-08-08 17:15 ` Eric Biggers 2019-08-09 9:17 ` Pascal Van Leeuwen 2019-08-09 17:17 ` Eric Biggers 2019-08-09 20:29 ` Pascal Van Leeuwen 2019-08-09 20:56 ` Eric Biggers [this message] 2019-08-09 21:33 ` Pascal Van Leeuwen 2019-08-09 22:04 ` Eric Biggers 2019-08-09 23:01 ` Pascal Van Leeuwen 2019-08-07 8:08 ` Milan Broz 2019-08-08 11:53 ` Milan Broz 2019-08-09 18:52 ` Ard Biesheuvel
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190809205614.GB100971@gmail.com \ --to=ebiggers@kernel.org \ --cc=linux-crypto@vger.kernel.org \ --cc=pvanleeuwen@verimatrix.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
Linux-Crypto Archive on lore.kernel.org Archives are clonable: git clone --mirror https://lore.kernel.org/linux-crypto/0 linux-crypto/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 linux-crypto linux-crypto/ https://lore.kernel.org/linux-crypto \ linux-crypto@vger.kernel.org public-inbox-index linux-crypto Example config snippet for mirrors Newsgroup available over NNTP: nntp://nntp.lore.kernel.org/org.kernel.vger.linux-crypto AGPL code for this site: git clone https://public-inbox.org/public-inbox.git