CodeBetter.Com
CodeBetter.Com
RSS 2.0 via Feedburner
           Do you Twitter? Follow us @CodeBetter

Jay Kimble -- The Dev Theologian

Philosophizing about the .Net religion

Encryption article...

Just wanted to point myself and others to a great article on encryption.  Eric Marvets writes about Block Cyphers and IVs.  Prior to reading the article I would have been able to give you a vacuous answer as to what Intialization vectors (IVs and sometimes referred to as salt) do.  I could not have told you exactly how they work.  I probably would have said something like "IVs are used to randomize your data so that it makes the actual encryption more effective; it makes data encrypted by the same key have different values."  If you had asked me how does it work?  I would have said, "uhhh, I don't know... I think it adds these bytes to the front of the data and symmetric encryption uses the last value as a seed for the next value (somehow)."  According to Eric, the right answer is that it XORs the data against the IV which transforms your data instantly into a different stream of bytes.  XOR is the slacker's quick and dirty encryption...  And no, it's not really secure! It's extremely hackable.  It will make the text magically look like garbage (if you're dealing with plain text), but once the XOR value is determined it is easily hacked... If you XOR text with a random value that you save, and then encrypt it with a real encryption algorithm (you get the picture).

The other thing I've wondered is what do I do with this thing... I mean I encrypt a value... I have my encrypted text, my key, and now a third value the IV... Here's the answer (according to Eric).  The key should be handled with care.  The encrypted text could be put in plain sight... not a problem... the IV is equally useless without the key (OK, it's only slightly useless, but you can store it pretty much anywhere).

 


Published Jun 15 2005, 12:40 PM by Jay Kimble
Filed under: ,

Check out Devlicio.us!

This Blog

Syndication

News

CodeBetter.Com Home
Current Threat level
Terror Alert Level