[prev in list] [next in list] [prev in thread] [next in thread] 

List:       botan-devel
Subject:    [Botan-devel] Secure IV
From:       mr.diggilin () gmail ! com (Mr Diggilin)
Date:       2008-12-17 2:17:10
Message-ID: 1229480230.11349.17.camel () linux-h0kk ! site
[Download RAW message or body]

I have a security question/problem.

As I understand, using the same IV twice is a bad idea.
The way my program works is by having a key for every database that gets
added (say around 50 databases, on average). That key encrypts each row
using the row id as an IV, this satisfying the unique requirement.
(Thanks Jack!)

Now I have the problem of User accounts. My idea was that the passphrase
part (which gets combined with the database id as salt) of the database
key gets encrypted by the user key, so when the user logs in, the
database key can be recreated and the contents viewed.

Now, the question is, what is a safe value to use for the iv when
encrypting the library passphrase?
I can't use an incrementing integer, as the user also has a database
which will do the same as the library.
Generating a random IV (16 bytes, Twofish) doesn't guarantee that I
won't get a duplicate.
I wanted to use the 40 byte LibraryID, but I can't guarantee that the
LibraryID wasn't forged, and I need to crop it to the needed 16 bytes.

Any recommendations for a good strategy? I'm guessing that I'm just
misunderstanding something, as my experience is limited to nothing. Any
help is much appreciated.

-Diggilin




[prev in list] [next in list] [prev in thread] [next in thread]