Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I don't think you can walk back your previous comment, which was pretty categorical. Either way, we're clear about the brittleness of GCM at this point, and there's little else for us to talk about.


Brittleness? Not really. It's not completely future-proof, and it would be easier if a larger nonce is standardized, but all realistic attacks require rather unlikely sets of circumstances.

And no, you can't recover the encryption key (i.e. the thing that allows you to decrypt messages) from any weakness in the nonce choice.


https://www.usenix.org/conference/woot16/workshop-program/pr...

I think you should stop digging. Sean and Hanno gave a Black Hat talk whose slides were unwillingly hosted on a GCHQ website because of this problem.


[flagged]


K.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: