On 9/15/2015 12:24 PM, Leyne, Sean wrote: > Jim, > >> I don't know of any known problems with AES/CBC. It is simply the most >> trusted crypto algorithm in the history of computing. It isn't possible >> prove >> that something can't be broken, but many, many very smart people have >> spent many years searching for an attack over 15+ years without success. >> >> If you have a pointer to an AES/CBC "problem", could you share it? > These links refer to the 'problem' and have links to other resources -- they > should provide a starting point: > > http://crypto.stackexchange.com/questions/11849/how-to-break-aes-cbc-pkcs5-when-key-and-iv-are-reused > > http://stackoverflow.com/questions/22931699/known-plaintext-attack-on-cipher-block-chaining > > http://crypto.stackexchange.com/questions/6212/aes-cbc-with-fixed-or-predictable-iv-what-are-the-risks > >
None of these suggest that there is an attack -- read the comments. A plaintext attack is one where the key can be deduced by submitting a sequence of known plaintexts to encryption with the unknown key. AES -- and virtually all modern encryption algorithms -- are designed to make this infeasible. If you search deeper, you will find commentary to the effect that CBC isn't an effective message digest, which is both true and irrelevant. If you want a message verifier, use a message verifier, but that doesn't have anything to do with a weakness of AES or AES/CBC. ------------------------------------------------------------------------------ Firebird-Devel mailing list, web interface at https://lists.sourceforge.net/lists/listinfo/firebird-devel
