On Friday, February 13, 2015 at 1:51:37 AM UTC-6, might1 wrote: > > And at what cost? Without this magic text, Vim does not know immediately > > that the file is encrypted. > And Mr. Moolenaar the Vim author wrote: > > If you would really want this, I think we would need a special option for > > that. The user would then have to enter both the password and the crypt > > method. > Vim should add an option, say, 'set magicstring' and 'set nomagicstring' to > toggle if prepend the magic string to encrypted file. The default is 'set > magicstring'. User could input, say, ':Z blowfish' in vim and be prompted > for password to decrypt. Also, user could just input ':Z' to decrypt with > default method, which can be set in vimrc. In a nut shell, it should be up to > user how to encrypt and decrypt. >
But, WHY? If someone already knows your password, and knows or guesses you are a Vim user, it will be trivial to try the three different encryption methods. You're basically multiplying the complexity of your password by 3 by removing that from the file. In terms of security, that's a completely irrelevant factor. The strength of the cryptography does NOT come from not knowing the encryption method. It comes from the fact that the encryption method itself is not breakable, even knowing the details of the implementation. OpenSSL is generally considered secure (minus the occasional high-profile bug) and yet everyone knows exactly how it is implemented, and it's an easy guess that it's in use when you're visiting a webpage on a wide range of sites. Hiding the fact that it's using OpenSSL, or hiding the size of the key in use, doesn't make a website more secure. The algorithm *itself* is secure. Your idea of using TWO encryption methods back-to-back is not a terrible one. That way, if a flaw is discovered in the implementation of one, you'd still be protected by the second. But hiding the magic string does nothing at all to enhance security, its only effect would be causing a hassle for the user to remember which crypt method was used. There is still the problem of not having very many available cryptography experts contributing to Vim. So I doubt this will be implemented soon, and it's irrelevant if there are no additional vulnerabilities hiding in the blowfish code. -- -- You received this message from the "vim_use" maillist. Do not top-post! Type your reply below the text you are replying to. For more information, visit http://www.vim.org/maillist.php --- You received this message because you are subscribed to the Google Groups "vim_use" group. To unsubscribe from this group and stop receiving emails from it, send an email to vim_use+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
