Hi Chris,
ECB, CTR ("Counter"), EAX and GGM are all modes of operation for block ciphers. This wikipedia page http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation provides a good overview of the different modes, and why ECB is a bad choice, and why an AEAD mode (near the bottom of the page) is better than a non-authenticating mode.
(I was particularly struck by the spectacular failure of ECB mode to encrypt the sample image!)
With specific reference to a Mako signed-sealed envelope, probably the best thing to do is to perform the public-key signing operation on the original data, and then encrypt-and-MAC the signed data as a separate step. The thing to do is to change the way envelopes are sealed (the signing process can be left alone) to be an encrypt-and-MAC operation rather than a simple encrypt-only operation with no integrity protection. For instance, Rijndael in EAX or GGM mode would do nicely for the enciphering step.
Another thing to watch out for is the key-exchange protocol, which can be really sensitive.
Cheers, Tony
Chris Muller wrote:
Hi Tony, it may very well be the other way around. I am honestly no encryption expert, just a skilled implementor. I will try to find the web reference that recommended that.
As for ECB, I'm sorry I have no idea what that means. This is exactly the kind of critique I need your guys' help with. I am hoping that the usage and management are mostly ok, but there may be some tightening needed in the cryptography layer.
This is a very worthy discussioon for the cryptography list, I hope you don't mind that I have copied that list here.
Cheers, Chris
--- Tony Garnock-Jones tonyg@lshift.net wrote:
Hi Chris,
In the comment to method MakoEnvelope class>>signedAndSealedFrom:to:object:, you write "Security experts recommend putting the signed inside the sealed".
Isn't it the other way around? According to http://www-cse.ucsd.edu/users/mihir/papers/oem.html the least insecure method is to encrypt, then MAC.
Also: On digging into the implementation of enciphering, it looks like the default cipher, Rijndael, is being used in ECB mode. Have I analysed that correctly? (If so, there are other modes that might be better: AEAD modes such as EAX or GGM; at a minimum, CTR, but an AEAD mode would be better, of course)
Regards, Tony