Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.c++ > #72084

Re: Regal eagle / American cloud

From "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com>
Newsgroups comp.lang.c++
Subject Re: Regal eagle / American cloud
Date 2020-03-02 13:24 -0800
Organization Aioe.org NNTP Server
Message-ID <r3jtim$1q8s$2@gioia.aioe.org> (permalink)
References (10 earlier) <_to6G.60660$4z5.47573@fx30.ams1> <r3geba$u4e$1@dont-email.me> <r3h7ob$16f0$1@gioia.aioe.org> <r3hai2$78g$1@dont-email.me> <r3jtd3$1q8s$1@gioia.aioe.org>

Show all headers | View raw

On 3/2/2020 1:21 PM, Chris M. Thomasson wrote:
> On 3/1/2020 1:47 PM, David Brown wrote:
>> On 01/03/2020 21:59, Chris M. Thomasson wrote:
>>> On 3/1/2020 5:46 AM, David Brown wrote:
>>>> On 29/02/2020 08:34, Mr Flibble wrote:
>>>>> On 29/02/2020 06:51, Melzzzzz wrote:
>>>>>> On 2020-02-29, Chris M. Thomasson <chris.m.thomasson.1@gmail.com> 
>>>>>> wrote:
>>>>
>>>>>>>
>>>>>>> Okay. I was thinking of sending an encrypted password using a DH 
>>>>>>> secure
>>>>>>> channel. We can most certainly hash on the client, then send the 
>>>>>>> digest
>>>>>>> to the server using a secure DH?
>>>>>>
>>>>>> When using encrypted protocol it is same. When attacker has hash 
>>>>>> it is
>>>>>> same as plain text.
>>>>>
>>>>> You are missing the point: people use the same password for 
>>>>> different things: if the hash is compromised it only compromises 
>>>>> access to this particular server; also
>>>>> you cannot gaurantee that lemons working on the server code don't 
>>>>> log it by mistake. NEVER send password in the clear from the CLIENT 
>>>>> computer even over encrpypted links.
>>>>> Clue: you can hash a hash.
>>>>>
>>>>
>>>> Exactly.  It is always surprising how many people miss this point. 
>>>> (And it should be needless to add that you should pick a good, 
>>>> random salt.)
>>>>
>>>> The bad guys don't break into Facebook, Google, banks, and the like 
>>>> by hacking those servers and reading out their data.  They break 
>>>> into some numpty web site that has stored user names, email 
>>>> addresses and clear text passwords (because the muppet running them 
>>>> thinks Wireguard or DH is magic that keeps it all safe).  Then they 
>>>> guess that the user has the same password on other services.
>>>>
>>>> In virtually all cases, a standard https connection is secure enough 
>>>> for transferring the password hash from the client to the server. 
>>>
>>> Agreed.
>>>
>>>
>>>> It is almost certainly better than making up your own system because 
>>>> you have heard that Diffie-Hellman key exchange is good
>>>
>>> Actually, DH key exchange can be very dangerous. One needs to know 
>>> how to use it.  Large secure primes come to mind.
>>>
>>
>> Friendly reminder - it was /you/ who brought up DH!
> 
> Indeed I did. It was simply meant for the OP to take a look at; study. 
> Imvvvho, its a good algorihtm to learn, at least.
> 
> 
>> Anything in the cryptographic world can be "dangerous".  A little 
>> knowledge can be a very bad thing here.  You are far better off 
>> forgetting you ever heard of "Diffie-Hellman" or key exchange - use a 
>> good TLS implementation and let people who know what they are doing 
>> implement the security.  (The authors of such software are not 
>> infallible either, so track updates and fixes for the software.)
> 
> Fwiw, I have an experimental symmetric cipher. If you get some really 
> free time perhaps you can take a look at it:
> 
> https://groups.google.com/d/topic/comp.lang.c/a53VxN8cwkY/discussion
> 
> http://funwithfractals.atspace.cc/ct_cipher
> 
> https://pastebin.com/raw/feUnA3kP
> (C version with hardcoded secret key)
> 
> I can get it to work with traditional HMAC, however its way too slow. 
> Using an optimized HMAC that can take a digest without destroying its 
> internal state makes things go a lot faster.

Fwiw, the folks over on sci.crypt are telling me that its beyond their 
experience to properly perform crypto analysis on. Perhaps you can help 
tear it apart!?

Back to comp.lang.c++ | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-09 12:54 -0800
  Re: Regal eagle / American cloud woodbrian77@gmail.com - 2020-02-27 20:19 -0800
    Re: Regal eagle / American cloud Mr Flibble <flibbleREMOVETHISBIT@i42.co.uk> - 2020-02-28 16:50 +0000
      Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 15:34 -0800
    Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 15:37 -0800
      Re: Regal eagle / American cloud woodbrian77@gmail.com - 2020-02-28 16:24 -0800
        Re: Regal eagle / American cloud Melzzzzz <Melzzzzz@zzzzz.com> - 2020-02-29 03:48 +0000
          Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 21:33 -0800
            Re: Regal eagle / American cloud Mr Flibble <flibbleREMOVETHISBIT@i42.co.uk> - 2020-02-29 06:28 +0000
              Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 22:34 -0800
                Re: Regal eagle / American cloud Melzzzzz <Melzzzzz@zzzzz.com> - 2020-02-29 06:51 +0000
                Re: Regal eagle / American cloud Mr Flibble <flibbleREMOVETHISBIT@i42.co.uk> - 2020-02-29 07:34 +0000
                Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 23:40 -0800
                Re: Regal eagle / American cloud David Brown <david.brown@hesbynett.no> - 2020-03-01 14:46 +0100
                Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-01 12:59 -0800
                Re: Regal eagle / American cloud David Brown <david.brown@hesbynett.no> - 2020-03-01 22:47 +0100
                Re: Regal eagle / American cloud red floyd <no.spam@its.invalid> - 2020-03-01 22:14 -0800
                Re: Regal eagle / American cloud woodbrian77@gmail.com - 2020-03-03 08:06 -0800
                Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-02 13:21 -0800
                Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-02 13:24 -0800
                Re: Regal eagle / American cloud David Brown <david.brown@hesbynett.no> - 2020-03-03 08:11 +0100
                Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-03 01:31 -0800
                Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-03 01:33 -0800
                exception with distinct data members and concatenated what "daniel...@gmail.com" <danielaparker@gmail.com> - 2020-12-08 08:24 -0800
                Re: exception with distinct data members and concatenated what Öö Tiib <ootiib@hot.ee> - 2020-12-08 10:26 -0800
                Re: exception with distinct data members and concatenated what "daniel...@gmail.com" <danielaparker@gmail.com> - 2020-12-08 11:00 -0800
                Re: exception with distinct data members and concatenated what Öö Tiib <ootiib@hot.ee> - 2020-12-08 13:17 -0800
                Re: exception with distinct data members and concatenated what Paavo Helde <myfirstname@osa.pri.ee> - 2020-12-08 22:13 +0200
                Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 23:38 -0800
              Re: Regal eagle / American cloud Melzzzzz <Melzzzzz@zzzzz.com> - 2020-02-29 06:50 +0000
                Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 23:32 -0800

csiph-web