search

LeftyBC / weechancrypt

Python plugin for Weechat that allows encrypted messaging in an IRC channel via pre-shared key.
3 stars 1 forks source link

Switch to HMAC instead of CRC32 checksums #2

Open LeftyBC opened 9 years ago

LeftyBC commented 9 years ago

CRC32 is not a cryptographically secure way to check that messages are authentic and undamaged.

@kisom recommends HMAC-SHA-256, and to use encrypt-then-MAC.

troby commented 9 years ago

available for addition of HMAC layer

LeftyBC commented 9 years ago

@troby I added you as a collaborator, should be able to assign this to you now.

kisom commented 9 years ago

Just a note, HMAC only applies to CTR mode: GCM uses GMAC and is already an authenticated symmetric cipher.

LeftyBC commented 9 years ago

Only problem with GCM is that pycrypto doesn't support it until very recent versions, so it'd be difficult to support older systems. I saw some info online today about using CTR mode but then adding the multiplications in code that makes GCM different from CTR.

kisom commented 9 years ago

If compatibility is required, I'd recommend CTR+HMAC, and not worrying about adding in the GCM parts. That would add another potential attack surface.