Thai Duong

It's https://vnhacker.blogspot.com. I rarely blog in English. However, right now there's a pretty good post: https://vnhacker.blogspot.com/2020/04/vietnams-contact-tracing-app_26.…

> These functions belong to a family of functions known as key derivation functions: they use hashing to produce a digest which is suitable for use as a password hash. KDFs are not for storing password hashes, they are for key derivation. This is a subtle point, the main thing is to use KDFs as KDFs (to derive keys that are then used to encrypt data). Details in the first link here (the second is about common mistakes when using scrypt): - http://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scrypt.html (bad title, he's referring to pass storage, not KDF usage) - http://vnhacker.blogspot.com/2014/04/fairy-tales-in-password-hashing-w… Another consideration is plausible deniability (PD) for situations where you're compelled to disclose your password(s). Our company writes Mac encryption software that specializes in this (and it uses scrypt). Here's a list of tools that offer PD (ours is called Espionage): https://en.wikipedia.org/wiki/Deniable_encryption#Software I compared Espionage's PD to TrueCrypt's on reddit: http://www.reddit.com/r/security/comments/2b5icu/major_advancements_in…

It's the end-to-end part that is opt in. Normal messages are encrypted in transit and while stored and only the machine learning system has access to them otherwise. https://vnhacker.blogspot.com/2016/05/security-and-privacy-in-google-a… Of course that means it is just Google policy protecting the messages internally and it probably isn't resistant to a warrant, but the messages are protected from other access.

Remind me this one http://vnhacker.blogspot.com/2011/09/beast.html

The recent post "Fairy Tales in password hashing"[0] in regards to scrypt seems somewhat relevant here. [0]: http://vnhacker.blogspot.com/2014/04/fairy-tales-in-password-hashing-w…

You should take a look at the [encryption] tag on stack overflow. There is a lot of really depressing stuff there. Implementing low level cryptographic algorithms is hard - I'd say near impossible to get right - if you apply high standards like side-channel resistance. There are a lot of use cases though, where side-channel resistance is not necessary to get secure "enough" against the slightly above average attacker. But the next level to get wrong is using the low-level crypto correctly. E.g. by assuming encrypting data is enough to protect the content, until you find out about CBC padding oracles and how your service involuntarily decrypts the sensitive date for the attacker (ASP.net: [1]). Or you realize, that your ad-hoc message authentication code does not protect your API at all, because MD5, SHA1 and the SHA2 family are all subject to length extension attacks (Flickr: [2]). The subtleties are endless: In RSA, you can calculate the `e`th root over the real numbers, if `e` and the message is small, RSA has it's own padding problems [3], Stream ciphers provide no authenticity whatsoever as you can just xor the ciphertext with any value to manipulate the plaintext, password hashing is not at all about what most people believe it to be, comparing passwords should be done using a PAKE [4] (otherwise you can bruteforce passwords, like in WPA)... And then there is stuff that even the experts get wrong, think TLS Triple Handshake [5]. You can learn about this kind of stuff…