<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
</head>
<body bgcolor="#ffffff" text="#000000">
<p class="MsoNormal"><span style="font-family: "Arial","sans-serif";">Hi
all,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family: "Arial","sans-serif";">Following
suggestion
of Zooko Wilcox O’Hearn, I post here a question about usage of hash
functions
in the security of Tahoe Filesystem. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family: "Arial","sans-serif";">I
wonder why
you are not using MAC’s (Message Authentication Codes) for the
authentication on the data, in plaintext and ciphertext
?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family: "Arial","sans-serif";">I
think your
architecture could fit well with MAC computed in the Gateway (As it’s,
by
design, in the confident area) <o:p></o:p></span></p>
<pre><span style="font-size: 11pt; font-family: "Arial","sans-serif";">Can you explain why you need collision resistance?<o:p></o:p></span></pre>
<pre><span style="font-size: 11pt; font-family: "Arial","sans-serif";"> <o:p></o:p></span></pre>
<pre><span style="font-size: 11pt; font-family: "Arial","sans-serif";">As you say in your doc <i
style=""><span style=""> </span>“The discovery of a collision in SHA256 is unlikely to allow much, but could conceivably allow a consistency violation in data that was uploaded by the attacker.”<o:p></o:p></i></span></pre>
<pre><span style="font-size: 11pt; font-family: "Arial","sans-serif";">As you are hashing (in fact, verifying consistency of) both ciphertext and plaintext, even if an attacker can replace a ciphertext chunk without modifying the Hash , you’ll see it after verifying the hash over the plaintext (after decryption) ? <o:p></o:p></span></pre>
<pre><span style="font-size: 11pt; font-family: "Arial","sans-serif";">Perhaps you only need hash for hashing the “Capability Extension Block” ?<o:p></o:p></span></pre>
<pre><span style="font-size: 11pt; font-family: "Arial","sans-serif";"><o:p> </o:p></span></pre>
<pre><span style="font-size: 11pt; font-family: "Arial","sans-serif";">Regards,<o:p></o:p></span></pre>
<pre><span style="font-size: 11pt; font-family: "Arial","sans-serif";">Guillaume Sevestre.<o:p></o:p></span></pre>
</body>
</html>