Re: kerneli blowfish/twofish compromised?

kernel@mallory.draper.net
Sat, 21 Nov 1998 12:36:20 -0600


On Sat, Nov 21, 1998 at 06:26:06PM +0100, Alexander Kjeldaas wrote:
<bigsnip>
> In regard to your work I can say that none of the loop-devices
> currently use the block-number as initialization vector and therefore
> there are weaknesses. The loop devices use the "weak" ECB, or the
> better CBC mode (but with IV=0). Currently the patch is a set of
>
Hi Astor,

I have developed patches to the loop driver and twofish code
that do exactly that (the testing of which was what lead me to the
discovery of the CBC twofish weaknesses). I'll be happy to make
the code available to anyone in the USA or Canada who would like to
take a look for themselves. Some people on sci.crypt are also looking
into it.

At this point my confidence in the integrity of the blowfish and twofish
implementations contained in the international patch (ONLY) is shaken (what
else might be compromised?). I need to test this against Bruce Schneier's
reference code and test vectors before my confidence will be restored.

Btw, even the remotest possibility of leaking plain text into the cipher
text sends shivers down my spine... brrrrr.

Reed,

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/