Re: [gnukeyring-discuss] Keyring crypto

[Jochen H. <hoe...@us...>]

On Monday, 29. April 2002 12:22, Tony wrote:
> Hello hoenicke,
>
> I wasnt sure if 3DES had a keylength of 112 bits or 168 bits;
> Thanks for clearing that up :)
>
> I dont really see any need to change the cipher. Maybe if you
> wanted to give users an option of selecting what cypher they like.
> 3DES is considered by many to be the most secure algorithm, but you
> might think of CAST for its speed while still being a 128bit
> cypher.

I plan to change the encryption to use the cfb or ofb variants.  The 
problem of the current ecb method is that every 8 byte block of data 
is encrypted the same way if it contains the same data.  So you can 
easily detect that two entries have the same account. The change to 
cfb/ofb is independent of the block cipher used; it applies to 3des 
as well as to blowfish, cast or aes.

This changes the database format and thus needs an upgrade routine.
I want to do this change together with other changes so that the 
database format hopefully needn't be changed again.  

> Does the change to the pilotSSLeay library mean that there will be
> more ciphers to choose from, or is there a speed difference?

I mainly did it for compatibility with PalmOS devices that don't 
support the (undocumented) builtin DES functions. The speed 
difference is a nice side effect, and with faster encryption 
algorithms it may be even better.  Speed is important when changing 
the master password or searching the whole database with the new 
fulltext find method that is in 1.2-pre1.

I may consider to give the user the choice to use a different 
encryption method (he only needs to install those shared libraries he 
actually uses).  But I will only do that if this is feasible without 
making keyring too complex.

  Jochen

-- 
Jochen Hoenicke -- ICQ: 101057678