Read now
Introducing Quill: the live context layer for AI →
QuillNEW
Get Started
QuillNEW
Decoration background
Posts
Blog
Badly implementing encryption: Part VII–implementing authenticated encryption

Badly implementing encryption: Part VII–implementing authenticated encryption

February 21, 2022

In the previous post I showed how we can mess around with the encrypted text, resulting in a valid (but not the original) plain text. We can use that for many nefarious reasons, as you can imagine. Luckily, there is a straightforward solution for this issue. We can implement something called MAC (message authentication code) to ensure that the…

Blog
Badly implementing encryption: Part VI–malleable encryption

Badly implementing encryption: Part VI–malleable encryption

February 18, 2022

In the previous post, we managed to get to a fairly complete state, the full code is less than 50 lines of code, but has enough functionality to be able to make use of it. Don’t actually do that. This code is horribly broken, and the adage of “don’t implement your own encryption” holds very strongly here. Let’s consider a fairly typical…

Blog
Badly implementing encryption: Part V–nonce reuse

Badly implementing encryption: Part V–nonce reuse

February 17, 2022

In the previous post, I moved to using HMAC for the key stream generation. Together with a random nonce, we ensure that each time that we encrypt a value, we’ll get a different encrypted value. However, I want to stop for a while and talk about what will happen if we reuse a nonce. The short answer, a single nonce reuse results in catastrophic…

Blog
Badly implementing encryption: Part IV–keyed hash function

Badly implementing encryption: Part IV–keyed hash function

February 16, 2022

I’m trying to not get too deep into the theory of encryption. I’m happy to say that so far I was able to avoid any math whatsoever and hopefully this is an interesting series. I do have to touch on an important topic. I’m using MD5 here for the purpose of generating a random bitstream to be used as a stream cypher. In the previous post, we looked…

Blog
Badly implementing encryption: Part III–breaking your encryption apart

Badly implementing encryption: Part III–breaking your encryption apart

February 15, 2022

In the previous post, I showed how the lack of nonce means that encrypted similar values will expose their content. Now I want to discuss a different matter, let’s assume that I have some control or knowledge about the plain text of an encrypted message. That is easy enough to obtain, I can simply ask you to encrypt a value for me. A great…

Blog
Badly implementing encryption: Part II–breaking the code

Badly implementing encryption: Part II–breaking the code

February 14, 2022

In my previous post, I implemented an “encryption system” using a stream cipher based on top of Md5. The idea is to start with a given key (128 bits in size) and feed it to Md5 recursively, leading to a random looking set of bits that we can generate for both encryption and decryption. I mentioned, but it is worth repeating, this is not a secure…

Podcasts
RavenDB: Domain Modeling and Data Persistency

RavenDB: Domain Modeling and Data Persistency

February 11, 2022

RavenDB expert Dejan Miličić was recently interviewed on the balta.io YouTube channel. He spoke about Domain Modeling and Data Persistency, and explained how RavenDB’s document model solves the problem of impedance mismatch.

Blog
Badly implementing encryption: Part I

Badly implementing encryption: Part I

February 11, 2022

One of the important adages in computer programming is: “Thou shall not write your own encryption”. That is because building your own encryption system is fraught will all sorts of really subtle details that are easy to get wrong, which will entirely eliminate any security that you have in place. For that matter, professional cryptographers are…

Blog
Talking at Carnegie Mellon Database Group: Practical Considerations for ACID/MVCC Storage Engines

Talking at Carnegie Mellon Database Group: Practical Considerations for ACID/MVCC Storage Engines

January 28, 2022

Next week I’ll be talking at CMU about how to build storage engines and what you need to consider when building them. The talk is open to the public (don’t have to be at CMU to be there). Here are the details: Event Date: Monday January 31, 2022Event Time: 04:30pm ESTLocation:…