anyone else feel like trying to explain to this guy about his error. He seems to think that if you use the wrong block mode, knowing a single plaintext/ciphertext combo for AES will let you solve any of them... Scary part is he has almost 2k rep
it's too late at night and I need to go to sleep, and he doesn't seem to be trusting me telling him he is off his rocker
@AJHenderson I highly suspect he's referring to the pattern leak in ECB (key reuse and no IV). He's technically not saying anything blatantly wrong. He's just trying to look smart by showing he knows about the crypto tux.
I'm trying to find good sources for learning the ARM instruction set
Also, to anyone who's listening. ARM has a link register which holds the return value. Does this mean that buffer overflows are less likely to lead to code execution? The stack is still corruptible, but it seems less likely that the overflow will lead to something useful.
@raz There is only one link register; it is, in fact, a cache on the top stack element.
When a function A is called, it receives the return address in the LR register
If A calls another function B, then it must free that register, so it writes down the contents of LR on the stack, and retrieves the value from that stack slot when it returns.
So, from the point of view of the attacker, everything happens as if the stack had been used all along, provided that the overflow occurs after the first nested call to another function from the attacked function.
This is the common case, when the overflow comes from an uncontrolled call to strcpy() or sscanf(), since, by definition, a sub-call occurs.
Note also that a stack is a stack, so a buffer overflow can overwrite the stack elements of a parent function as well.
@raz In RISC systems, the stack is often less tied to the hardware; in fact, it can be completely emulated by software. The CPU uses the link register; the rest is up to the code.
If the code wishes to manage a part of RAM in a stack fashion, and dedicate a register for that, then so be it. The CPU needs not be aware of it.
The Alpha architecture was a lot more extremist. In the Alpha, there is no dedicated link register either; the "branch opcode" was using two registers, one that contains the destination, the other receiving the return address.
@RоryMcCune Is this where you dress up as an NSA staffer and grin evilly while holding a spliced fibre optic cable dredged from the bottom of the atlantic?
Do you know how many terrorists try to break through our firewall every second??
I should be their external advisor for security. After lengthy consideration of your network we have decided your telephone sounds are annoying and have you tried not connecting your sensitive intelligence data to the internet?
Plus, your background checks could do with some work because there's about 5 moles a season.
"Why do children keep breaking into the Pentagon!"
The security gates just don't stop the Big Wheels
@SteveDL I'm not sure why that question got downvoted. But I think that knowing the difference between encryption and ACLs, and how to use them is a completely valid question.
I think he's confused the two concepts, and how to use them. Clarifying each, and explaining when each should be used is perfect.
It is a beginner question, but not all questions need to be "expert" questions. It's also not a typical question that would be easy to find an answer to by googling.
@SteveDL I think making a note that while encrypting something with a password does protect against unauthorized access, it is not in fact an Access Control by definition.
The OP sees the end result as being the same, which is the source of their confusion.
If encrypted data is stored on a server, and decryption key is disseminated to the legitimate users (through email), is there a need to implement access control policies?
What could be a possible scenario where I need both of them (if decryption key is only available to the legitimate users)?
(I should apologize in advance because this question is going to be messy -- I'll try to refine it as the subject becomes more clear to me).
I'm studying for the CISSP exam and I'm getting confused on the differences between access control methods, security models, and security policies.
When...
@raz argh, more text :p I think I covered the main differences, and I need to rush to grab a seat into a nice no-reservation restaurant tonight. If anyone finds something is lacking, please do edit the answer!
We recently received this email at our work from the HR Department. We work in the healthcare industry and our username and password is linked to everything that we do. We have to follow strict HIPAA guidelines.
Would providing our username and password not be a breach of our privacy? And how d...
(I should apologize in advance because this question is going to be messy -- I'll try to refine it as the subject becomes more clear to me).
I'm studying for the CISSP exam and I'm getting confused on the differences between access control methods, security models, and security policies.
When...
