[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <8762cg8997.fsf@mid.deneb.enyo.de>
Date: Tue, 01 May 2012 12:51:16 +0200
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Subject: Re: weak use of crypto in python-elixir can lead to information disclosure (CVE and peer review request)
* Vincent Danen:
>>And you can group by encrypted column values in the database. That's
>>why I'm not sure if it's actually possible to address this issue in a
>>satisfying manner.
>
> So the encryption can be more fine-grained than just per-table? You can
> also do it per-column? If that's the case, this does sound a lot uglier
> to deal with.
This test case suggests to me that you have to specify the list of
encrypted columns explicitly:
<http://elixir.ematia.de/trac/browser/elixir/trunk/tests/test_encryption.py>
Based on this example, it's not clear to me if the current
implementation supports get_by with an encrypted column. If this is a
feature which needs preserving, there is no apparent way around
convergent encryption.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
