From 4cfce62881e08e89e155c7965c138568a336cdb1 Mon Sep 17 00:00:00 2001 From: W Date: Wed, 9 Nov 2016 11:53:52 +0100 Subject: [PATCH] v7 first version done --- report/v7_cryptography.tex | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/report/v7_cryptography.tex b/report/v7_cryptography.tex index 293dd19..9058968 100644 --- a/report/v7_cryptography.tex +++ b/report/v7_cryptography.tex @@ -3,9 +3,14 @@ \addtocounter{enumi}{1} \item - \TODO{} + \pass{} Verify that all cryptographic modules fail securely, and errors are handled in a way that does not enable oracle padding. + \begin{result} + The only cryptographic operation is the hashing of the password, which can + not be vulnerable to a padding attack as it does not use a block cipher. + \end{result} + \addtocounter{enumi}{3} \notapplicable{ @@ -20,6 +25,10 @@ \TODO{} Verify that cryptographic algorithms used by the application have been validated against FIPS 140-2 or an equivalent standard. + \begin{result} + The application uses md-5 for password hashing, which should be insecure by + now. + \end{result} \notapplicable{ \item -- 2.20.1