Re: [SM-2006042709405218849] Applied by teha

Benjamin Schieder wrote/schrieb/scripsit:
>> That whole code is bullshit crypto. First you're reading 1024 bits 
>> (almost, no \n) of super paranoid randomness, then reduce to 128 bits 
>> by applying MD5 to it.
>
>I can increase that to 256 Bits if it makes you feel better :-)

That was not my point. In your code you are taking great pains to 
acquire about 1024 bits of randomness, but then feed it into a digest 
algorithm that produces only 128 bits of output. It doesn't matter if 
you feed 129 bits, 1024 bits or 10240 bits into it -- the resulting key 
is never going to be better than these 128 bits. There isn't necessarily 
anything wrong with using a 128 bits key in the end, but your code 
projects a false sense of security and uselessly depletes the entropy 
pool. This isn't so serious from the purely technical point of view.  
Rather it also suggests that you didn't take all relevant aspects into 
consideration when you wrote this code. I take this as a grave flaw for 
code that claims to improve security.

-Stefan
-- 
 junior guru   SP666-RIPE     JID:[email protected]    SMP@IRC