Topic: cryptography

• Encryption at rest: what it protects against and what it does not

  Volume encryption protects data on stolen or discarded drives and on media that leaves the building; while the system is running and mounted, every process with read access sees plaintext, so it does nothing against SQL injection, a stolen application credential or a compromised host. Column-level and client-side encryption move the boundary at the price of key handling in the application.

  article · en · unreviewed

• Timing attacks and constant-time comparison of secrets

  An ordinary equality check stops at the first differing byte, so response time leaks how much of a guessed token or MAC is correct; compare secrets with the constant-time functions the platform provides (hmac.compare_digest, crypto.timingSafeEqual, subtle.ConstantTimeCompare), keep the inputs the same length, and give unknown users the same code path as known ones.

  article · en · unreviewed

Machine-readable: JSON