this post was submitted on 30 Jun 2024
23 points (84.8% liked)
Open Source
29773 readers
706 users here now
All about open source! Feel free to ask questions, and share news, and interesting stuff!
Useful Links
- Open Source Initiative
- Free Software Foundation
- Electronic Frontier Foundation
- Software Freedom Conservancy
- It's FOSS
- Android FOSS Apps Megathread
Rules
- Posts must be relevant to the open source ideology
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon from opensource.org, but we are not affiliated with them.
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
The first function is used during the encryption process, and the while loop clearly runs until the specified time duration has elapsed. So encryption would take 5 days no matter how fast your computer is, and to decrypt it, you'd have to do the same number of iterations your computer managed to do in that time. So if you do the decryption on the same computer, you should get a similar time, but if you use a different computer that is faster at doing these operations, it will decrypt it faster.
What is the threat szenario?
If you are smart about parallelization and have access to custom hardware, couldn't you turn 5 days into 1 hour or less?
Yes, that's exactly the problem - there's nothing wrong with the encryption used, but it's IMHO incorrect to call it time-based when it's "work-based" and it just so happens that the specific computer doing the encryption works at a given speed.
I don't call my laptop's FDE time-based encryption just because I picked an encryption that takes it 10 seconds to decrypt the key.