From d3323ab8e9e39bcb0a6493d33efa265073920a7d Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Fri, 19 Aug 2016 12:41:31 -0400 Subject: comment updates The keyid used as a salt in the shardIdents does not prevent rainbow table attacks, since it's often anyKey (""). The obscure name combined with the username does make rainbow tables unlikely to be useful though. --- Encryption.hs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'Encryption.hs') diff --git a/Encryption.hs b/Encryption.hs index 649cfed..4a8f5cf 100644 --- a/Encryption.hs +++ b/Encryption.hs @@ -164,7 +164,7 @@ hashToAESKey (ExpensiveHash _ t) = b = B.take (fromIntegral $ Raaz.byteSize (undefined :: AesKey)) $ Raaz.toByteString $ Raaz.sha256 (E.encodeUtf8 t) --- | A bytestring that can be AES enctypted. It includes a checksum, +-- | A bytestring that can be AES encrypted. It includes a checksum, -- and size, and is padded to the objectSize with NULs. -- -- This is a multiple of the AES blocksize, as long as objectSize is, -- cgit v1.2.3