| |||||||||||||
I won't give up LibreOfficeI won't give up LibreOfficePosted Mar 15, 2012 12:43 UTC (Thu) by eru (subscriber, #2753)In reply to: I won't give up LibreOffice by dgm Parent article: A look in on Apache OpenOffice But there is one 3.5 change I am not terribly happy with: Different Encryption Algorithm. Up to now password-protected documents have been interchangeable between different OOo/LO versions (I use them for master password lists and some personal notes), but now there is a "version trapdoor". This one feels a bit like change for change's sake. Blowfish surely has not been broken in practice?
(Log in to post comments)
Changes in Encryption for Password-Protected Documents Posted Mar 15, 2012 19:44 UTC (Thu) by orcmid (guest, #74478) [Link]
The allowance for other encryption algorithms is a provision of ODF 1.2, now an approved OASIS Standard.
The peculiarity is taht ODF 1.2 recommends a different encryption than Blowfish while at the same time Blowfish (and its particular parameters) are available as defaults when no algorithm is specified. The change in recommendation is basically because algorithms like AES have formal support from NIST and elsewhere, and Blowfish does not. Blowfish is also a bit dated (as AES is becoming).
Unfortunately, users are apparently not given a way to choose the encryption.
Presumably it is possible to use the Save As ODF 1.1 selection in the Tools | Options in order to use the original default encryption methodology. I must try that with the latest LO release candidates.
PS: The flaw, among others, in the current encryptions is in the improper use of PBKDF2 that allows an attack by direct injection of password digests obtained from elsewhere without attacking the password. This sideways vulnerability applies to all of the encryption methods at the present time. And of course password-based schemes are more vulnerable than the encryption and are easier to attack, making it irrelevant how good the encryption algorithm itself is.
|
|||||||||||||