The theory tag has no wiki summary.
3
votes
1answer
304 views
Will double encryption increase the security of cipher vs bruteforce?
Lets say, I have a function
encrypt(mes,key)
where :
mes = message
key = key
Length of key is 64bits.
Lets say, that only way to crack my cipher is brute force attack.
If I use
...
1
vote
4answers
198 views
Strategies to store/remember very long password?
If future proof encryption is - in theory - possible it will require long password.
What are some of the strategies for storing or remembering very long - in this case rarely used - password?
For ...
7
votes
2answers
119 views
What applicability does the Halting Problem have to infosec?
I was reading an infosec blog recently, and I was caught off guard by the following statement:
Sure you can run up to date software and firewalls and that network appliance in your data center ...
1
vote
1answer
76 views
How big is the risk of hash fixed points/cycles?
It's established wisdom to hash password multiple times with a salt to increase the time it takes per brute force iteration. At the same time (unless the algorithm guarantees otherwise) there's a ...
10
votes
4answers
755 views
Future proof encryption possible in theory?
Let's say I have a message that I want to keep safe for the next 100 years. Is it theoretically possible?
Let's say the message is unique (raw picture data, raw video video data, raw text data) and ...
5
votes
4answers
178 views
provable security and sandboxes
Maybe this can be answered by an answer to a more general question, such as what programs can be proven secure.
Can it be (or has it been) formally proven that a sandbox is secure?
18
votes
5answers
1k views
How valuable is secrecy of an algorithm?
On the surface, the inadvisability of security through obscurity is directly at odds with the concept of shared secrets (i.e. "passwords"). Which is to say: if secrecy around passwords is valuable, ...
0
votes
1answer
129 views
Detecting end-state of decryption process with unknown key
Note: this question arises purely from a theoretical interest in security research.
Frequently in popular fiction we see white-hat hackers decrypt secret information in a matter of seconds. While ...
1
vote
1answer
167 views
authorization vs federation vs entitlement
I am vague among the three following terms: authorization, federation, entitlement (as stated by the OpenAM product: OpenAM provides open source Authentication, Authorization, Entitlement and ...
1
vote
2answers
161 views
BLP Lattice structure with missing top and bottom levels
I designed a system similar to the above diagram. However There is no (Top Secret, {nuclear,crypto}) and no (Secret,{}) levels. Meaning that there is no top and bottom level.
Would it make the BLP ...
1
vote
1answer
96 views
Appilicability of Theoritical Computer Science/Formal methods in Malware research
I would like to know the importance of Theoritical CS/Formal methods in Malware research. Due to the large volume of new malware variants received per day (~50,000 samples/day according to McAfee), ...
4
votes
1answer
53 views
Are viewable permissions an issue?
Is it, generally, considered to be a security issue if a user in 3-tier application has read-only access to other users' permissions? I.e. Alice can see that Bob has or has not access to some ...
6
votes
1answer
368 views
Open Problems in Security?
I know it might seem a bit too much theoretical, but I was wondering if there was some list of known open problems in security?
In a similar way that there are open problems in Theoretical Computer ...
12
votes
2answers
510 views
Are there some good papers (or discussions) on using Markov chains or Hidden Markov Models for password auditing/cracking?
As a programmer and language enthusiast I've been very interested in Markov chains for some time. Considering the influence of natural language on password and passphrase selection (by humans of ...
25
votes
2answers
3k views
Amount of simple operations that is safely out of reach for all humanity?
Cryptographic primitives usually assert some security level given as number of operations to mount an attack. Hash functions, for example, give different security levels for collision attacks, ...
14
votes
6answers
4k views
Where can I learn cryptography/cryptanalysis the hard way, without going to school ? Any good book?
I'm not so bad at mathematics:
I know what are p-list and p-combinations, I know matrix algebra, I know what a XOR is, I know how to tell if number is a prime, etc: I'm not the programmer who hates ...
8
votes
7answers
954 views
Definition of Software Security
I'm looking for a theoretical definition of Software Security. And I need to quote some book in an article.
Most of the books starts already assuming that the user knows what that is, and they're ...
4
votes
2answers
127 views
Is it correct to consider audits as exclusively “detective” in nature?
I'm studying for the CISSP exam and one of the video lecture points didn't quite make sense to me. The instructor was discussing access control administration areas and began categorizing certain ...
5
votes
4answers
295 views
What is the solution to Schneier's Law?
Schneier's law (which should probably be called Babbage's Law). States that:
Anyone, from the most clueless amateur
to the best cryptographer, can create
an algorithm that he himself can't
...
