Tag Info

New answers tagged

1

It is quite possible to create a stronger RNG using the suggested method, however it is also possible to create a weaker RNG, or one that does not improve. The end result depends on the properties of the weaker RNGs. Bit distribution and bias has just as much effect as the entropy level. Only careful analysis and knowledge of the entire scheme can tell if ...


1

The quick but overly vague answer to your original question is: Yes. However, as most people have indicated: more secure != secure. The purpose behind RNGs/PRNGs is to produce sufficient entropy to make it infeasible for an attacker to guess enough information to recover sufficient protected data. Most sources of entropy are tested to determine whether ...


2

This probably sounds like snark, but your solution only improves the situation if the two PRNGs are themselves chosen with sufficient randomness. Think of the reason that we consider a weak PRNG to be insecure: the result is statistically easy to guess some/all of, resulting in crypto and other operations that can be attacked by knowing part of the input ...


1

Unless one is perfectly random, the end results is unclear. But if one were perfectly random, it would not be weak any more. Edit: Unless you're sure the two are completely independent of each other, the benefits may be unclear.


0

Let me make sure I understand. Your user will run a local application that is capable of decrypting your encrypted file and of storing it (or parts of it) in memory in a readable format. Your adversary is the user; the user is assumed to want to hijack those permissions stored in the encrypted file. I also assume the user is root on that machine so she can ...


2

the diffrence comes from the locking / nonlocking random beeing used (e.a. /dev/random and /dev/urandom) from the Manpages of ubuntu 14.04 (man random) NAME: random, urandom - kernel random number source devices SYNOPSIS : #include int ioctl(fd, RNDrequest, param); DESCRIPTION : The character special files /dev/random and /dev/urandom ...


0

Your question asks that the RSA key pair be created on a token. If that token contains an approved RNG, you should be OK. Otherwise, not so good. Your private key encrypted with an AES key will be imported onto a trusted desktop computer? Your private key should only be used for signing or for decryption. If your private key is for application signing it ...



Top 50 recent answers are included