25,971 reputation
863129
bio website ayrx.me
location Singapore
age 20
visits member for 2 years, 8 months
seen 2 hours ago

This is not the profile you are looking for.


Dec
15
revised OpenTSA and PKCS11
+some clarification
Dec
15
revised HMAC-SHA256 Transaction signing
deleted 12 characters in body
Dec
15
comment HMAC-SHA256 Transaction signing
I'm not sure what this is about. TOTP is simply HMAC applied over the current Unix ntimestamp and truncated to 8 digits. Sure, you can derive the HMAC key from the transaction details somehow but that isn't "signing". You need to describe in more detail what you have in mind.
Dec
13
comment Should the whole web *really* be encrypted? Isn't plaintext sometimes faster/better?
@DavidHoelzer " but the overall overhead at the server end is quite substantial." Commonly repeated myth but completely untrue. See: istlsfastyet.com
Dec
13
comment Necessary components for PGP
If we want to go as generic as possible, I'd say symmetric and asymmetric encryption.
Dec
13
answered What does this potentially malicious code do?
Dec
11
awarded  Guru
Dec
8
comment Timing attack against HMAC in authenticated encryption?
Excellent! I thought this was a Bear answer at first. :)
Dec
7
awarded  Nice Question
Dec
6
answered nginx recommended ssl_ciphers
Dec
1
awarded  Nice Answer
Nov
29
answered Techniques to make a login page safe without using SSL
Oct
16
awarded  Taxonomist
Oct
15
reviewed Reject What are the odds of an RSA private key collision?
Oct
15
awarded  Announcer
Oct
13
comment One-Time-Passwords resist against bruteforce attacks? Immune Alternative?
Your second point is false. There are algorithms that are information theoretic secure which means they remain secure even in the face of attackers with unlimited computing power.
Oct
13
revised One-Time-Passwords resist against bruteforce attacks? Immune Alternative?
added 1072 characters in body
Oct
13
answered One-Time-Passwords resist against bruteforce attacks? Immune Alternative?
Oct
11
comment Is it a good idea to use the user's username as a salt when hashing a password like hash(username_str + password_str)?
@AbeMiessler security.stackexchange.com/a/31846/10211 Scroll to the section on Salt Generation.
Oct
7
answered Does KASLR really provide more security against exploits?