332 reputation
414
bio website
location
age
visits member for 3 years
seen Aug 16 at 10:07

Aug
10
comment Should I worry about padding oracle?
I forgot what is probably the most important detail: in my scheme there isn't a global fixed key to discover hoping the server leaks smthg about it.in fact the client request contain the username and the user-specific encourage key, generated on-the-fly when the user types his pwd. So I think that setting up a padding Oracle on my server requires the attacker to know user pwd, but that means that auth modes are irrelevant at that point. Am I wrong?
Aug
10
awarded  Nice Question
Aug
9
comment Should I worry about padding oracle?
app and db aren't separate. user never provides ciphers and encryption keys are generated when user type their password.
Aug
9
asked Should I worry about padding oracle?
Jul
22
awarded  Caucus
Jul
16
awarded  Popular Question
Jul
16
comment Clarification about IV in PBKDF2 to generate encryption key
Thanks a lot for the detailed answer, as usual of you.. could you please tell me something about the code posted? I don't provide openssl_encrypt a salt (and I don't disable it) so I think that openssl thinks to it (i.e. generates and store in the header a random salt). Is that wrong?
Jul
15
reviewed Approve Clarification about IV in PBKDF2 to generate encryption key
Jul
15
asked Clarification about IV in PBKDF2 to generate encryption key
Feb
16
awarded  Notable Question
Feb
2
awarded  Yearling
Jul
25
awarded  Popular Question
Jul
2
awarded  Curious
Apr
5
awarded  Notable Question
Feb
27
awarded  Popular Question
Jan
27
awarded  Notable Question
Jun
16
awarded  Popular Question
May
21
awarded  Popular Question
Jan
21
comment Maintain sensitive key between requests
What do you mean for "session is invalidated"? Log out? expired time?
Jan
21
comment Maintain sensitive key between requests
No, the first pages are public so only http. When the user wants to login, I redirect him over https to a login form and the logged session is entirely over ssl. Can the session be considered secure?