952 reputation
615
bio website paralint.com
location Montreal, Canada
age
visits member for 3 years, 6 months
seen 2 days ago

I like smart people who get things done. I do my best everyday to be one of them.

I code mostly in C++, Python, Java and... whatever comes my way. I also like to understand a problem down to its roots, a process also known as debugging.

LinkedIn and Careers profiles.


Jul
15
answered What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?
Jul
12
comment chosen plaintext attacks against MD5 and SHA1
No, MITM too (RFC2617 mentions it). An attacker can discard the digest value of the server and use its own.
Jul
11
revised chosen plaintext attacks against MD5 and SHA1
Redundant words removed words ;)
Jul
11
answered chosen plaintext attacks against MD5 and SHA1
Jul
8
answered When should I use Message layer encryption vs transport layer encryption
Jul
7
comment Does Windows really still use unsalted MD4 for password storage?
And doesn't Active Directoy need plain text password to encrypt the session key in a Kerberos ticket ? In which case it must store password in a reversible symetric scheme. The local password cache uses a salted hash, though, and you can disable it if you don't need offline logon (wich is rather rare, from my experience).
Jun
21
answered Programmer to Security Professional
Jun
16
comment When using AES and CBC, can the IV be a hash of the plaintext?
Makes sense. I edited my answer with an encrypted hash, but I made it up from my self-educated crypto background. I will read on encrypted indexes (I beleive cryptohash is something like RFC2104?)
Jun
16
awarded  Editor
Jun
16
revised When using AES and CBC, can the IV be a hash of the plaintext?
Provided an answer that is still fast and efficient, but with more security when a salted hash is not enough
Jun
16
comment When using AES and CBC, can the IV be a hash of the plaintext?
You are right about low entropy, dictionnary and rainbow tables are real risk. But is there efficient way to search for a random IV cipher text from a plaintext, when each IV is different (as stated in the question) ?
Jun
16
comment When using AES and CBC, can the IV be a hash of the plaintext?
But given a string like "Darren's projects", how will you find the relevant encrypted row in the database if the IV is random and different for each row ? My understanding is that you will need to encrypt the plain text (user input your are looking for) for each random IV of each row, and compare the encrypted blobs wich will take quite some time.
Jun
16
answered When using AES and CBC, can the IV be a hash of the plaintext?
Apr
8
answered Is clipboard secure?
Apr
8
awarded  Scholar
Apr
8
awarded  Supporter
Apr
8
accepted Why doesn't the client's web browser need to be PCI compliant?
Apr
8
awarded  Teacher
Apr
6
awarded  Student
Apr
6
asked Why doesn't the client's web browser need to be PCI compliant?