Reputation
3,541
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
7 24
Newest
 Yearling
Impact
~123k people reached

  • 0 posts edited
  • 9 helpful flags
  • 85 votes cast
Oct
14
comment Known password length, brute force character in place?
@OlegV.Volkov That quote is taken out of context. Their analysis was done on a customer application but is based on simulated real world applications. I know for a fact that this attack is possible in the real world because I've actually done it on a test system.
Oct
14
comment Known password length, brute force character in place?
@OlegV.Volkov please read rdist.root.org/2010/07/19/exploiting-remote-timing-attacks - this exact attack was done by them. The paper talks about 20 microseconds - not milliseconds.
Oct
13
comment Known password length, brute force character in place?
@OlegV.Volkov Besides Nate Lawson's work I linked to in my previous comment, there's also this paper, cs.rice.edu/~dwallach/pub/crosby-timing2009.pdf, which states that time differences as small as 20 microseconds can be detected over the Internet.
Oct
13
answered Is there any processor that could decrypt encrypted data and machine instructions?
Oct
13
comment Known password length, brute force character in place?
That's why I wrote you would need to try each multiple times - to cancel out the noise. This has been done succesfully by many reseachers - for example, please see rdist.root.org/2010/07/19/exploiting-remote-timing-attacks.
Oct
12
awarded  Nice Answer
Oct
12
revised Known password length, brute force character in place?
added 1 characters in body
Oct
12
reviewed Reviewed OpenBSD, fbtab and X Window
Oct
12
revised Known password length, brute force character in place?
added 76 characters in body
Oct
12
comment Known password length, brute force character in place?
+1 for the board game :-). It's interesting to note that some padding oracle attacks retrieve the plaintext message one byte at a time. Tom Ptacek calls this "Hollywood style" cracking.
Oct
12
answered Known password length, brute force character in place?
Oct
11
answered How can you judge the physical security of a padlock?
Oct
11
comment SSL VPN placement strategies
Could you clarify how option 1 ("behind a firewall") is different from options 2 and 3? Aren't the internal network and DMZ "behind a firewall"? Also, you didn't include the option of the VPN server being connected to the Internet (i.e. not being behind a firewall). Perhaps that's what you intended in 1?
Oct
10
comment Decryption on AES when the same key and IV are used
@CodesInChaos Thanks - I've corrected the answer accordingly.
Oct
10
revised Decryption on AES when the same key and IV are used
Corrected based on comments
Oct
10
answered Decryption on AES when the same key and IV are used
Oct
10
comment Decryption on AES when the same key and IV are used
What mode of operation are you using? CBC, counter mode, OFB etc?
Oct
9
comment Distributed XAdES-X and XAdES-A signatures over multiple documents
Yes, every new form needs to be signed. It's not clear to me why this would make verification more difficult.
Oct
9
comment Why do so many embedded devices use shared keys?
@Chris Lively For the purpose of encryption one doesn't need a cert - all one needs it a priv/publ key pair (send the pub key to the client who will send back a random session key encrypted with that pub key). But this is susceptible to a man-in-the-middle attack - it doesn't prevent an attacker from intercepting communications, sending his own pub key to the client. For this you need a cert that will prove to the client that the public key actually belongs to the server he intended communicating with. Even a non-EV cert proves "identity" - it identifies the pub key with a specific domain.
Oct
8
answered By default, does a linksys router log connections?