meta user
network profile
| bio | website | goodenoughsecurity.blogspot.c… |
|---|---|---|
| location | Jerusalem, Israel | |
| age | 39 | |
| visits | member for | 9 months |
| seen | Mar 13 at 7:51 | |
| stats | profile views | 47 |
Digital security professional and manager. Work on chip hardware security (smart cards, USB tokens, consumer electronics), DRM, proprietary cryptography and protocols, embedded software security, end-to-end system security and security policy.
IT security (especially password security) is a hobby.
|
Oct 12 |
comment |
Known password length, brute force character in place? +1 for the board game :-). It's interesting to note that some padding oracle attacks retrieve the plaintext message one byte at a time. Tom Ptacek calls this "Hollywood style" cracking. |
|
Oct 12 |
answered | Known password length, brute force character in place? |
|
Oct 11 |
answered | How can you judge the physical security of a padlock? |
|
Oct 11 |
comment |
SSL VPN placement strategies Could you clarify how option 1 ("behind a firewall") is different from options 2 and 3? Aren't the internal network and DMZ "behind a firewall"? Also, you didn't include the option of the VPN server being connected to the Internet (i.e. not being behind a firewall). Perhaps that's what you intended in 1? |
|
Oct 10 |
comment |
Decryption on AES when the same key and IV are used @CodesInChaos Thanks - I've corrected the answer accordingly. |
|
Oct 10 |
revised |
Decryption on AES when the same key and IV are used Corrected based on comments |
|
Oct 10 |
answered | Decryption on AES when the same key and IV are used |
|
Oct 10 |
comment |
Decryption on AES when the same key and IV are used What mode of operation are you using? CBC, counter mode, OFB etc? |
|
Oct 9 |
comment |
Distributed XAdES-X and XAdES-A signatures over multiple documents Yes, every new form needs to be signed. It's not clear to me why this would make verification more difficult. |
|
Oct 9 |
comment |
Why do so many embedded devices use shared keys? @Chris Lively For the purpose of encryption one doesn't need a cert - all one needs it a priv/publ key pair (send the pub key to the client who will send back a random session key encrypted with that pub key). But this is susceptible to a man-in-the-middle attack - it doesn't prevent an attacker from intercepting communications, sending his own pub key to the client. For this you need a cert that will prove to the client that the public key actually belongs to the server he intended communicating with. Even a non-EV cert proves "identity" - it identifies the pub key with a specific domain. |
|
Oct 8 |
answered | By default, does a linksys router log connections? |
|
Oct 8 |
comment |
Why do so many embedded devices use shared keys? The only goal of a certificate is to prove identity. Self signed certificates are signed by a secret private key and in this way prove identity (albeit only to someone who trusts the owner of that secret private key). |
|
Oct 8 |
comment |
Why do so many embedded devices use shared keys? The device can generate it's own key and certificate. But the device still needs to receive from outside the private key used to sign it's certificate. This certificate signing key can't be generated by the device itself. The goal of having a certificate is to be able to prove the identity of a device. This can't be achieved by randomly generating a key and certificate; since anyone can do this it doesn't prove identity. To prove identity someone trusted needs to certify that this certificate belongs to this device. If this isn't clear I would suggest you read the Wikipedia article on PKI. |
|
Oct 8 |
answered | Distributed XAdES-X and XAdES-A signatures over multiple documents |
|
Oct 8 |
comment |
Why do so many embedded devices use shared keys? +1 for the link |
|
Oct 8 |
answered | Why do so many embedded devices use shared keys? |
|
Oct 7 |
revised |
Shared hosting mail server, Thunderbird and encryption Minor corrections |
|
Oct 7 |
answered | Shared hosting mail server, Thunderbird and encryption |
|
Oct 7 |
comment |
Stack smashing keep getting segmentation fault Have you tried running this in a debugger to see at what stage in the code the segmentation fault occurs? |
|
Oct 7 |
comment |
Does a working JTAG diagnostics port on Android phone add unnecessary risk? @tylerl I don't agree with the statement that it's impossible to "protect a device that is in the attacker's physical possession." It's extremely difficult and expensive - but not impossible. Any FIPS 140-2 security level 4 device is supposed to be secure even if it's in the attacker's physical possession for a substantial amount of time (this includes many HSMs). A good example is the PS3, which was in the attacker's hands for four years before its DRM was hacked (see events.ccc.de/congress/2010/Fahrplan/attachments/…). |
