531 reputation
39
bio website
location
age
visits member for 2 years, 11 months
seen 2 days ago

Aug
24
comment A potential possibility of improvement of PKI for personal communications
@SEJPM: Thanks for the informations. My issue is however to have a public key generated by a person (of length of his own choice) be certified by the authority, which IMHO could be most simply done, if the authority just enters that key into a publically accessible list maintained by it (without indirectly via a digital certificate from the authority, which would unnecessarily complicate the security issue in my view.)
Aug
23
comment A potential possibility of improvement of PKI for personal communications
@SEJPM: Wiki says: "Das Erstellen von qualifizierten elektronischen Signaturen (QES) ist aber derzeit noch nicht möglich." Anyway, I don't yet see how one would (without a common CA) have his self-generated public key be certified by the German authority. Could you please say something more concrete?
Aug
22
asked A potential possibility of improvement of PKI for personal communications
Aug
12
comment How do session keys in public key cryptography work?
Communications of the common people are normally of fairly low volume. I employed my own coding to encrpt and decrypt messages of 10000 characters with RSA alone, with measured cpu time of 2 and 4 sec respectively, which is IMHO practically acceptable.
Feb
11
comment How does Tor guarantee anonymity of Tor network?
[OT] Just want to remark that if one sends encrypted stuffs then, in case the bad guys could tap at one's provider evidently no anonymity could ever be achieved excepting perhaps using e.g. linguistic steganography. But the bit embedding rate of that is unfortunately very low.
Dec
11
comment Who defined the term “fully homomorphic encryption”?
I conjecture that at first a number of scientists found schemes that are only partially homomorphic and hence Gentry's scheme obtained that distinguishing qualification.
Nov
4
comment How can the private key be obtained in PKI without alerting a third party?
The best is that you generate yourself the keys on a sufficiently secured computer. The trust on the security (freedom of backdoors and errors) of the software used to generate the keys could be an essential issue. To be safe, you have to carefully examine an open-source package for that. (BTW I have a fairly short code for RSA key generation available at s13.zetaboards.com/Crypto/topic/7234475/1/ which you may like to look at.)
Oct
21
comment Is there anything preventing the NSA from becoming a root CA?
In this context I like to cite once again (I did in a post on 23.9.2014) Ross J. Anderson who wrote in Sec.19.5.3 of his well-known book "Security Engineering", Wiley, 2001, the following: "In short, while public key infrastructures can be useful in some applications, they are unlikely to be the universal solution to security problems as their advocates seem to believe. They don't tackle most of the really important issues at all."
Sep
14
awarded  Yearling
Jul
2
awarded  Curious
Jun
20
revised Trust on certificate authorities
added 291 characters in body
Jun
20
asked Trust on certificate authorities
May
23
awarded  Popular Question
May
5
awarded  Popular Question
Sep
14
awarded  Yearling
Jul
4
comment Control over IT security
Of course everything at the end depends on one's own evaluation/estimation of different matters in the society. Apology that I have thus to say that there could be no well meaningful argumentation in the current context in the sense of e.g. some topics in mathematics and I am afraid we would be eventually arguing like persons of different religions (or over tastes and colours).
Jul
4
comment Control over IT security
I fully agree that NIST has contributed very much to IT security, e.g. the AES standard for encryption. In my personal view, national standardization bodies could further contribute to IT security by issuing certificates to software and hardware products that are relevant to IT security. (I happened to know long ago that the German standardization body issues certificates certifying the standard conformity of programming language compilers. The same work evidently should be doable for IT security software and hardware IMHO.)
Jul
4
comment Control over IT security
@Xander and schroeder: Well, of course nobody can be infalliable. But generally in countries with comparatively good functioning governments the employees of governments are under good oversight to do their jobs properly. (In Germany, for example, government employees have also to swear an oath upon being employed.) Certainly one could question whether all such measures really help. But then a question in the other direction is: Why would one consider that the lack of such measures be better? For me personally anyway the said hypothetical scenario without FDA is quite clear.
Jul
4
comment Security of remailers
[Addendum] The tapping points could be more conveniently situated at the providers of the first nodes of remailer chains, if I don't err.
Jul
4
comment Security of remailers
Thanks. I am concerned about the location of the router of the first node that one sends the message to. Since such first nodes of remailer chains are certainly a very tiny fraction of all Internet nodes, it would be advantagesous IMHO for the agencies to concentrate their tapping activities there.