Reputation
681
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
6 11
Impact
~61k people reached

  • 0 posts edited
  • 0 helpful flags
  • 14 votes cast
May
1
comment Best practices for Tor use, in light of released NSA slides
If you can rule out the case that your adversary is mighty enough and willing to tap on the line from your location to your ISP or your ISP's being somehow coerced to cooperate with your adversary, then I believe that Tor would indeed work quite fine. Otherwise, since your emails initially carry your IP-address, your identity would be clearly revealed through the said kind of tapping and a way-out would be to attempt to use a foreign IP-address, e.g. one of a call-shop, to send your emails, if you could exclude your being under surveillance while doing so.
Apr
28
comment How do connection relays strengthen anonymity?
IMHO it is not feasible to hide your identity if your messages go in the ordinary manner from you to your ISP and they are tapped on the way to ISP or examined by the ISP itself. So remailers like Tor are (despite the believes of their supporters) useless against a really mighty advesary. The only way out is to attempt to use a neutral foreign IP address like one of an Internet cafe. I have argued for this since quite some time, see e.g. the Epilogue of s13.zetaboards.com/Crypto/topic/7234475/1/
Apr
25
comment What prevents ISPs from tracking chain of proxies' (or Tor relays') IP addresses?
Thanks very muvch for this hint. I only hope that those TOR users whose anonymity is really really critical don't neglect to read its FAQ.
Apr
23
comment AES step by step
Doesn't CJK need only two bytes for each symbol?
Apr
22
comment What prevents ISPs from tracking chain of proxies' (or Tor relays') IP addresses?
IMHO if that's not perfect then users of Tor (or similar remailers) should preferably be informed of that fact, since it couldn't be exluded that there is a non-trivial percentage of the users who really need genuine anonymity.
Apr
22
comment What prevents ISPs from tracking chain of proxies' (or Tor relays') IP addresses?
But isn't it that "you are talking to a Tor node", which your ISP knows, a non-trivial information in his possession?
Apr
19
comment Are RSA Key Pairs unique?
I am afraid that I had not clearly formulated my last comment. By manipulations I meant malicious acts of hackers or other adversaries concerning the keys that the common users somehow obtain. See my post elsewhere: s13.zetaboards.com/Crypto/topic/7487358/1
Apr
19
comment Are RSA Key Pairs unique?
A. K. Lenstra et al. however found duplicates in practice. The cause they said was not known. IMHO it couldn't be excluded that that resulted from manipulations. See infoscience.epfl.ch/record/174943/files/eprint.pdf
Apr
18
comment Functions in common server-side languages which are used to execute code
In LISP and some similar functional PLs one could build an arbitrary string and apply an eval on it for execution as code.
Apr
17
comment Is it possible for one Division of an organization to be certified ISO 27001?
I suggest that you would better ask the institutions that actually perform such certifications. In Germany e.g. tuev-sued.de/management-systeme/it-dienstleistungen/iso-27001
Apr
12
comment How to test my anonymity?
A sufficiently mighty adversary may tap at the entrance points of all nodes of a remailer network, so that assuming anonymity via use of remailers is an Illusion in our post-Snowden era IMHO.
Apr
11
comment How to test my anonymity?
You yourself mentioned ISP recordings. In that case (or equivalently when someone manages to tap at the entrance point of ISP) your email contains your IP address and thus it is surely revealed that you have sent out the message in question. IMHO there is nothing you can do to avoid that sort of risk, if you send the message from your own computer. That is, to be anonymous in case of really mighty adversaries, you have to employ a neutral IP address somehow (cf. some humble suggestions I posted in the Epilogue section of s13.zetaboards.com/Crypto/topic/7234475/1/)
Apr
10
comment Why shouldn't we roll our own?
Bruce Schneier has an article "Memo to the Amateur Cipher Designer". It highly discourages one's rolling one's own cipher. But this leads naturally to the thinking that everything of crypto is to be done by the experts and others should only watch what they are doing. If that's so, I like to ask why we should even take our time to watch what they do at all, since everything is taken care of for us in the best way, The experts surely have vast and profound knowledges, but there is a minute albeit non-zero probability that hints and questions of the laymen could benefit the work of the experts.
Mar
17
comment Setup a private VPN for family in China?
I don't have knowledge of VPN. But I suppose stego could be at least a fine alternative for you, if your stego scheme is secure enough and the common means of stego with pictures as cover doesn't lead to suspicions when very frequently pictures are sent. I must say that I also know not much about stego via pictures to be able to recommend you any such schemes. On the other hand, I have two stego schemes of my own with normal texts as covers, albeit unfortunately with very low efficiency: s13.zetaboards.com/Crypto/topic/6939954/1/ and s13.zetaboards.com/Crypto/topic/7338098/1/
Mar
15
comment steganography - digital application?
I have 2 Python codes that presumably coud well satistisfy your requirements excepting eventually with regards to efficiency in practice: s13.zetaboards.com/Crypto/topic/6939954/1 and s13.zetboards.com/Crypto/topic/7338098/1
Mar
12
comment Is C a good choice for security-related software any longer?
Python isn't a "safe" language like ADA, i.e. without care and discipline there is a fairly non-trivial probability of committing errors with it IMHO. On the other hand, it's obviously true in general that coding in languages like Python, which can operate on integers of arbitrary size in the familiar infix notation, could significantly reduce the time of programming and debugging and consequently enable the designer of a crypto software to dedicate more efforts to ensure the correctness of the algorithms underlying the software, which is extremely vitally impotant in my humble view.
Mar
6
comment Will quantum computers render AES obsolete?
If I don't err from what I read from literatures, quantum computers could only reduce the block length (and key length) "effectively" to one half of the nominal values. Thus I recently pointed out a simply way to do that doubling for a given block cipher in order to counterbalance the potential risk of adversary's having quantum computers available. See s13.zetaboards.com/Crypto/topic/7504586/1/
Mar
6
comment Using optical illusions as CAPTCHA
I don't yet fully understand, since "flaws" could somehow be simulated by a machine IMHO.
Mar
1
comment Password based Asymmetric Key generation
[Addendum:] To render my earlier comment clear: To get the advantages of asymmetric encryption you have anyway to render your public key public. Once that is done, there is no need/sense at all to keep anything in order to be able to repeat the generation process. That's why I argued that you don't need a password (something to be secretly and securely kept). For RSA key generation with provable primes employing system randomness, I have a Python code at s13.zetaboards.com/Crypto/topic/7234475/1/
Mar
1
comment Password based Asymmetric Key generation
If you have a password that has sufficient entropy against bruteforcing, you could use it as a seed to an appropriate PRNG to generate large numbers to be sieved by primality tests to obtain a pair of primes to be the modulus of RSA keys. But why do you need to choose a password? You could much better (secure) use system randomness for getting the large numbers and you can also use an algorithm to generate provable primes instead of the statistically highly probable primes.