1,659 reputation
818
bio website paul-ebermann.tumblr.com
location Berlin, Germany
age
visits member for 4 years, 2 months
seen 13 mins ago

Don't fear to edit my posts: even if I have more reputation than you, I do make mistakes.

I'm now also a Moderator Pro Tempore (= until the first elections) at Cryptography Stack Exchange: feel free to come around and ask some cryptography questions.


My personal name is spoken as /ˈpawlo/ (IPA), in English this would be written similar to Powlo, I think (i.e. the vowels are ow and o), with an accent on the before-last syllable (which is the first in this case). It's the Esperanto form of my given name.

The photo shows my shadow, taken at night. My camera sometimes seems to forget all the other frequencies and only stores the green ones.

My current main private programming project is the game of fencing, an online abstract turn based strategy game. Implemented as a Java applet, using git as a version control system.


Some more links:


1d
comment Should I use a Certificate Revocation List?
@user3765109 You can use commercial CAs even with non-browser clients. Either you can access the system's list of trusted CAs (if there is one), or include the needed root CA(s) in your software (assuming you are controlling the client).
Apr
6
comment What's the safest way to transmit a message to another client through a server hidden from high level malicious users?
Ah, I understood that you want to whisper on an airplane.
Apr
6
comment What's the safest way to transmit a message to another client through a server hidden from high level malicious users?
I would not count on the NSA not also having a copy of my DNA, even more if I'm Edward Snowden or his son.
Apr
6
comment What's the safest way to transmit a message to another client through a server hidden from high level malicious users?
I don't see how the airplane helps here.
Mar
30
comment Can 'cracked' product keys harm the user in any way?
Using a product key for encryption of user data is a bad idea – it means that the company can also read this user data.
Mar
30
comment Can 'cracked' product keys harm the user in any way?
What is your definition of "cracked software"?
Mar
17
comment Is using the concatenation of multiple hash algorithms more secure?
@fgrieu While this might not answer the question directly, I think it is a useful addition to your answer, since readers might want to use such a construction for password hashes, and now know not to do so.
Mar
17
comment Is using the concatenation of multiple hash algorithms more secure?
A related question (by me) on our sister site Cryptography Stack Exchange: Guarding against cryptanalytic breakthroughs: combining multiple hash functions
Mar
12
comment Is it legal to start a private website for you and your friends to hack?
Make sure you own the whole server of your site, to not cause collateral damage to other sites.
Mar
1
comment VeraCrypt/TruCrypt - I can't understand why you'd want to create a “hidden” volume…?
So if the outer volume was changed recently, but none of the files in it, then it is clear that there must be a hidden volume in it, right?
Feb
25
comment When signing email with GPG, how does verification by the receiver work?
Your second sentence ("Encryption and decryption can occur with either [public or private key]") and most of the rest of the post is only valid for some public key cryptosystems (like RSA), not for all of them (e.g. DSA has no encryption at all, though ElGamal can use the same keys, and public and private keys look quite different).
Feb
12
comment Can you say that since one time pad encryption is unbreakable, it is the best if used properly?
I doubt that "compression + hash" is really a way to provide integrity comparable to the security of the OTP. I'm not sure what the use of the compression step is supposed to be, and the hash alone doesn't provide protection against a known-plaintext MiTM attack. You should at least use a MAC (with additional key input), and I think there are MAC algorithms which have a similar theoretical protection level as OTP ... I would have to look that up, though.
Feb
12
awarded  Yearling
Feb
11
comment Why can protocols on higher layers be left unchanged?
So plain HTTP (without SSL/TLS) has an empty presentation layer?
Jan
22
comment How is hashing safe if a given string always generates the same hash?
Now one can find your new hash with Google ;-)
Jan
8
comment Does HTTPS encryption on a site prevent the NSA from knowing you visited its domain / the URL?
Are you sure that there are no Referrer-headers to xsite? (I guess this might depend on the browser.)
Sep
30
awarded  Explainer
Sep
24
awarded  Autobiographer
Sep
5
comment Is encrypting SALT with given user's password more secure?
Actually, there are some hash function constructions where hashing one block is basically using this block as a key to encrypt the previous hashing result.
Jul
22
comment What is a good analogy to explain to a layman why passwords should be hashed?
This codebook is written in Braille?