1,629 reputation
718
bio website paul-ebermann.tumblr.com
location Berlin, Germany
age
visits member for 3 years, 9 months
seen 11 hours ago

Don't fear to edit my posts: even if I have more reputation than you, I do make mistakes.

I'm now also a Moderator Pro Tempore (= until the first elections) at Cryptography Stack Exchange: feel free to come around and ask some cryptography questions.


My personal name is spoken as /ˈpawlo/ (IPA), in English this would be written similar to Powlo, I think (i.e. the vowels are ow and o), with an accent on the before-last syllable (which is the first in this case). It's the Esperanto form of my given name.

The photo shows my shadow, taken at night. My camera sometimes seems to forget all the other frequencies and only stores the green ones.

My current main private programming project is the game of fencing, an online abstract turn based strategy game. Implemented as a Java applet, using git as a version control system.


Some more links:


Sep
30
awarded  Explainer
Sep
24
awarded  Autobiographer
Sep
5
comment Is encrypting SALT with given user's password more secure?
Actually, there are some hash function constructions where hashing one block is basically using this block as a key to encrypt the previous hashing result.
Jul
22
comment What is a good analogy to explain to a layman why passwords should be hashed?
This codebook is written in Braille?
Mar
27
answered Is Google overreaching by forcing me to use TLS?
Feb
24
awarded  Nice Answer
Feb
12
awarded  Yearling
Oct
18
comment Could SQRL really be as secure as they say?
Could you elaborate about your phishing site attack? (I think I puzzled together how this is supposed to work from the comments, but it would be better clearly mentioned in the answer.)
Jul
3
comment SSL vs Encryption
There is no such thing as an "AES public key infrastructure".
Jun
9
comment Key distribution and key exchange for simple secure FTP implementation
Do you actually want to use SSL/TLS for the encryption layer (then your question should solve itself, as SSL takes care of this) or do you want to implement the crypto layer yourself? (I recommend you don't.)
Jun
9
comment Key distribution and key exchange for simple secure FTP implementation
Welcome to Cryptography Stack Exchange. You might want to get some inspiration from the existing SFTP protocol (which is a binary file transfer protocol which is usually used in a "channel" inside a SSH connection, but could be used over another kind of secure transport too.) But please don't call your protocol (or its implementation) SFTP if it isn't actually the protocol known with this name.
Apr
6
comment Is my developer's home-brew password security right or wrong, and why?
@qarma HMAC is using the secret (i.e. the password) twice, this algorithm is using it only once.
Apr
3
comment How quickly can these password schemes really be beaten?
@StephenTouset Good point, I added some text relating this to the answer. Seems I missed this part of the question.
Apr
3
revised How quickly can these password schemes really be beaten?
expanded
Apr
3
revised How quickly can these password schemes really be beaten?
add some information from the comments.
Apr
2
comment Password and Generated number - How does it work?
I didn't downvote, but I suppose someone didn't like the "RTFM" attitude (which one might read from your answer).
Apr
2
comment PINsentry PRNG and Bank Cards
That device is just a keyboard + screen extension for your card, the calculations are happening in the card.
Feb
12
awarded  Yearling
Jan
27
comment XKCD #936: Short complex password, or long dictionary passphrase?
For your password database, you should use a salt anyway, so rainbow tables are of no use.
Jan
4
comment Shouldn't GPG key fetching use a secure connection?
@humanityANDpeace In the case where there is no trusted path to (the key of) the sender of your message, you can't even trust that the message is really from this person. (The same is valid for encryption keys, with sender → receiver.) Anyone can upload a key with any name to the key server, and anyone else can express trust to this key, whether or not the connection is secured by TLS. The encrypted version of the protocol is there so nobody (other than the keyserver) knows which keys you request, I suppose.