1,649 reputation
818
bio website paul-ebermann.tumblr.com
location Berlin, Germany
age
visits member for 4 years, 1 month
seen 3 hours ago

Don't fear to edit my posts: even if I have more reputation than you, I do make mistakes.

I'm now also a Moderator Pro Tempore (= until the first elections) at Cryptography Stack Exchange: feel free to come around and ask some cryptography questions.


My personal name is spoken as /ˈpawlo/ (IPA), in English this would be written similar to Powlo, I think (i.e. the vowels are ow and o), with an accent on the before-last syllable (which is the first in this case). It's the Esperanto form of my given name.

The photo shows my shadow, taken at night. My camera sometimes seems to forget all the other frequencies and only stores the green ones.

My current main private programming project is the game of fencing, an online abstract turn based strategy game. Implemented as a Java applet, using git as a version control system.


Some more links:


Mar
17
comment Is using the concatenation of multiple hash algorithms more secure?
@fgrieu While this might not answer the question directly, I think it is a useful addition to your answer, since readers might want to use such a construction for password hashes, and now know not to do so.
Mar
17
comment Is using the concatenation of multiple hash algorithms more secure?
A related question (by me) on our sister site Cryptography Stack Exchange: Guarding against cryptanalytic breakthroughs: combining multiple hash functions
Mar
12
comment Is it legal to start a private website for you and your friends to hack?
Make sure you own the whole server of your site, to not cause collateral damage to other sites.
Mar
1
comment VeraCrypt/TruCrypt - I can't understand why you'd want to create a “hidden” volume…?
So if the outer volume was changed recently, but none of the files in it, then it is clear that there must be a hidden volume in it, right?
Feb
25
comment When signing email with GPG, how does verification by the receiver work?
Your second sentence ("Encryption and decryption can occur with either [public or private key]") and most of the rest of the post is only valid for some public key cryptosystems (like RSA), not for all of them (e.g. DSA has no encryption at all, though ElGamal can use the same keys, and public and private keys look quite different).
Feb
12
comment Can you say that since one time pad encryption is unbreakable, it is the best if used properly?
I doubt that "compression + hash" is really a way to provide integrity comparable to the security of the OTP. I'm not sure what the use of the compression step is supposed to be, and the hash alone doesn't provide protection against a known-plaintext MiTM attack. You should at least use a MAC (with additional key input), and I think there are MAC algorithms which have a similar theoretical protection level as OTP ... I would have to look that up, though.
Feb
12
awarded  Yearling
Feb
11
comment Why can protocols on higher layers be left unchanged?
So plain HTTP (without SSL/TLS) has an empty presentation layer?
Jan
22
comment How is hashing safe if a given string always generates the same hash?
Now one can find your new hash with Google ;-)
Jan
8
comment Does HTTPS encryption on a site prevent the NSA from knowing you visited its domain / the URL?
Are you sure that there are no Referrer-headers to xsite? (I guess this might depend on the browser.)
Sep
30
awarded  Explainer
Sep
24
awarded  Autobiographer
Sep
5
comment Is encrypting SALT with given user's password more secure?
Actually, there are some hash function constructions where hashing one block is basically using this block as a key to encrypt the previous hashing result.
Jul
22
comment What is a good analogy to explain to a layman why passwords should be hashed?
This codebook is written in Braille?
Mar
27
answered Is Google overreaching by forcing me to use TLS?
Feb
24
awarded  Nice Answer
Feb
12
awarded  Yearling
Oct
18
comment Could SQRL really be as secure as they say?
Could you elaborate about your phishing site attack? (I think I puzzled together how this is supposed to work from the comments, but it would be better clearly mentioned in the answer.)
Jul
3
comment SSL vs Encryption
There is no such thing as an "AES public key infrastructure".
Jun
9
comment Key distribution and key exchange for simple secure FTP implementation
Do you actually want to use SSL/TLS for the encryption layer (then your question should solve itself, as SSL takes care of this) or do you want to implement the crypto layer yourself? (I recommend you don't.)