658 reputation
615
bio website
location
age
visits member for 3 years, 5 months
seen Jul 17 at 20:10

Feb
16
awarded  Yearling
Nov
3
asked How is WEP/WPA2 key derived?
Oct
27
accepted Is it “standard” to SMS passwords?
Oct
27
accepted Guarding against rogue certificates
Oct
27
asked Is it “standard” to SMS passwords?
Sep
19
asked Guarding against rogue certificates
Jun
30
comment Using computer random number generators to produce keys, it is secure?
My point is: once you gather enough unpredictable entropy, it does not matter if it came from software or hardware or from the moon. It's a matter of philosophy as to whether anything is "truly unpredictable"; that depends on whether the universe is deterministic or not. But for practical concerns, it does not matter: as long as bits are infeasible to predict given the inherent physical limitations we face, then it's good enough.
Jun
29
comment Using computer random number generators to produce keys, it is secure?
How is a pure software solution based on inter-keystroke timings, time of day, process id, current weather, current stock indexes, etc., inferior to a noisy diode? The key is really introducing enough hard-to-predict seed such that pseudo-random effectively becomes truly-random.
Apr
18
comment Is Schneier's “Applied Cryptography” current?
The typo was not in Schneier's book itself; the typo was in the Chinese translation of this book that caused XioaYun Wang's team to get the endianness wrong it their original MD5 attack.
Apr
18
answered Is Schneier's “Applied Cryptography” current?
Apr
13
accepted Looking for example of well-known app using unsalted hashes
Apr
11
comment Complexity of web certificate attacks
Most of the relevant papers can be found at cryptography.hyperlink.cz/MD5_collisions.html
Apr
11
answered Complexity of web certificate attacks
Apr
9
asked Looking for example of well-known app using unsalted hashes
Mar
30
awarded  Nice Question
Mar
5
comment Is a large number of RSA-encrypted files a vulnerability?
what is a "public key passphrase"? Public keys are normally not protected whatsoever.
Mar
4
comment Should I bother teaching buffer overflows any more?
@mrnap We get 10 weeks to teach a security class
Mar
3
comment Should I bother teaching buffer overflows any more?
@mrnap I've been teaching buffer overflows and shellcode writing for 13 years. As most people in the security arena know, this was once the #1 vulnerability (5-10 years ago) and has since been supplanted by other vulnerabilities. I asked the question above to poll professionals on the continued value of teaching these techniques (which takes a lot of time) when other topics are becoming more relevant. You criticize me for even asking the question: believe me, if I'm not constantly questioning the impact of what I'm teaching, then I'm not doing my job.
Mar
3
accepted Should I bother teaching buffer overflows any more?
Mar
1
awarded  Supporter