Reputation
763
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
8 19
Newest
 Critic
Impact
~16k people reached

  • 0 posts edited
  • 0 helpful flags
  • 113 votes cast
Mar
21
comment Use openssl to individually verify components of a certificate chain
My question was how to verify g1 signed g0. Involving g2 doesn't make sense to me here, nor does involving EquiFax's root cert from the trusted store. Can I not just verify this one sig without having to invoke the rest of the chain to some self-signed root? Or is this not supported by OpenSSL?
Mar
16
comment How to verify a signature of one entity by another using OpenSSL CLI?
@dave_thompson_085 Thank you; very helpful. Rather than clutter this thread with ancillary comments, I have started a new question at security.stackexchange.com/questions/117651/… Would be very grateful if you could weigh in.
Mar
16
comment How to verify a signature of one entity by another using OpenSSL CLI?
Curiously, s_client -connect www.google.com:443 fails validation with the same chain. I guess it doesn't use the certs in /etc/ssl/certs like verify does?!
Mar
16
comment How to verify a signature of one entity by another using OpenSSL CLI?
I think you nailed it! I didn't set up the same chain (it would require I spin up multiple local CAs), but I did notice that renaming /etc/ssl/certs so that OpenSSL couldn't find the relevant roots did result in failed verification. And then adding explicit pointers to the cert files did result in valid verification. This is consistent with your answer above! Cheers.
May
19
comment Which is safer, GSM or CDMA?
Man, relying on spread spectrum as "security" is really a stretch.
Nov
28
comment Why shouldn't we roll our own?
The smartest person I know of who created a bad cryptographic primitive (in this case, a block cipher) is Dan Sleator, who is a highly-regarded theoretical computer scientist from Carnegie Mellon. He made a Feistel cipher out of a bad round function for his ICC chess server (acsac.org/2005/papers/57.pdf)
Jun
7
comment Looking for example of well-known app using unsalted hashes
@CodeInChaos: Done.
Jun
30
comment Using computer random number generators to produce keys, it is secure?
My point is: once you gather enough unpredictable entropy, it does not matter if it came from software or hardware or from the moon. It's a matter of philosophy as to whether anything is "truly unpredictable"; that depends on whether the universe is deterministic or not. But for practical concerns, it does not matter: as long as bits are infeasible to predict given the inherent physical limitations we face, then it's good enough.
Jun
29
comment Using computer random number generators to produce keys, it is secure?
How is a pure software solution based on inter-keystroke timings, time of day, process id, current weather, current stock indexes, etc., inferior to a noisy diode? The key is really introducing enough hard-to-predict seed such that pseudo-random effectively becomes truly-random.
Apr
18
comment Is Schneier's “Applied Cryptography” current?
The typo was not in Schneier's book itself; the typo was in the Chinese translation of this book that caused XioaYun Wang's team to get the endianness wrong it their original MD5 attack.
Apr
11
comment Complexity of web certificate attacks
Most of the relevant papers can be found at cryptography.hyperlink.cz/MD5_collisions.html
Mar
5
comment Is a large number of RSA-encrypted files a vulnerability?
what is a "public key passphrase"? Public keys are normally not protected whatsoever.
Mar
4
comment Should I bother teaching buffer overflows any more?
@mrnap We get 10 weeks to teach a security class
Mar
3
comment Should I bother teaching buffer overflows any more?
@mrnap I've been teaching buffer overflows and shellcode writing for 13 years. As most people in the security arena know, this was once the #1 vulnerability (5-10 years ago) and has since been supplanted by other vulnerabilities. I asked the question above to poll professionals on the continued value of teaching these techniques (which takes a lot of time) when other topics are becoming more relevant. You criticize me for even asking the question: believe me, if I'm not constantly questioning the impact of what I'm teaching, then I'm not doing my job.