673 reputation
bio website
visits member for 4 years, 2 months
seen Jan 28 at 1:10

comment Why shouldn't we roll our own?
The smartest person I know of who created a bad cryptographic primitive (in this case, a block cipher) is Dan Sleator, who is a highly-regarded theoretical computer scientist from Carnegie Mellon. He made a Feistel cipher out of a bad round function for his ICC chess server (acsac.org/2005/papers/57.pdf)
comment Looking for example of well-known app using unsalted hashes
@CodeInChaos: Done.
comment Using computer random number generators to produce keys, it is secure?
My point is: once you gather enough unpredictable entropy, it does not matter if it came from software or hardware or from the moon. It's a matter of philosophy as to whether anything is "truly unpredictable"; that depends on whether the universe is deterministic or not. But for practical concerns, it does not matter: as long as bits are infeasible to predict given the inherent physical limitations we face, then it's good enough.
comment Using computer random number generators to produce keys, it is secure?
How is a pure software solution based on inter-keystroke timings, time of day, process id, current weather, current stock indexes, etc., inferior to a noisy diode? The key is really introducing enough hard-to-predict seed such that pseudo-random effectively becomes truly-random.
comment Is Schneier's “Applied Cryptography” current?
The typo was not in Schneier's book itself; the typo was in the Chinese translation of this book that caused XioaYun Wang's team to get the endianness wrong it their original MD5 attack.
comment Complexity of web certificate attacks
Most of the relevant papers can be found at cryptography.hyperlink.cz/MD5_collisions.html
comment Is a large number of RSA-encrypted files a vulnerability?
what is a "public key passphrase"? Public keys are normally not protected whatsoever.
comment Should I bother teaching buffer overflows any more?
@mrnap We get 10 weeks to teach a security class
comment Should I bother teaching buffer overflows any more?
@mrnap I've been teaching buffer overflows and shellcode writing for 13 years. As most people in the security arena know, this was once the #1 vulnerability (5-10 years ago) and has since been supplanted by other vulnerabilities. I asked the question above to poll professionals on the continued value of teaching these techniques (which takes a lot of time) when other topics are becoming more relevant. You criticize me for even asking the question: believe me, if I'm not constantly questioning the impact of what I'm teaching, then I'm not doing my job.