142 reputation
9
bio website bernd.eckenfels.net
location Karlsruhe, Germany
age 43
visits member for 2 years, 4 months
seen Mar 20 at 0:43

Chief Architect at a german ISV. Java Guru, IT-Security freak, married and pirate.


Mar
20
comment 1024-bit DHE vs 2048-bit RSA
It is fixed in Java 8 (docs.oracle.com/javase/8/docs/technotes/guides/security/… and docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/…)
Mar
6
awarded  Revival
Feb
11
awarded  Tumbleweed
Feb
4
comment Is it safe to include timestamps in error codes that are shown to the users?
You could return a short "request ID" instead. If you really have a user who wants to be nice and contact support about the error, thay can report that XID. (You could even add a "sent mail" link which includes it. Having said that, the Date: header with second resolution should be fine.
Feb
4
comment What is the ideal HMAC message format if message is an array?
actually in order to ensure order you need to sort it by key with a fixed comparator. And remeber to also specify the encoding. Personally I would concatenate zero terminated UTF8 bytes (if \0 cannot occur in data).
Feb
4
asked LDAP Authentication and Sessions
Feb
4
answered Should we be checking password restraints on log in forms?
Nov
5
awarded  Excavator
Nov
5
revised What is ECDHE-RSA?
use the correct algorithm
Nov
5
suggested approved edit on What is ECDHE-RSA?
Nov
4
answered How widely deployed is TLS with cipher ECDHE?
Oct
17
comment What web browsers support OCSP stapling? Are the privacy and performance features the same?
@bethlakshmi SSL has this revocation problem. CRLs get longer and longer. OCSP is a solution for that but it has the privacy (and soft fail) problem. Both can be solved with OCSP stabling (and must staple extension).
Aug
31
comment Why should I sign data that's already encrypted?
No, beeing able to decrypt it is no gurantee for beeing authentic. Trivial example, if you have a message 0 or 1 (yes or no) and you sent it, somebody can flip the bits in the message without beeing able to decrypt or encrypt it and still reverted the meaning of your message. Thats why my AE answer below is relevant.
Aug
31
comment Why should I sign data that's already encrypted?
BTW, the topic of authenticated encryption (AE) is a quite hot topic, because it was neglected in the past by many implementations. It is especially of a problem, if the encrypted data actually is processed (allowing an attacker to take advantage of bugs in the processor like memory overflow in decompression or executing unwanted commands).
Jun
5
answered HMAC Based Request Signing - Storing the Salt
May
7
answered Logging “password with counter” use
Apr
25
comment SSL cert minimize downtime key rotation strategy
Important: if you generate a new CSR you also need to generate a new key. It is not uncommon to request new certrificates with the old key. But this is generally bad and especially bad for heartbleed mitigation.
Apr
16
revised TPM- Symmetric key storage
typos, wording
Apr
8
comment How exactly does the OpenSSL TLS heartbeat (Heartbleed) exploit work?
@supercat no, the openssl layer which processes records will allocate and store the ssl record based on the (first) record length. This stored record is handed to the extension processing, where another length identifier inside the record is used. And the later one happens to have a larger number. So the memcopy starts at the beginning of the valid record and includes data after it. I suspect its a malloced buffer (even when thats a weird thing for high performance network code.) Check the diagnosis link above.
Apr
8
comment How exactly does the OpenSSL TLS heartbeat (Heartbleed) exploit work?
@supercat I dont think the actual buffers are a problem here, the network buffers get overwritten, so when you extract memeory its only the current stuff in memory. And you cannot overwrite stuff you need later on (like cached sessions). And in fact zeroing is quite a high overhead for web servers. I think however some more static allocation of ssl record buffers would not only improve performance but also leaking random system memory (especialy initially allovated "system parameter" memory like the key)