network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 2 years, 2 months |
| seen | Aug 23 '11 at 23:29 | |
| stats | profile views | 13 |
|
Mar 18 |
comment |
Should the bit-strength selection of a child certificate be influenced by the CA or the chain? Yes, but I covered that case in the first paragraph; obviously an impersonator has the option of proxying traffic and acting as a man-in-the-middle. The "read traffic" attack covers instances of passive eavesdropping; in particular, cases where the attacker captures traffic passively and breaks the key later, revealing past cleartext. This attack cannot be mounted if the attacker compromises a signing CA key. This is a very different threat and a clear case where having a stronger end-entity key than signing CA key might make sense. |
|
Mar 16 |
comment |
What SSL key should I make for IIS: RSA or DH? What bit length is appropriate? Yes, I mistyped above; decrypt and sign are the private operations, while encrypt and verify are the public ones. An increased key length will increase the burden on clients, but usually this is not considered significant because (1) RSA encryption on the client side is usually not a limiting factor because of the relative speed of RSA public ops, and (2) typically each client only needs to deal with one SSL session, as opposed to an SSL server which concentrates the load from many sessions. I'd suggest benchmarking your client against RSA-2048 to see for yourself. |
|
Mar 16 |
answered | Should the bit-strength selection of a child certificate be influenced by the CA or the chain? |
|
Mar 16 |
answered | What SSL key should I make for IIS: RSA or DH? What bit length is appropriate? |
|
Mar 16 |
comment |
Is there a way to accept signed requests without storing client's password in plaintext? Right on both counts. As for TLSLite, the only difference should be the calculation of "k", one of the intermediate values. An older draft had it fixed to 3, but RFC5054 makes it a hash of the N and g parameters. |
|
Mar 15 |
awarded | Teacher |
|
Mar 15 |
answered | Is there a way to accept signed requests without storing client's password in plaintext? |
|
Mar 13 |
answered | Is there a way to accept signed requests without storing client's password in plaintext? |
