206 reputation
16
bio website atrevido.net
location
age
visits member for 1 year, 11 months
seen Nov 11 at 22:56

Nov
3
awarded  Yearling
Nov
2
comment Keyboards using 2.4GHz with AES
Good paper, thanks! It sounds like they do something like a DH key exchange during pairing. This may not be the person's weakest link, but if you have an office, it'd be nice to make sure you aren't transmitting everything everyone types to anyone nearby - the kind of thing that'd make you fail a pentest/audit. The problem I do see is that it looks (from the little graphic) they are doing a stream cipher, so each keystroke is sent individually. If so, then simple text and time analysis may reveal the contents of human language communications.
Nov
2
asked Keyboards using 2.4GHz with AES
Jun
26
comment Why doesn't Bitlocker mix the password with stored key?
Does the PIN actually help encrypt the VMK? I thought the PIN was a passcode for the TPM's use. Even if BDE did mix in the PIN material, the TPM might store the PIN plaintext (maybe? is this stuff even spec'd or verified?).
May
20
comment Why doesn't Bitlocker mix the password with stored key?
@KnightOfNi Microsoft published a detailed research paper on the per-sector mixing algorithm used as well as many other details and attack vectors. Furthermore, employees comment on all sorts of rationales for design decisions. Not all of that is NDA.
May
20
comment Why doesn't Bitlocker mix the password with stored key?
@grasGendarme no the way that it's handled is that the key stored is a Key Encryption Key, and it unlocks a Data Encrypting Key.
Apr
15
awarded  Nice Question
Apr
3
comment Why does Android mix phone state with phone identity?
Right, that's the question. It'd be an intentional malicious move by Android/Google. Also, since there's next to no privacy impact in viewing phone is on/off, why would there be a permission for that?
Mar
27
awarded  Critic
Mar
7
awarded  Commentator
Mar
7
comment How To Protect Tomcat 7 Against Slowloris Attack
@AminSh you could run Apache (or nginx) as a reverse proxy (so Tomcat runs on localhost:1234, nginx on port 80/444, and then relays connections). The configuration is easy and only a few lines. As a bonus, if there are static resources being served, you'll get better performance from nginx caching, too. One thing to be aware of: Tomcat apps won't see the original client IP, since connections will come from localhost. You'd have to add a header containing the real IP if your app needs that.
Mar
7
asked Why does Android mix phone state with phone identity?
Mar
4
comment Self-encrypting drives, certification for tamper-protection?
Aha. So FIPS 140-2 level 3/4 are the only ones that'd provide any protection against an attacker with physical access to the drive? (Assuming the drive just stores the key and does some sort of auth process to start up?) I see some SSDs marketed as "FIPS compliant" "FIPS-197 Validated". That's just a cute way to say they implemented AES, eh? Is FIPS 140-2 something an SSD vendor is likely to not to bother with, even if they could meet the requirements?
Mar
3
comment How to decrypt the Encrypted DEK using KEK which are separated in servers?
The HSM works like I described - your application will verify its identity to the HSM, and the HSM performs the crypto. The keys never leave the HSM. And yes, you still have the problems mentioned; you need to audit access and make sure a malicious admin didn't steal the app credentials and submit illicit decryption requests. All of this is also part of general auditing - you don't want a malicious admin adding malware to a server either.
Mar
2
comment Encrypting sensitive data in software and storing/decrypting it on a server
KeyCzar is another excellent choice for a library that implements these scenarios and tries to prevent you from messing up.
Mar
2
comment Why doesn't Bitlocker mix the password with stored key?
I don't think it's far-fetched or too intense. A casual office observer can look over your shoulder and see you enter your password. A casual office worker can steal your USB key (or you could just accidentally leave it plugged in). That's half the point of using FDE in the first place, right?
Mar
2
awarded  Teacher
Mar
2
awarded  Student
Mar
2
answered How to decrypt the Encrypted DEK using KEK which are separated in servers?
Mar
2
comment Only one entry in No-SQL database needs encrypting
Please clarify what the scenario is. If you have a key, why use hashes of the ID to form a unique password? I don't understand what you're trying to accomplish.