2,682 reputation
1221
bio website
location Paris, France
age
visits member for 4 years, 3 months
seen 10 hours ago

Security consultant, specializing in application security.


14h
comment Why is there a “des-ede3-cbc” in my rsa private key?
With current known attacks, 3DES is still good with petabytes of data encrypted with the same key... I really wonder where that 512Kb figure comes from...
1d
answered Why is there a “des-ede3-cbc” in my rsa private key?
May
28
reviewed Edit Things to do to ensure that data is secured on my virtual server
May
28
revised Things to do to ensure that data is secured on my virtual server
Improved question
May
25
reviewed Approve Why is writing zeros (or random data) over a hard drive used when writing all ones is more beneficial?
May
16
revised Decrypting SHA-256 with known plain text
added 28 characters in body
May
16
comment Decrypting SHA-256 with known plain text
Yes it does, however if %s is truly random and long enough they keyspace is still too large for it to be practical.
May
13
comment Which systems in a network are able to spoof a TCP handshake?
The question is badly worded... Is it a matter of just sending a SYN packet or does the attacker need to complete the three-ways handshake... The answers will be very different...
May
13
comment Is Schneier's “Applied Cryptography” current?
Thomas Ptacek had a blog entry in 2013 going in depth on the subject, way more than any answer here, highly recommended : sockpuppet.org/blog/2013/07/22/applied-practical-cryptography
May
13
comment HSM maintenance
My guess is swapping of a fan or a PSU, but yes, this question need to be reworded completely, and one thing is sure, whatever you do, the certification is not in danger...
May
11
reviewed Approve What is preventing us from sniffing the mobile phone communication?
May
11
comment HSM maintenance
I do believe this is on topic. The question here is not if the HSM will lose its certification, certification is done by a lab on behalf of the manufacturer. The question is whether your manipulations will trigger the anti tamper mechanisms or not. This question is best answered by the manufacturer, but the anti-tampering counter measures are to prevent you to access the keys. As long as you don't interfere with the shielding of the cryptographic module, and don't leave the equipment without electricity for too long, you should be fine.
May
9
reviewed Approve In the context of security engineering, is trust an equivalence relation?
May
9
reviewed Approve Does OpenPGP encryption mean that not even I can see my data?
May
8
reviewed Reject Router Ports open
May
8
reviewed Approve What to look for in a PHP file on my server to decide whether it is rogue or not?
May
8
answered Is there any possibility that a trusted CA can perform a man in middle attack?
May
8
revised What to look for in a PHP file on my server to decide whether it is rogue or not?
spelling
May
7
reviewed Approve Bring your own phone to a (new) job: Consequences?
May
7
answered Can a website detect which method you are using to connect (LL2P, SSTP and PPTP)