meta user
network profile
| bio | website | redhardsupra.blogspot.com |
|---|---|---|
| location | Charleston, SC | |
| age | 35 | |
| visits | member for | 2 years, 7 months |
| seen | 17 hours ago | |
| stats | profile views | 112 |
|
Jan 24 |
revised |
What things should a penetration tester know about databases? more info |
|
Jan 24 |
answered | What things should a penetration tester know about databases? |
|
Jan 16 |
comment |
How to crack password hashed using SSHA? Depending on the format, you might have to convert the hash/salt to/from hex/base64 for JtR or Hashcat to work on them. |
|
Nov 18 |
awarded | Yearling |
|
Oct 26 |
comment |
Access control matrix and integrity Biba (integrity) and Bell-La Padula (confidentiality) are 'duals' of one another, so whatever you can do with one you can do with the other. |
|
Oct 22 |
comment |
The Creation of Secure Software Development Environments The G in STIG stands for Guide. STIGs were originally intended as a starting point. However, since the accreditors tend to have severe tunnel vision, and hold people's feet to the fire over complete, blind compliance to the STIGs, they've become a de facto 'Law.' STIGing a box should be a mere beginning, a nice starting point to building a more secure system, not the official stopping point, with the ability of being penalized for actually improving upon it. |
|
Oct 16 |
comment |
Enterprise IDS - Deployment & Uses "Snort's free, sure, but your time isn't" +1 for t-shirt worthy quote ;) |
|
Oct 9 |
comment |
security issue on storing keys and certificate on token Even if the EEPROM is read-only, wouldn't anyone with an EEPROM reader be able to get your private key, at which moment they can pretend to be that token? |
|
Sep 25 |
awarded | Nice Answer |
|
Sep 20 |
comment |
Can DES-based hashed password be recovered if salt is known? This is a very good explanation of DES vs descrypt, thank you. |
|
Sep 20 |
answered | NSA Suite A Cryptography: Security through obscurity? |
|
Sep 7 |
comment |
Scrypt + Bcrypt = cascade hashing I'm no crypto expert, but I've learned enough to be afraid of subtle aggregation problems that pop up when combining multiple tricks. A good hash will maintain all of the properties it needs, and there should be no need to use it as in input to another hash. I'd use SHA-512, it is NIST-approved, it has an adjustable number of rounds, the default number of rounds is 5000, and the salt is 16 bytes. It is sufficiently slow when trying to crack it. JtR gives me about 1200 keys/sec on a 4-core 3.2GHz i7. |
|
Sep 6 |
answered | GSEC or GCIH, for a Security Analyst? |
|
Sep 6 |
comment |
optimal way to salt password? Randomness helps with collisions when you have a lot of hashes. Think password hashes of a milion users, when stored as descrypt (12 bit salt, 4096 maximum). There's gonna be many hashes that share a salt, thus lowering the level of effort to cracking them, which undoes the whole point of having a salt. If you only have only one hash total, it makes next to no difference how long the salt is. But for any non-trivial amount of hashes, long salts good, short salts bad. (Assuming their randomness is equally good) |
|
Sep 6 |
answered | Does AES-192 provide better encryption than AES-256? |
|
Aug 28 |
answered | Distributed md5 crack software? |
|
Aug 14 |
awarded | Caucus |
|
Jul 2 |
answered | What drives FIPS140-2 compliance? |
|
Jun 25 |
comment |
Lessons learned and misconceptions regarding encryption and cryptology How about H(H(S)||H(T))? since output of H()is a fixed length, you wouldn't be able to move the boundary around. Plus, using hashes as inputs for concatenation makes it really hard to manipulate a string on one side of one of the inputs into a desired value. The only downside I see is now you're doing 3 hashes instead of one. But than again, hashes supposed to be slow, so maybe it's not a bad thing afterall ;) |
|
Jun 21 |
comment |
How should I choose a difficulty factor for my password hashing function? golubev.com/gpuest.htm you mean like this? |
