19,309 reputation
23291
bio website
location Brooklyn, NY
age 33
visits member for 3 years, 2 months
seen 3 hours ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


May
23
revised Expanding/Inverse Hash function
added 22 characters in body
May
23
answered Cryptanalysis of encrypted data at rest
May
23
awarded  Custodian
May
22
comment How to securely hash passwords?
Ok, caught my mistake. I think the 448 bits comes from 56*8, for the key used in eksblowfish not the output generated from bcrypt. Reading up more on bcrypt I see that its 192 bit encryption of OrpheanBeholderScryDoubt (in ECB mode - or was this changed to CTR at some point?) using 64 rounds of eksblowfish (which itself does 2^cost number of rounds).
May
22
comment How to securely hash passwords?
Doesn't bcrypt give a 448-bit output? From: schneier.com/paper-blowfish-fse.html Schneier does mention that simplifying bcrypt to be 8-round (versus 16), but otherwise says it can output keys of up to 448 bits. " It is probably safe to reduce the number of iterations from 16 to 8 without compromising security. The number of iterations required for security may be dependent on the length of the key. Note that with the current subkey generation procedure, an 8-iteration algorithm cannot accept a key longer than 192 bits."
May
22
awarded  Yearling
May
21
answered What benefit is there to adding a password to your SSH key?
May
21
revised Any reason I shouldn't be salting and hashing before putting through bCrypt?
added 570 characters in body
May
21
answered Any reason I shouldn't be salting and hashing before putting through bCrypt?
May
20
revised Does gmail's TOS allow Google to steal your emailed ideas?
added 873 characters in body
May
20
comment Serpent cipher technical details in-depth
Again comparing apples to oranges but finding a machine without AES-NI (Core 2 duo), I did time openssl enc -aes-256-ctr -K 13ca797952c0379e9b748ea8ceb8473d566cd012686fb7c0a225d83dabbecd80 -in file.txt -out file.enc -iv 01020304050607080910111213141516 took 6.4 seconds (real), 4 seconds (user) on 1 GB file of zeros, while time mcrypt file.txt -a serpent -m ctr -o hex -k 13ca797952c0379e9b748ea8ceb8473d566cd012686fb7c0a225d83dabbecd80 which took about 24.2 seconds. Granted mcrypt doesn't have AES -- it does have rijndael which I find quite comparable to serpent (23 seconds).
May
20
answered Does gmail's TOS allow Google to steal your emailed ideas?
May
20
comment Serpent cipher technical details in-depth
@CodesInChaos - That makes sense that serpent on a single core is more easily parallelizable. But OpenSSL does Serpent? I know its in the linux kernel and in mcrypt, but couldn't find any reference to it in OpenSSL (openssl enc -help gives: aes, bf, blowfish, camellia, cast, cast5, des, -des3, -desx, rc2, rc4, seed). Benchmarks from the AES contest (back when multi-core was rare) show Rijndael being 2-4 times faster than serpent.
May
20
revised Serpent cipher technical details in-depth
added 416 characters in body
May
20
revised Serpent cipher technical details in-depth
added 416 characters in body
May
20
revised Serpent cipher technical details in-depth
added 416 characters in body
May
20
revised Serpent cipher technical details in-depth
edited body
May
20
comment Serpent cipher technical details in-depth
@CodesInChaos to quote Serpent's homepage "Serpent and Rijndael are somewhat similar; the main difference is that Rijndael is faster (having fewer rounds) but Serpent is more secure". I agree benchmarks shouldn't be trusted as hard fact (often depend on external factors like processor, how it was coded, etc) and that a serpent round != Rijndael round. Also the parallelizability of a block cipher should be irrelevant when comparing CTR mode (where decryption/encryption are both naturally parallelizable even if the block cipher is not.)
May
20
revised Why does openssl enc -aes-256-cbc -a -salt increase the file size?
added 633 characters in body
May
20
revised Why does openssl enc -aes-256-cbc -a -salt increase the file size?
added 1201 characters in body