692 reputation
310
bio website
location Netherlands
age 41
visits member for 4 years
seen 2 hours ago

Security professional with many years of experience with the practical application of cryptographic algorithms and protocols. I'm helping with the design of protocols and API's within international standardization bodies. Lead developer of a common criteria certified product. Over 30 years of general experience with computers.


3h
comment Encryption / Decryption algorithm generic across JRE (Sun/IBM)
String.getBytes() uses the platform character encoding, which may be different on each runtime. If you however use String.getBytes(StandardCharsets.UTF_8) then you will get UTF-8 on both platforms.
23h
answered Storage on Root CA and intermediate CA certificate on Embedded device
23h
comment Storage on Root CA and intermediate CA certificate on Embedded device
What do you mean: there is a SERVER which connects to the CLIENT? Should that not be the other way around? Kind of important for TLS handshake.
1d
comment Encryption / Decryption algorithm generic across JRE (Sun/IBM)
As long as you perform correct encoding, decoding and IO you should be fine. If you don't specify a character encoding e.g. using getBytes () that's less likely.
1d
awarded  Explainer
1d
comment Encryption / Decryption algorithm generic across JRE (Sun/IBM)
It returns a Cipher instance backed by a CipherSpi instance from the highest prio provider that contains the algorithm string. Or it thrown an exception if it cannot find the algorithm of course. Read the documentation.
1d
revised Encryption / Decryption algorithm generic across JRE (Sun/IBM)
formatting mostly
1d
revised Encryption / Decryption algorithm generic across JRE (Sun/IBM)
added 223 characters in body - cleared things up even more
1d
suggested approved edit on Encryption / Decryption algorithm generic across JRE (Sun/IBM)
1d
revised Encryption / Decryption algorithm generic across JRE (Sun/IBM)
added 223 characters in body
1d
answered Encryption / Decryption algorithm generic across JRE (Sun/IBM)
1d
comment How to encrypt and authenticate large amounts of data with NaCl
Android has been derived from Linux and iOS from BSD if I'm not mistaken. I don't see why mmap should have issues but it never hurts to test. Of course you would need native code to use mmap. Java has also java.nio but I'm not sure you could use that for this use case.
1d
comment Is this way of encoding cryptographic hashes safe?
@Random832 We're not looking for a solution; the solution is to convert to binary and to then apply base 64, possibly with a file name safe alphabet. We're trying to determine if there is a chance at collisions, and - if possible - how high this chance is.
1d
comment Is this way of encoding cryptographic hashes safe?
@Polynomial And that's just the start, there's also the single character encoding...
1d
comment Is this way of encoding cryptographic hashes safe?
I think that the answer of apsillers already shows that there can be loss of information. It would be tricky to calculate how much though.
1d
comment What if someone steals a Certificate authority's private key?
From what I understood DigiNotar had quite a few dubious practices. Initially they just seem to sign any requestion, but later it was discovered they could not tell how much they had been compromised. Once those came to light there was no saving them. They could have mitigated to the moon and back at the time of discovery and they would still not have escaped bankruptcy :|
May
26
comment How to encrypt and authenticate large amounts of data with NaCl
The latter should be preferred. You should not process unauthenticated data. The only place where you should decrypt huge packages of data is where you 1) don't process the data immediately and 2) you cannot store the data in RAM. A good example would be file encryption/decryption. Even then it may pay off to split the plaintext into blocks or fragments.
May
24
answered Guidelines for time for encryption key regeneration
May
24
comment Are hashes of hashes used for password storage in practice? Why/why not?
Note that quite a few candidates for the password hashing competition perform some kind of balancing between client & server.
May
24
comment Which KDF should be used for ECIES?
A HMAC has two input parameters and a statically sized output. You would need to use the secret as key and then keep the leftmost bits. The input may be anything, a counter, key identifier or even empty.