Reputation
1,478
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
5 14
Newest
 Custodian
Impact
~24k people reached

May
3
comment Can secrets be made safe in memory?
Usually humans enter passwords, not keys (although some key management routines may require direct entry of hexadecimals representing bytes of a key). Never confuse passwords and keys.
May
3
comment Can secrets be made safe in memory?
You can store keys securily in memory by wrapping them with another key (ending with a key or password which is not in memory, obviously). The problem is using such a key, as you'd need to unwrap it first. What is sometimes performed is to unwrap the stored key in a hardware module. This is what TPM's and some HSM's do to keep larger quantities of keys than fit it in their internal, secure memory. This of course doesn't work as well in a cloud service, providing that the hardware is not available.
Apr
14
comment Which part is the longest when gerating RSA key pairs?
Ah that's a pretty cool solution I have to say. I'm going to check if I can do something similar in Java for sure! Java 9 creates a 2048 bit key pair in 1.88 seconds though :)
Apr
14
revised Which part is the longest when gerating RSA key pairs?
added 300 characters in body
Apr
14
answered Which part is the longest when gerating RSA key pairs?
Apr
2
comment What are active research topics in SSL/TLS?
No, that's not what you were asking. A draft of TLS v1.3 isn't - in itself - a research topic. It could be a good starting point to find one, but a research topic it aint.
Apr
2
comment Why can passwords be used to encrypt data, but are less strong for authentication?
@schroeder That comment is just completely wrong. More information available to an attacker can by definition only help an attacker.
Apr
2
answered Why can passwords be used to encrypt data, but are less strong for authentication?
Mar
4
comment Java card 3 connected edition availability
The problem is mostly that SRAM is expensive with regards to the surface area required on the chip. Connected edition requires about 24 to 32Ki of transient memory, so you'd only find it on very high end contact based cards - if at all. Personally I wonder if it ever got off. Most applets are written according to an ISO 7816-4 specification. Connected edition does't make too much sense for that.
Mar
4
comment Why is weakness of SHA-1 considered a threat to TLS security
As you can see, it's pretty tricky to understand what is going on without a deeper understanding about the issue and the underlying cryptography. This is why - to the management level - it is often easier to say "SHA-1 is insecure. Of course you then get questions about removing SHA-1 altogether, including uses within password hashing and other key derivation mechanisms, but hey, that's life :)
Mar
4
answered Why is weakness of SHA-1 considered a threat to TLS security
Mar
3
answered Client verification with PKCS#7
Feb
27
comment Teslacrypt Ransomware
"I'm hesitant on using teslacracker since the RSA key is 4096 lenght and that would take a lot of time to crack even for a 4GB RAM i5 CPU laptop." Basically that would be a waste of (CPU) power even on a top of the line machine - which you could probably use after transferring the disk. You'd never find the private key, ever. Then again, RSA is not 100% secure against quantum computing, so....maybe in 20 years.
Feb
23
comment Broadcasting 10k SSIDs
I see 3 downvotes, but I don't see any reason why this is downvoted (I'm not saying that there isn't any, I just don't see it in the comments).
Dec
20
comment Why triple DES used in EDE mode?
Duplicate, with an extended answer on cryptography
Dec
20
comment Why triple DES used in EDE mode?
A keyed block cipher set to encryption is a permutation. A keyed block cipher set to decryption - and of course the same key - is just the inversed permutation. As you can always perform any permutation on a block of data, both encryption and decryption can be performed as long as a full block of data is available.
Dec
20
comment Why triple DES used in EDE mode?
Voted down not because the content is in error, but because the answer is simply too fluffy, never mind the exam.
Nov
28
comment How smart card with client certificate is used during SSL/TLS session
@StackzOfZtuff You may be right, although e.g. IE tends to rely on OS functionality, which - at least in principle - should be able to detect card removal.
Nov
28
comment How smart card with client certificate is used during SSL/TLS session
Note that the client itself may be programmed in such a way that the connection is severed whenever the card is made unavailable by the user (to protect the user from others to use the authenticated session).
Nov
27
comment SSL with both local client and server
Anybody could send any certificate, right? So I don't see any trust relationship being established that way. If you already know the certificate then you can just as well store the certificate itself.