Reputation
1,312
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
5 14
Newest
 Custodian
Impact
~17k people reached

Dec
20
comment Why triple DES used in EDE mode?
Duplicate, with an extended answer on cryptography
Dec
20
comment Why triple DES used in EDE mode?
A keyed block cipher set to encryption is a permutation. A keyed block cipher set to decryption - and of course the same key - is just the inversed permutation. As you can always perform any permutation on a block of data, both encryption and decryption can be performed as long as a full block of data is available.
Dec
20
comment Why triple DES used in EDE mode?
Voted down not because the content is in error, but because the answer is simply too fluffy, never mind the exam.
Nov
28
comment How smart card with client certificate is used during SSL/TLS session
@StackzOfZtuff You may be right, although e.g. IE tends to rely on OS functionality, which - at least in principle - should be able to detect card removal.
Nov
28
comment How smart card with client certificate is used during SSL/TLS session
Note that the client itself may be programmed in such a way that the connection is severed whenever the card is made unavailable by the user (to protect the user from others to use the authenticated session).
Nov
27
comment SSL with both local client and server
Anybody could send any certificate, right? So I don't see any trust relationship being established that way. If you already know the certificate then you can just as well store the certificate itself.
Nov
27
answered SSL with both local client and server
Nov
25
comment Why include a private key in a root certificate?
The whole idea that the private key is part of the certificate is maybe to blame here. This (over) simplification is all over the Microsoft API's. So it may be just a mistake where too much was experted during certificate export.
Nov
9
awarded  Custodian
Nov
9
reviewed Approve Are the elliptical curves in ECDHE and ECDSA the same?
Nov
9
comment Do certificates need to be protected at rest?
PS I assumed that the certificates do not contain a private keys here, although private keys can certainly present in key/certificate stores. Private keys are linked to specific certificates, but they are not contained within them.
Nov
9
answered Do certificates need to be protected at rest?
Nov
8
comment Safe to store encrypted data with (password protected) pfx file
That presumption is a bit tricky. Complex passwords are very hard to remember, especially if you don't want to reuse them. So storing the PFX file separately may add a layer of security.
Nov
8
answered Stacking Encryptions (Stream over Block)
Nov
8
answered Are the elliptical curves in ECDHE and ECDSA the same?
Nov
8
comment Asymmetric vs symmetric encryption benchmarks
Did you just tell him to go fish?
Nov
6
answered DHE_RSA Pubkey Length in TLS 1.2?
Nov
3
comment Why hashing algorithms in layer 2 are weak?
MD5 can be cracked with very limited amount of resources, if not a pocket calculator (yes, not for pre-image attacks though). No SHA1 collisions so far, so it's certainly not easy to do (but very likely possible by now). Note that key derivations functions (password hashing is a subset of that) are usually not affected when it comes to attacks on the hash function used. MD5 can be secure if a salt and enough iterations are used (1000 is a very low count though for relatively simple passwords).
Nov
3
comment When I visit a site using HTTPS is it exposed to sniffers?
The IP address would also be a pretty big hint. The IP header isn't encrypted, only the TCP data within it. As for your last question: no, but beware that the size of the big long secret may show, i.e. an attacker may be able to see that you go to something with a big long ... secret.
Nov
2
comment Do we still need to encrypt/decrypt data in Application Layer, despite using TLS/SSL?
"to selectively apply security protection on individual applications" - that sentence does not say anything really... what's "security protection"? "The procedure can be done without concerning the network layer" - well, the most many applications see is TCP sockets, and you need to replace or tunnel those. "only the application layer data is actually encrypted"... and there's me thinking that it is transport or socket layer security. "So, all you need is HTTPS/SSL with client authentication. Adding a second layer of encryption doesn't actually add any security. " Life is not that simple.