264 reputation
16
bio website
location Netherlands
age 40
visits member for 3 years, 2 months
seen Aug 8 at 23:15

Java and security expert with over 10 years of experience with the language and with the practical application of cryptographic protocols - including the design of protocols within international standardization bodies. Creator of a heavily used common criteria certified product. Over 30 years of experience with computers. Likes kids, cats, reading, movies and several sports.


Aug
3
comment Is Linux really that secure, with only root password denying external access?
@PeterMortensen You are right of course, that's why it is not the perfect place, I'll reword
Aug
3
revised Is Linux really that secure, with only root password denying external access?
added 3 characters in body
Aug
2
answered Is Linux really that secure, with only root password denying external access?
Jul
30
comment Is it possible to distinguish between a SHA256 hash and an ecc256 key?
Could you put the additional question back in? I just answered it.
Jul
30
answered Is it possible to distinguish between a SHA256 hash and an ecc256 key?
Jul
29
comment Is there something similar to pseudorandom generators but in the opposite direction?
Correct. Hash functions can actually be used as a random extractor (see NIST SP 800-90B). NIST however requires that you put in twice as much entropy as the output of the hash function (to call it fully randomized). Of course, if you already have a well seeded CSPRNG you can just take the amount of bytes you require for all practical purposes.
Jul
3
comment Is code-signing with a non-ssl timestamp unsafe?
I guess that as long as you can establish trust (beforehand) for the public key of the time stamp service, and as long as you perform verification, then using a time stamp server over an insecure line is OK.
Jun
30
comment how to rememeber passwords securely?
Cache the result of the PBKDF2 instead?
Jun
24
comment Does SMIME differ from TLS, PGP, DMARC signature, or a Portal Encrypted email message in terms of legal non-repudiation?
Non repudiation in electronic commerce. Does not sound like something that ages quickly.
Jun
23
comment RSA-Based Signature Algorithms
@rapt That's OK, hopefully you do agree on my answer :)
Jun
22
comment openssl - generating rsa key pair - public key
It's at least compatible with X509EncodedKeySpec and the "RSA" KeyFactory in Java. Don't know about others. After PEM decoding, e.g. using Bouncy Castle, of course.
Jun
22
comment RSA-Based Signature Algorithms
@ThomasPornin I feel a bit bad about attacking David though, he's done so much for Bouncy Castle libs :( . It's not personal, just a difference of opinion. Good book otherwise.
Jun
22
awarded  Yearling
Jun
22
answered Java AES encryption output length
Jun
22
comment RSA-Based Signature Algorithms
Note that private key operations may have different security requirements than public key operations. Using one for another may lead to insecurity with regards to side channel attacks (!).
Jun
22
answered RSA-Based Signature Algorithms
Jun
22
comment How widely deployed is TLS with cipher ECDHE?
That last sentence does not parse for me, what's "tpo"? Is it short for "to" (or for "tYpo" :P )? Some capitalization would not hurt either.
Jun
22
comment If md5 is only insecure because of its speed, why doesn't this workaround make it reasonably secure?
Your basic assumption is wrong. MD5 is not insecure because of its speed, it's insecure because it is broken (for certain important scenarios, mostly with regards to hashing of messages for signing / message verification). Speed is actually a good property for a hash function to have, as long as attacking the hash is sufficiently complex.
Jun
22
comment What are the enhancements of SHA1 compared to MD5?
I would not say SHA-1 is slightly weakened. Theoretical attacks exist that run in $2^61$ instead of $2^80$. That's a lot of security margin that went up in smoke. The fact that there have been active projects to find SHA-1 collisions is a writing on the wall as well.
May
11
comment How much programming I need to enter the security field
I would warn not to get too good at programming if you want to really progress, or let yourself be cornered by some software development where you will be and will stay the professional. As well as advancing your career, programming skills can hold you back as well. A lot of people in my organization seem to lack anything but communication skills and do better than I do - if you count a higher up position as advancement, of course.