369 reputation
18
bio website
location Netherlands
age 40
visits member for 3 years, 4 months
seen 20 hours ago

Java and security expert with over 10 years of experience with the language and with the practical application of cryptographic protocols - including the design of protocols within international standardization bodies. Creator of a heavily used common criteria certified product. Over 30 years of experience with computers. Likes kids, cats, reading, movies and several sports.


1d
comment Is it possible to turn a computer into a bomb?
Well, when I burned my AMD Athlon CPU to the ground when I switched on the computer without the fan attached, all I got was a whisp of smoke :(. That were the days that CPU's did not have thermal sensors, of course. I would not even call it a smoke bomb. The best bet is the battery or the hard disk drive. Or plugging in your computer in a 230 V outlet while it's expecting 110 :) That 21" monitor back in the days did go BOOM when it was accidentally put on 360, I can tell you. But not family shattering.
1d
comment Requirment for encryption algorithem to be secure/safe
So, AES is not secure anymore because it has some issues with the key schedule for AES-256? SHA-1 is not secure anymore because it does not provide 2^80 security? That seems like a bit too strict for me, I should at least make sure that it depends on how the algorithm is used.
1d
comment Can the aproximated date on which a given Encryption Algorithm will become prone to brute force be predicted?
There are these calculations where the amount of energy required to brute force an algorithm is larger than the amount of raw energy in the solar system. In those cases Moore's law can do nothing but to roll over and admit defeat. See for instance this article just to give an understanding on how mind boggling the numbers are.
2d
comment Security Implications of using Base64 Encoding with Encryption
Updated my answer accordingly.
2d
revised Security Implications of using Base64 Encoding with Encryption
added 638 characters in body
2d
comment Security Implications of using Base64 Encoding with Encryption
What kind of strings does the library expect?
2d
answered Security Implications of using Base64 Encoding with Encryption
Oct
18
revised Is it safe to use private key encryption for lots of small blocks of data themselves?
added 31 characters in body
Oct
18
comment Is it safe to use private key encryption for lots of small blocks of data themselves?
This question is more on topic here than on SO, but I'm still wondering if it should be on crypto (beta) or here.
Oct
18
answered Is it safe to use private key encryption for lots of small blocks of data themselves?
Oct
11
comment Do passphrases need to be run through PBKDF2? Almost impossible to brute force?
As you can see, I'm struggling a bit because the use case and the security of the password storage was not specified in the question. Usually a PBKDF2 is beneficial, but there are use cases where it is not required. A PIN is usually not run through a PBKDF2 either.
Oct
11
answered Do passphrases need to be run through PBKDF2? Almost impossible to brute force?
Sep
24
awarded  Autobiographer
Sep
13
awarded  Informed
Aug
29
comment Why should I sign data that's already encrypted?
@Jaap And that's just RSA, for which modular exponentiation is used for both encryption and decryption. It will fail miserably for e.g. Elliptic Curves.
Aug
29
comment Why should I sign data that's already encrypted?
@Jaap Even the PKCS#1 documents, which define the standard way to perform RSA signing or encryption, don't define it as hash then encrypt. It's hash, pad, modular exponentiation. To avoid confusion, they have even given the modular exponentiation a different name (!) for signing and decryption, even though it is the same operation: "RSASP1 and RSAVP1 are the same as RSADP and RSAEP except for the names of their input and output arguments; they are distinguished as they are intended for different purposes" from the RFC
Aug
16
answered Security implication of exporting private key
Aug
3
comment Is Linux really that secure, with only root password denying external access?
@PeterMortensen You are right of course, that's why it is not the perfect place, I'll reword
Aug
3
revised Is Linux really that secure, with only root password denying external access?
added 3 characters in body
Aug
2
answered Is Linux really that secure, with only root password denying external access?