7,153 reputation
11441
bio website
location
age
visits member for 3 years, 4 months
seen yesterday

The first rule of security is: you do not invent security protocols.

The second rule of security is: you do not invent security protocols!

The third rule of security is: if this is your first time with security you do not invent security protocols.

Inventing, modifying, tweaking, hacking, extending, optimizing, or just about anything else you can do to a cryptographic protocol, hash, algorithm, PRNG, key agreement, or cryptographic technique is a very bad idea.

(Not dead.)


Jul
7
comment zero knowledge proof and its protocol
Exactly right. One critical aspect of the proof is probability. Probability allows for the posibility of convincing someone you know something that you do not know! The probability aspect is part of what prevents the knowlege transfer. In a pure deterministic proof exposure of the knowledge you are prooving you have is inevitable.
Jul
7
comment Identity-Based Encryption - how secure is it?
"usability issues are extremely important" Critical point! From Jerry Proc "using the KY-28 in an aircraft when being fired at was impracticable because of the crypto synchronization time required. Pilots being shot at were not about to wait for the crypto to sync up so they communicated in the clear! The ground troops would do the same!" Sometimes unusable crypto is worse than no crypto at all!
Jul
7
comment What is gained by hashing the last block on-device?
But do the standard deviants conform to a standard deviation?
Jul
7
comment How to protect ftp account information in the source code of a program
Hi @niggles, welcome to the site. You are on the right track, attempting to ensure the integrity of the transmission, but a HTTP POST provides no more security than FTP RETR. The question calls for a method of transmitting data to remote server without exposing the credentials for access.
Jul
7
comment How to protect ftp account information in the source code of a program
Hi @Sparksis, welcome to the site. I appreciate your attempt to contribute, but your answer is weak from a security perspective. Obfuscation tends to require just as much work as more secure solutions and provides much less benefit. Your solution introduces additional components without considering the security required for each component. Databases need security and web applications need security. However you are correct that it is bad practice to store credential in a program.
Jul
7
comment SCADA Operating System & Security Exploits
True, but the safety critical design has benefits in the security domain. DO-178B OSes have fault and process isolation, integrity checking, independent virtual address spaces, and formal verification. From Flight-Critical Data Integrity Assurance for Ground-Based COTS Components "System security is closely related to system safety; both deal with threats or risks to the system and both involve protection against losses"
Jul
7
revised SCADA Operating System & Security Exploits
added 1187 characters in body
Jul
7
awarded  Quorum
Jul
6
revised Is NTP vulnerable to DNS poisoning or spoofing attacks?
changed mitigation from IPSec to NTP shared secret or autokey, thanks nealmcb
Jul
6
revised SCADA Operating System & Security Exploits
added 112 characters in body
Jul
6
comment Is NTP vulnerable to DNS poisoning or spoofing attacks?
@nealmcb good point. I was think of protecting the system and forgot about the built-in authentication, which is quite funny since my initial responses to the question were advertising the protocol's authentication capability. I need to think again about packet delays. Which mitigations seem dubius, all of them?
Jul
6
answered SCADA Operating System & Security Exploits
Jul
6
answered What security risks exist in cell phone apps' data transfer?
Jul
6
comment Is NTP vulnerable to DNS poisoning or spoofing attacks?
@D.W. edits made, removed opinion of protection worth, removed user detection.
Jul
6
revised Is NTP vulnerable to DNS poisoning or spoofing attacks?
added 3326 characters in body
Jul
5
comment Is NTP vulnerable to DNS poisoning or spoofing attacks?
@bruno-rohee The answer only talks about the protocol, not the implementation. I agree that the implementation is more important than the protocol, but no implementation seems to be mentioned here.
Jul
5
comment DUKPT - how does the receiver verify the transaction counter?
Could you post a link to the specification? I am not familiar with ANSI X9.24, but on cursary reading I think you are correct that the HSM must store the KSN. Transaction counters are used to mitigate replay attacks where an adversary captures a transaction and resends the same data from one party in the transaction. Prohibitions on keeping state are usually to mitigate information leakage or prevent short-cycling a protocol. I can not think of a good reason not to store the KSN as it a function of the device’s unique identifier, and the device's internal transaction counter.
Jul
5
comment Hashed passwords - How many variations of rainbow tables?
Did you search for 'rainbow tables' before asking your question? Possible duplicate of What are rainbow tables and how are they used?
Jul
4
comment Warn about specific CA in Firefox
Thanks, now I understand.
Jul
4
comment Is it a bad idea for an information holder to e-mail a user their password?
additionally... The senders are sending security critical information in response to a non-security event. They are trading security risk for business risk (loosing users).