248 reputation
110
bio website
location Frederick, MD
age
visits member for 3 years, 4 months
seen Jun 26 at 12:54

May
28
awarded  Popular Question
Feb
17
awarded  Popular Question
Jun
9
awarded  Yearling
Jun
8
awarded  Caucus
Feb
20
comment How long should the password be?
Also wired.com/politics/security/commentary/securitymatters/2007/01/…
Oct
3
comment Is TDEA (TripleDES) invulnerable to the weak keys of DES?
@AviD I completely agree.
Sep
14
accepted Is TDEA (TripleDES) invulnerable to the weak keys of DES?
Aug
29
awarded  Commentator
Aug
29
comment How can I decrypt data with Java, without hard-coding the key?
Have you heard of Microsoft's Data Protection API (DPAPI)? There's a wrapper for Java: jdpapi.sourceforge.net
Aug
26
comment How can I decrypt data with Java, without hard-coding the key?
"Storing secret information—data such as encryption keys, signing keys, and passwords—in software in a completely secure fashion is impossible with current PC hardware…The trick is to raise the security bar high enough to make it very difficult for anyone other than appropriate users to access the secret data." Writing Secure Code (2nd ed.) chapter nine. Microsoft Press.
Aug
26
comment How can I decrypt data with Java, without hard-coding the key?
+1 good answer. I would add that if you store the password in a file on the computer, it can be protected via a file ACL. If this is a service, the initialization could be run as a user which has read access to the file but after initialization, the app would run under a different user that doesn't have read access. In general, pure software solutions can raise the bar only so high.
Aug
25
awarded  Teacher
Aug
23
revised Is TDEA (TripleDES) invulnerable to the weak keys of DES?
added 31 characters in body; edited title
Aug
23
answered Is TDEA (TripleDES) invulnerable to the weak keys of DES?
Aug
23
comment Is TDEA (TripleDES) invulnerable to the weak keys of DES?
This is a great answer. +1 Thank you.
Aug
23
comment Is TDEA (TripleDES) invulnerable to the weak keys of DES?
"There are a few keys that are considered weak for the DEA cryptographic engine. The use of weak keys can reduce the effective security afforded by TDEA and should be avoided." - p. 24 of the PDF
Aug
23
comment Is TDEA (TripleDES) invulnerable to the weak keys of DES?
Thanks for your answer. So, the multiple pass method of 3DES doesn't provide any defense against the weak keys. Can you cite a reference?
Aug
23
asked Is TDEA (TripleDES) invulnerable to the weak keys of DES?
Jun
11
awarded  Nice Question
Jun
10
comment Is it a vulnerability to display exception messages in an error page?
@Soumya92 Thanks. > "At best, give them an ID they can correlate to your log." -- we are changing our page to do that. It will provide a generic error message, an apology for the inconvenience, the current date, and a number for us to be able to correlate their report to the log entry.