6,678 reputation
11734
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 3 months
seen 3 hours ago

1d
comment PHP secure random number generator
@JoelL Unlike opening /dev/urandom by yourself, MCRYPT_DEV_URANDOM works on windows as well.
1d
comment Please help me to find the Hash algorithm and decrypt the password
40 hex character = 20 bytes = 160 bits. My first guess would be SHA-1.
1d
comment How effective are password checking websites?
Isn't your 48 days too small by a factor of 1000 or so?
Nov
14
comment Is TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 a safe cipher suite to use?
AFAIK TLS 1.2 is still MAC-then-encrypt, so I'd hesitate to use CBC.
Nov
14
comment Java SecureRandom doesn't block? How?
But you can only retrieve entropy securely from random.org if you have enough entropy to create a secure SSL connection. So you have a chicken-egg problem.
Nov
13
comment Does encrypting the message protect it against length extension attacks
This should prevent the length extension, but as Xander noted using MAC-then-encryption causes other difficulties, so it's still a bad idea. If the encryption is a stream cipher (including AES-CTR) it's probably secure, if it's CBC you're almost certainly fucked.
Nov
13
answered AES 128bit decryption using a key longer than 16 bytes
Nov
11
comment How bad is it to truncate a hash?
"the blackbox should not be able to know the original 8 bytes." and "Some blackbox take a 8 byte value" sounds like a direct contradiction to me.
Nov
6
comment Hashing a hard drive before shutdown
ZFS and TahoeLAFS have some similar features.
Nov
4
comment Are there any instant messaging systems that offer resistance to traffic analysis?
Not an instant messages, but AGL's Pond is a messaging system that takes traffic analysis seriously.
Nov
4
comment How can Tor be considered a standard tool for achieving anonimity, given that it is created by the government?
You can verify that the distributed code for Tor relays does not log. But you cannot verify that actual relays do not log. Some certainly do. But for this issue it doesn't matter who created Tor, but who runs relays.
Nov
4
revised TextSecure/WhisperPush instant messaging by Open Whisper Systems: End-to-end encrypted or not?
added 243 characters in body
Nov
4
answered TextSecure/WhisperPush instant messaging by Open Whisper Systems: End-to-end encrypted or not?
Nov
4
comment TextSecure/WhisperPush instant messaging by Open Whisper Systems: End-to-end encrypted or not?
Whisper has nothing to do with Open Whisper Systems / TextSecure. It's just a similar name.
Nov
4
comment Is there a reason to use TrueCrypt over VeraCrypt?
@KnightOfNi WTF? Why would you even think about a one time pad for disk encryption? That makes so little sense, I don't even...
Nov
4
comment Is there a reason to use TrueCrypt over VeraCrypt?
If you're using linux only, why not LUKS?
Oct
30
comment How safe is it to use older/unknown Encryption methods for plaintext?
See Kerckhoffs's principle
Oct
27
awarded  Nice Answer
Oct
25
comment All users can write only one can read system
Asymmetric encryption easily solves that part of the problem. The only remaining problem is key management - the sender must be able to obtain the public key (which requires some trust root) and the receiver needs some way to obtain their private key (either store it securely or decrypt is with a password).
Oct
25
comment All users can write only one can read system
The senders need some way to obtain the public key of the receiver. That could be a 256 bit ECC key, or if you assume that there is public but untrusted storage, a fingerprint of 60 to 80 bits.