meta user
network profile
| bio | website | lamontconsulting.com |
|---|---|---|
| location | New York, NY | |
| age | 36 | |
| visits | member for | 2 years, 7 months |
| seen | 39 mins ago | |
| stats | profile views | 673 |
The following message is ROT26 encrypted:
SSL isn't good enough. Your website can be hacked.
Help solve the problem by advocating these RFCs:
TLSA (formerly DANE for DNS) Fixes the hackable CA problem
TLS-OBC: Fixes TLS, and the Related Domain Cookie Attack
About me
I have no relation to the above sites; I am just an advocate
Why "makerofthings7"? It's a challenge to "make seven things in my life of significant quality and value". Who knows if those things will take the form of software, art, or people. (I'm not married, no kids yet)
See ...my LinkedIn profile
Bitcoin: 1Ev4VoQYqZzJa1YvDCyUxFjpFhtK34evHk
|
May 20 |
comment |
Lessons learned and misconceptions regarding encryption and cryptology Note: There is no message authentication in an OTP. Modifications to an OTP will be undetected. |
|
May 20 |
revised |
Lessons learned and misconceptions regarding encryption and cryptology added 120 characters in body |
|
May 20 |
answered | Lessons learned and misconceptions regarding encryption and cryptology |
|
May 20 |
answered | Lessons learned and misconceptions regarding encryption and cryptology |
|
May 20 |
revised |
Lessons learned and misconceptions regarding encryption and cryptology added 274 characters in body |
|
May 20 |
answered | Lessons learned and misconceptions regarding encryption and cryptology |
|
May 20 |
answered | Lessons learned and misconceptions regarding encryption and cryptology |
|
May 20 |
comment |
Lessons learned and misconceptions regarding encryption and cryptology This also opens the door for a Two time pad attack, that bit Microsoft PPTP. The first version of PPTP used the same key in the client and the server |
|
May 20 |
comment |
Lessons learned and misconceptions regarding encryption and cryptology Here is a right example: Suppose a crypto designer doesn't want to reuse the same key for multiple messages. One solution is to generate one key and expand it using a PRG. Then only use each multiple of x bits as a key. Where segment 1 == key 1, segment 2 == key 2. |
|
May 20 |
comment |
Lessons learned and misconceptions regarding encryption and cryptology Here is a wrong example: WEP implemented RC4 with a 24 bit nonce that increases after each message. This introduced two issues: (1) after 2^24 packets were sent, nonces were reused. (2) RC4 wasn't designed to have nonces "closely related" where it is known that each subsequent cipher was ++ the value of the previous. |
|
May 20 |
comment |
Lessons learned and misconceptions regarding encryption and cryptology Would you edit "As I'm not reusing the key, there is no way to attack the ciphertext by subtracting one message from another." and add text saying that other attacks are possible? EXAMPLE: a two time pad, bad protocol, or other bias (PPTP, WEP, RC4 respectively). An unknowledgeable layman may misread what you wrote and think that OTP offers "perfect secrecy" in another sense of the word. Also, since you're broaching this topic some coverage of what a valid PNG/PRG key stretcher is would be helpful. |
|
May 19 |
revised |
How can I verify the identity of a US | UK -based person and prevent *fake identities* from being accepted? deleted 58 characters in body |
|
May 19 |
comment |
How can I verify the identity of a US | UK -based person and prevent *fake identities* from being accepted? @DeerHunter Someone under Witness Protection is something I'm less concerned about, but am more interested in understanding how much duplication could be seen in the worst case scenario. |
|
May 19 |
awarded | Nice Question |
|
May 18 |
comment |
How can I verify the identity of a US | UK -based person and prevent *fake identities* from being accepted? @SteveS The cost of a duplicate account per human would cost my company 10,000 to 100,000 per incident over the span of 10 years. I need to extrapolate this cost by possible transgressions. How much duplication (fraud) is possible with each assurance qualification? |
|
May 18 |
revised |
How can I verify the identity of a US | UK -based person and prevent *fake identities* from being accepted? edited title |
|
May 18 |
revised |
How can I verify the identity of a US | UK -based person and prevent *fake identities* from being accepted? edited title |
|
May 18 |
asked | How can I verify the identity of a US | UK -based person and prevent *fake identities* from being accepted? |
|
May 17 |
reviewed | Approve suggested edit on Unsolicited Password Request from Facebook |
|
May 17 |
reviewed | Approve suggested edit on Data Encryption and Key Management in C# |
