Reputation
Next tag badge:
152/100 score
19/20 answers
Badges
6 69 117
Newest
 Nice Answer
Impact
~1.2m people reached

2d
revised Encryption - should I be using RSA or AES?
fixed typo (thanks dotnetguy); cite Matasano article
Feb
1
awarded  Nice Answer
Jan
26
reviewed Approve Why did customer services say using symbols in a password is insecure?
Jan
24
comment Firefox pre-downloading
@humanityANDpeace Clicking “Save link as” is a user interaction, and that's what it takes to download something outside the browser cache.
Jan
20
revised What kind of encryption or obfuscation is this?
fixed formatting
Jan
19
reviewed Leave Open Should I worry about remote timing attacks on string comparison?
Jan
12
reviewed Leave Open Protecting email addresses if their hashes are publicly avaliable
Jan
12
reviewed Close How to securely counter users from adding a single digit to their old password upon creating a new one?
Jan
12
awarded  Marshal
Jan
11
reviewed Reopen What prevents criminals from buying a new PC and going on public wifi?
Jan
8
comment How to counter the security risks of shared prime factors among RSA moduli employed in practice?
@Mok-KongShen Once again: you CANNOT do anything useful if you only have the generated key. There is no magic bullet you can shoot. You (or someone you trust) MUST analyze the key generation process.
Jan
8
comment How to counter the security risks of shared prime factors among RSA moduli employed in practice?
@Mok-KongShen Go by the reputation of the provider of the software. You have to go by this for everything else, why are you looking for something specifically about one aspect of key generation for one particular kind of key? Once again: you cannot evaluate a correct key generation process by looking at the generated keys, you have to look at the process. This holds for RSA keys and every other kind of cryptographic key.
Jan
7
comment How to counter the security risks of shared prime factors among RSA moduli employed in practice?
@Mok-KongShen No, it is resolved. You counter the risk of shared prime factors not by verifying key values, but by verifying the key generation process.
Jan
7
comment How to counter the security risks of shared prime factors among RSA moduli employed in practice?
@Mok-KongShen You cannot tell from the RSA modulus (not without doing a massive study like the one you read). You need to rely on the application doing it correctly, just like you're relying on it implementing RSA encryption or verification correctly, on not uploading a copy of all the data it sees to archive.org, etc.
Jan
7
comment How to counter the security risks of shared prime factors among RSA moduli employed in practice?
@Mok-KongShen It is not really practical to check one modulus against all the other moduluses in existence. Rather than tackle the problem at this level, it is easier to ensure that the modulus was randomly generated using a properly working crypto-strength RNG (like /dev/urandom on Linux or CryptGenRandom on Windows, subject to proper seeding which would be room for a whole other question (which we may well have on the site already)). A randomly-generated key does not share any factors with any other key.
Jan
7
revised Secure sensitive information sent from Server to mobile App
edited tags
Jan
7
revised CSRF issues in “stateless” web app?
edited tags
Jan
7
revised Security of Web Game over WebSockets?
edited tags
Jan
7
revised How can I implement a secure download area on a website which requires an electronic signature?
deleted 425 characters in body; edited tags
Jan
6
revised How do I ensure there is sufficient entropy on an embedded system at first boot?
added 24 characters in body