60,834 reputation
575155
bio website
location
age 68
visits member for 2 years, 6 months
seen 8 hours ago

I SHALL DEVOUR YOUR HEART AND FEAST ON YOUR SOUL (so don't bug me).


20h
awarded  Great Answer
1d
comment Encrypting/decrypting information in database
Yes, in case of password loss, the data is lost. One method is to use escrow: the data, or the encryption key for the data, is also encrypted with a public key. The sysadmin keeps the private key somewhere else (not on the server itself) and uses it to salvage the data of people who forgot their password. Of course this means that the sysadmin can decrypt users' data, which may or may not be appropriate to your case. Alternative: the user writes his encryption key on a paper and keeps that in a safe, to be used in case of emergency.
1d
awarded  Good Answer
2d
awarded  Guru
2d
awarded  Good Answer
2d
comment How can I create a password that says “SALT ME!” when hashed?
Brutally... I took an MD5 implementation from here, then went through many 8-letter passwords until the proper output was obtained. About 2^23 tries per second and per core on my 3.1 GHz server (I estimate that I could do 2^24 with some SSE2-aware code -- I had done that at one time for SHA-1).
2d
comment How can I create a password that says “SALT ME!” when hashed?
UsePBKDF2 and UseBcrypt are 9 letters each, for an average cost of 2^54, which is quite beyond what I can do with my lone quad-core server. With these nifty GPU arrays which claim to do 8 billions MD5 per second, this could be done within a month (more or less).
2d
comment How can I create a password that says “SALT ME!” when hashed?
NoMD5 is only five letters; we can go to six and get NoMD5+, which looks better. And, indeed, pmcrsihh yields NoMD5+pyhpe6Xxa3x93iGQ==.
2d
awarded  Nice Answer
2d
revised How can I create a password that says “SALT ME!” when hashed?
Added examples of passwords which fulfill the conditions.
2d
answered How can I create a password that says “SALT ME!” when hashed?
2d
answered Do I need an SSL Certificate for a HTTP only site?
Apr
21
awarded  Necromancer
Apr
21
answered How does Shodan crawl internet-connected devices?
Apr
21
comment What are the OpenSSL standard Diffie Hellmann parameters (primes)?
The warning in the documentation is only theoretical. When you try to break discrete logarithm modulo a prime p, the first attempt is very expensive, but subsequent breaks modulo the same prime are much cheaper (you can reuse big parts of the inner attack results). This is the "specialization" they are talking about. However, a 1024-bit modulus appears to be quite beyond the technologically feasible (current record is 530 bits) so even that "first attempt" is out of reach.
Apr
19
answered What are the OpenSSL standard Diffie Hellmann parameters (primes)?
Apr
19
answered Evaluation of cryptosystem for authentication and keyexchange
Apr
18
answered How does the NSA restrict public access to cryptography?
Apr
17
awarded  Enlightened
Apr
17
awarded  Nice Answer