97,100 reputation
12144270
bio website
location
age 70
visits member for 3 years, 9 months
seen 1 hour ago

I SHALL DEVOUR YOUR HEART AND FEAST ON YOUR SOUL (so don't bug me).


Jul
22
answered Actual use of covert channel in malware
Jul
22
comment How much entropy is good enough for seeding a CSPRNG?
If your CSPRNG is really CS, you do not need to use several of them (if that was a problem, then your CSPRNG would not be really CS).
Jul
22
answered How much entropy is good enough for seeding a CSPRNG?
Jul
22
answered Why does StartTLS block connection to apache
Jul
22
answered Will it improve security if I place both SHA1 and SHA256 signatures inside codesigned binary on Windows?
Jul
22
answered How secure is socks5 proxy over ssh?
Jul
22
answered For maximum security is it best to link OpenSSL libraries statically or dynamically?
Jul
22
comment How bad an idea is intentionally using short RSA keys for signing CloudFront private-content URLs?
@AaronD: that's the point: we are not talking about encryption but signatures. If a new key is generated every day, then it does not matter if an attacker breaks a key that was used two years before -- it won't be accepted anyway. This highlights that encryption and signatures use really distinct security models.
Jul
22
answered How bad an idea is intentionally using short RSA keys for signing CloudFront private-content URLs?
Jul
21
comment How to steganograph ownership information into members uploaded images?
Well, watermarking does not have to be obvious; in fact, we prefer it when it does not deteriorate the picture's main functionality, i.e. "being looked at". But, contrary to steganography, it is not a problem if the watermark is known to be there (in fact it is often the point: to deter copyists by making it known that there is a watermark).
Jul
21
comment How to steganograph ownership information into members uploaded images?
"watermarking is a lot harder to do than steganography". Yes, I think that I meant to say that, and also that I actually did.
Jul
21
answered Key derivation inside secure container of HSM
Jul
21
answered How to steganograph ownership information into members uploaded images?
Jul
21
answered How safe is password based key derivation in the case of long password?
Jul
21
answered Guid salt - string vs bytes[]
Jul
21
comment Is it complicated to deploy my own CA?
There is no such thing as a definitive, authoritative source for English typography (contrary to, say, French typography, because the French, in all their frenchness, created an Académie Française whose job is to be Right, always). Using a space before the question mark is relatively rare but not unheard of among English writers. It is often said to mimic French punctuation. The question mark itself is a relatively recent import into English (circa 1580, say some authors). Bottom-line: it is not absolutely incorrect to put a space; and I find it clearer that way.
Jul
20
answered Is it complicated to deploy my own CA?
Jul
19
comment do serial numbers for x509 certs need to be sequential or can they be timestamp's?
There is an official recommendation: for backward compatibility with some deployed implementations, the serial number encoded value should fit in 20 bytes -- thus you can use integers up to 2^159 (DER encoding of an INTEGER is signed, so there must be room for a sign bit).
Jul
17
comment Is it good practice to send passwords in separate emails, and why?
Most "best practices" are old lore turned into dogma through sedimentation, and parroted by people who like to think of themselves as "cybersecurity experts".
Jul
17
comment What Country, State and City should I choose when requesting an SSL certificate?
Theoretically, a PKCS#10 certificate request is supposed to be signed with the corresponding private key; this is called a "proof of possession" (i.e. you may request a certificate with a given public key only if you actually control the corresponding private key). What you would gain from buying a certificate with the public key of somebody else is unclear. Also, this self-signature cannot work for an encryption-only key (e.g. Diffie-Hellman). Many CA will verify the self-signature, mostly out of Tradition.