82,148 reputation
9114220
bio website
location
age 69
visits member for 3 years, 2 months
seen yesterday

I SHALL DEVOUR YOUR HEART AND FEAST ON YOUR SOUL (so don't bug me).


1d
comment Does the entire AES encrypted dataset have to be present to be 'cracked'?
If the PRNG output is in some way predictable by attackers, then the security properties achieved by the "splitting" are reduced, possibly lost completely -- at which point you still have an AES-encrypted string, which should resist until the end of times (unless the encryption key can be guessed, e.g. it was generated with the same flawed PRNG; or the library that uses AES to "encrypt a string" turns out to do something stupid, e.g. CBC with a fixed IV for all strings).
2d
comment Are there implementations of password hashing algorithms for major frameworks that utilizes specialized hardware like GPUs/FPGAs?
There are proposals that support heavy parallelism, and you can always turn a CPU-hard (not memory-hard) function parallel by defining h'(p,s) = h(p,s) XOR h(p,s+1) XOR h(p,s+2)... (p = password, s = salt). Whether this brings the defender on par with the attacker remains to be seen: it depends on whether the defender has GPU (e.g. on his server). There is also all the debate about buying vs running costs (e.g. GPU tend to use a lot of energy, and some people argue that in the long run, power consumption is what matters for the average attack cost).
Dec
15
comment SHA1 - S/MIME and CRL validity after deprecation?
The job of the TSA is to keep its clock accurate, in the same way as the job of a CA is to make sure that it does not issue a certificate to the wrong person. No cryptographic algorithm ever creates trust; it just moves it around.
Nov
24
comment Use of safe prime in RSA digital signature scheme
Fixed. Thank you.
Nov
24
comment Can we have https without certificates?
It is not fully automated -- otherwise you would get your certificate right away, not several hours or days later on. A human being is still involved, even if you don't get to talk to that person.
Nov
14
comment Accessing iPhone data without passcode - how difficult?
I am not sure it is documented, but it must run on the iPhone hardware within the severe time constraints of the user's patience. So it cannot be that expensive.
Nov
14
comment How to prove Bob has received Alice message
In all of this I am assuming signed receipts, with a signature algorithm that cannot be forged (because both Alice and Bob know each other's public keys).
Nov
13
comment Machine Certificate Key File Artifacts
Windows stores private keys with encryption, but the encryption is ultimately based on the password of the account that owns the key. If a machine can boot up alone and use a private key, then that machine necessarily "knows" everything that is needed to access the private key, and thus the key can be recovered. That private key encryption is there to defeat some attackers with only partial access (they can read some files, not all of them), to block a few unsophisticated malware that scan RAM brutally, and, of course, to make a show of "having sprinkled crypto everywhere".
Nov
12
comment Security of pronounceable passwords
I'd say that if passwords are hashed with a weak algorithm then you should fix that first. This is only technology -- far easier to do than changing users' minds.
Nov
12
comment Security of pronounceable passwords
40 bits of entropy are not bad, if you use the passwords for, say, user authentication on a server that uses proper password hashing like bcrypt with a high enough iteration count. If the server uses 1 second worth of CPU to check a password, an attacker with 1000 PC will need 15 years on average to crack a password with 40 bits of entropy, which should be enough to deter him.
Nov
12
comment Security of pronounceable passwords
Yes, I have used a minimizing approximation: I have deliberately restricted myself to a subset of "pronounceable passwords", so that I could more easily compute the number of combinations. The subset is still sufficient to make the main point that the number of pronounceable passwords far exceeds the number of existing English words.
Nov
10
comment How bad is it to truncate a hash?
It is possible to define quite contrived hash functions that show how resistances to preimages, second preimages and collisions are distinct concepts. However, if you resist collisions then you resist second preimages at least as well (though you normally expect a much better resistance for second preimages than for collisions).
Nov
10
comment How bad is it to truncate a hash?
@NWard: for a collision, you challenge the attacker with finding two distinct inputs that hash to the same value. For a second preimage, you issue the same challenge with the additional constraint that you fix one of the two messages that are to collide. (So it makes sense that finding a second preimage is harder than finding a collision.)
Nov
10
comment How can I check the integrity of the downloaded files?
"Integrity" does not mean "the file is nice and innocuous". Integrity is about making sure that a given file is exactly the same as it was at its source. It says nothing about the trustworthiness of the source; only that the file was not altered in transit.
Nov
9
comment Avast https scanning
A tool that does a MitM can remove the Public-Key-Pins headers to prevent pinning from happening, or, alternatively, register its own fake certificates as pins. However, it can be expected that things will break for servers for which pinning was active before installation of Avast. Conceptually, Avast could try to empty the current cache of pinned keys upon installation (or deactivate pinning altogether), but I am not sure there is an API for that; I don't know if Avast bothers doing it.
Nov
9
comment Is publishing CRLs over HTTP a potential vulnerability?
A CRL contains a field called thisUpdate that documents its age. It also contains a (theoretically optional, but in practice always there) field called nextUpdate that specifies a date at which a newer CRL will be available; all implementations use nextUpdate as a CRL expiration date.
Nov
7
comment Completely disabling microphone
Technically no, you cannot trust that. If it can be done from software (BIOS is just software) then it can be undone in software.
Nov
6
comment Indexing encrypted data for efficient searching
"Padding with a secret value before hashing" really means computing a MAC, so you may as well do it correctly. Use HMAC, which is a deterministic MAC. Using HMAC to generate a search key is equivalent to the "deterministic encryption" solution, except that it uses up an extra column (in particular, if you can search the MAC values then you still leak whether two source values are identical or not).
Nov
6
comment How to mitigate the risk of X forwarding?
@SiyuanRen: yes, this would be similar.
Nov
5
comment Why wouldn't it be great, if HTTP/2 would only allow communication via TLS?
@user2813274: there are products that do interception of SSL traffic by generating on the fly a fake certificate and, technically, doing a MitM attack (this of course requires installation of the corresponding CA certificate in the clients). However, this may incur substantial CPU cost on the firewall/filter side, and it breaks client certificates (although this are quite rare in practice).