Tom Leek

24,721 reputation

42668

bio	website
	location
	age	67
visits	member for	1 year, 7 months
	seen	yesterday
stats	profile views	1,162

I SHALL DEVOUR YOUR HEART AND FEAST ON YOUR SOUL (so don't bug me).

	24,721 reputation	bio	website		visits	member for	1 year, 7 months
42668 badges		location			seen	yesterday

summary answers questions tags badges favorites bounties reputation activity

116 Comments

suggestions reviews revisions comments badges posts accepts all

1d	comment	Protecting Password Hashes with Store Procedures? A server which receives requests of the type "I got this password for this user name, is it OK ?", and sends answers "yes" or "no".
May 13	comment	Cascading Encryption Algorithm using mcrypt or GnuGP "Lack of practical use" is the polite way of expressing it. Personally, I would have said that cascading algorithms is bloody stupid. I am somewhat disappointed in TrueCrypt for indulging in such voodoo.
May 13	comment	optimal way to salt password? Reliably maintaining a counter is hard across reboots, and hard when there are multiple frontends as well. DNS names are unique worldwide but not necessarily forever (domains are sometimes abandoned and then registered again by someone else); also, uniqueness does not work for internal, closed networks. Apart from that, it would work.
May 11	comment	How can I punish a hacker? The said hacker already spends his nights on his computer, alone, staring at his bleak screen, looking for vulnerabilities and installing backdoors. How could you possibly punish him any further ?
May 10	comment	Does ssh-keyscan tell you if a server supports RSA or DSA keys? `ssh-keyscan` tells you which key types are used by the server for its own part. If a server has a key of a given type, then it has code to support that kind of key, but it does not necessarily mean that it will support similar key types for authenticating clients. And neither in the other direction. That's not a reliable inference to make.
Apr 29	comment	Does hash solve passwords in parts? The downside of adding "obvious" words in the password is that they don't add much to security, but you still have to type them when you use them. This becomes a problem if this incites the user to shorten the "non-obvious" parts of his password.
Apr 29	comment	Windows Phone and Hardcoding Values It is very recent. Got out of private beta one or two weeks ago, I think.
Apr 29	comment	Prevent DOS against RSA authentication On a 2.7 GHz i7, I get much better values: 757 for RSA 2048, 2652 for ECDH/P-256. Still on one core.
Apr 28	comment	Prevent DOS against RSA authentication And now with an even older 1.6 GHz Turion 64 processor from 2005 (whereas the 2650e is from 2008 and the A8 is from 2012), I get a whooping 1695 ECDH/P-256 per second, as opposed to 318 RSA-2048 per second. There is something wrong in modern AMD processors, or in OpenSSL, or both.
Apr 27	comment	Prevent DOS against RSA authentication There's something definitely fishy with OpenSSL's implementation. The same code runs at over 1000 ECDH (with P-256) per second, on an old, cheap, 1.6 GHz AMD Athlon 2650e, which should be slower, not twice faster, than the more recent A8 (SHA-1 benchmark are more coherent: 240 MB/s for the 2650e, 340 MB/s for the A8). OpenSSL's EC code was contributed from Sun, and was supposedly audited carefully to be uncovered by existing patents, which means that OpenSSL developers are reluctant to modify it in any way.
Apr 24	comment	Encryption of headers in IPsec tunnel mode @akh2103: yes, that's about that.
Apr 24	comment	How to identify the Java program that is maliciously accessing my web site from many client addresses? The infected machines try to locate other machines which could be infected, by virtue of sporting server software versions with known remotely exploitable holes. If a server, contacted by an infected machine, returns "foobar v42.17" and the botnet software knows how to infect servers which use "foobar v42.17", then the infected machine will automatically proceed to infect that server and make it join the botnet.
Apr 22	comment	“Please Enter Nth Character” without HSM My answer mostly expresses that it can be mathematically proven that there cannot be a good solution -- negative results are rarely popular, which might explain a downvote, out of anger at the Universe in general.
Apr 20	comment	how secure is passwordcard.org? `nextLong()` is implemented by calling `next(32)` twice (to get two random 32-bit integers). `SecureRandom` has its own `next()` implementation which uses `nextBytes()`. `nextBytes()` does automatic seeding from what the underlying OS provides (e.g. `/dev/urandom`) so that one, at least, is safe.
Apr 18	comment	Is it appropriate to use haveged as a source of entropy on virtual machines? I may also add that I have some reservations about trusting people for implementing a PRNG, when they show that their framework for testing their results is statistical tests, which, by definition, are terrible for cryptographic usages. This does not bode well.
Apr 18	comment	Is it appropriate to use haveged as a source of entropy on virtual machines? @gwuertz: if the output passes the continuous tests even when its entropy source has been fixed (no measure at all !), then this means that the tests are not adequate to test for cryptographic strength -- as is expected, since such tests are for statistical patterns, not for unpredictability. If you talk a strong crypto-grade PRNG and seed it with a fixed 0, you will also pass all such tests with success, and your security will nonetheless be nil.
Apr 17	comment	How can police find out about criminal activity on an iPod Touch? This book claims to explain it all. At least, I see no conceptual impossibility in opening the case and reading the Flash chip directly.
Apr 17	comment	Using MD5 for file integrity checks? Technically a second preimage attack, since the attacker also has the genuine file to start with. This is not exactly the same thing as a preimage attack (but close enough).
Apr 16	comment	How to encrypt packets in network? Ethernet is not inherently encrypted. For other network types, anything goes... especially for cable companies, who rarely disclose the nature of the protocols they run over the cable (they want to discourage rogue wiring). It is safest to assume that there is no protection unless you explicitly configured a VPN between the relevant machines.
Apr 12	comment	Is OpenSSL AES GCM standardized? I did not say that OpenSSL rejects IV longer than 12 bytes; only that NIST recommends that implementations reject IV longer than 12 bytes. Also, the extra bytes are not ignored; they just don't provide additional security benefits. You already have the best security you can hope for with 12 bytes.