93,259 reputation
10134257
bio website
location
age 69
visits member for 3 years, 8 months
seen 19 hours ago

I SHALL DEVOUR YOUR HEART AND FEAST ON YOUR SOUL (so don't bug me).


2d
comment How do I know if a font is malicious?
Would a location become trusted because "an Internet bear said so" ?
Jun
23
comment How critical is it to keep your password length secret?
Modern fashion with TLS is to use AES/GCM cipher suites, where there is no padding -- the plaintext length can thus be inferred with the utmost precision.
Jun
18
comment Why is it fine for Certificates above the end-entity certificate to be SHA1 based?
There is some embryonic standard somewhere, that somehow alludes to the interpretation of a self-signed certificate as a trust anchor, but this is as part of "trust lists" to be used with long-term signatures, and I don't think it is much supported anywhere. The Tradition predates it by at least one decade.
Jun
18
comment Compromised Issuing CA
We are here talking about an offline root CA, which, by definition, cannot be an online responder. Moreover, an OCSP response still has a lifetime; while any relying party MAY insist on getting a fresh response (freshness is verified with the nonce), the question is about OTHER machines -- such freshness cannot be enforced externally.
Jun
18
comment Why is it fine for Certificates above the end-entity certificate to be SHA1 based?
Well, it is not urgent -- SHA-1 is not broken yet -- but yes, if there is a problem with SHA-1 then it is not limited to end-entity certificates.
Jun
17
comment Is it possible to encrypt a download twice, once with a different encryption method?
Encryption does not prevent tampering. To reliably detect tampering, you need a MAC.
Jun
17
comment SSL is Extended Validation more secure?
The idea of EV vs non-EV certificate is that the attacker is assumed to be able to obtain a fake non-EV certificate from an existing CA -- and then, there will be no warning to click through. Browsers don't allow users to "click through" warnings about purportedly EV certificates that don't validate cleanly (and that's, in some way, about protected users from themselves), but then the attacker won't present a fake EV certificate, avoiding this issue.
Jun
4
comment What does the EC Private key version field mean?
Use: openssl pkcs8 -nocrypt -in mykep.pem This will try to read the file as a PKCS#8 file. If it works, then it is a PKCS#8 file.
Jun
4
comment What does the EC Private key version field mean?
The problem is not one of version. The problem is that BouncyCastle expects the private key as a PKCS#8 object. If what you provide is not a proper PKCS#8 object, then you get an exception.
May
26
comment GPG: Can't encrypt DSA 3072 keys
GPG supports DSA and DSA is a signature algorithm, so GPG will be perfectly happy to verify signatures using that key. That's the point of DSA being a signature algorithm and not an encryption algorithm: you can sign with it, you cannot encrypt with it.
May
26
comment GPG: Can't encrypt DSA 3072 keys
The idea is that, for some reason, you have a copy of the recipient's master key (usable for signatures only) but not of his encryption subkey. gpg only sees the signature key, and cannot use it for encryption.
May
25
comment Prevent padding oracle attack on key exchange process
RSA-KEM uses no padding (that's its point) so it should be immune to padding oracle attacks. The random integer from which the key is derived must still be generated in the proper range with enough "uniform randomness". PKCS#1 preferred OAEP over KEM because the security proofs were "tighter" in all generality.
May
25
comment Is it worth it to implement both SHA2 and SHA3 at the same time?
PHC exists precisely because scrypt cannot be considered to be the one-and-only answer to such questions. In fact, scrypt was initially designed to support full hard disk encryption: at password hashing time, several seconds of CPU, and gigabytes or RAM, can be devoted to a single hashing operation. For a server that authenticates clients, the conditions are different, and forces a use of scrypt with other parameters (much less CPU and RAM usage) and it is unclear whether this yields a better bargain than bcrypt.
May
22
comment Should diffie-hellman parameters be unique to a vhost
The known methods for reusing breaking efforts work as long as the several attacked DH instances all use the exact same modulus. If the modulus has a different size, then, in particular, it is not the exact same modulus, and reuse does not apply.
May
15
comment Creating my own CA for an intranet
echo "Abandon all hope, ye who enter here."
May
14
comment Ensure that a file can only be decrypted after a specific date
@RickyDemer: in fact, parallelism-resistance can be argued to be a bad thing for password hashing, because the attacker has all the parallelism he can wish for (he has many potential passwords to hash) while the defender gets password one at a time. If the defender has a parallel architecture (e.g. a GPU or even a PC with a few cores) then he may prefer a function that supports moderate parallelism. Heavy-duty authentication servers benefit from parallelism by virtue of running multiple password-based authentication simultaneously.
May
11
comment How are digital certificates compared?
If the virus injects an attacker-controlled CA inside the set of root CA that the Java VM uses to decide whether an applet is trustworthy, then the attacker may feed you with a fake, corrupted applet that your computer will execute blissfully. My point, though, is that a virus that can do that is also able to simply alter the Java VM or browser code right away, to get a copy of your password as you type it, and send it to its master. The latter method does not even need the attacker to send you a fake Java VM, so it is even simpler for the attacker.
May
9
comment How long does an HTTPS symmetric key last
The key would be renewed exactly as often as the client and server wish it -- i.e., in practice, only when either the client or the server reboots. Which is not a problem, cryptographically speaking (encryption keys are not "used up" until a substantial amount of data has been processed with that key, where "substantial" means "250 billions of gigabytes" when AES is used).
Apr
24
comment Custom socket server on the internet running as root
"Principle of least privilege" is worth anything only as long as there is some actual difference in the available privileges. My point is that the difference between "root" and "non-root" is usually negligible with today's systems -- it mattered a lot when attackers and victims shared the same hardware and OS instance, and "root" was basically a god; but no longer for separate machines, as in your case.
Apr
23
comment This is 2015. Has SHA1 been exploited or cracked yet?
A compelling reasons for switching to SHA-256 for certificates is that some modern browsers (especially Chrome) are beginning to emit warnings when they see SHA-1 used in the signature of a certificate. Regardless of whether SHA-1 is weak or not, using it incurs the risk of scaring users away (especially when users are prospective customers).