76,013 reputation
798196
bio website
location
age 69
visits member for 3 years
seen 10 hours ago

I SHALL DEVOUR YOUR HEART AND FEAST ON YOUR SOUL (so don't bug me).


19h
comment Encryption algorithm keySize restriction in JSSE 7
My guess is that key size restrictions are enforced only for asymmetric algorithms (RSA, DH... but not AES). Anyway, from a practical security point of view, AES-256 is not stronger than AES-128, since AES-128 is already quite far in the "cannot break it with existing or foreseeable technology" zone. Thus, removing AES-128 support does not make a lot of sense. (Also, AES-256 is about 40% slower than AES-128, so there are actually good reasons to prefer AES-128.)
1d
comment What's the benefit of hybrid cryptosystem vs asymmetric for small data blocks?
Decent asymmetric algorithms already include randomness, exactly for that reason. For RSA, this is specified in PKCS#1.
1d
comment How long can a pkcs#8 passphrase be?
There is no hard limit in PKCS#8 about the number of iterations. However, some implementations may have arbitrary limitations, e.g. not having a command-line switch to configure the number of iterations. The real limit on the number of iterations is that iterations make the password-to-key transform expensive for everybody, attacker and defender alike; so you don't want to go to the billions range.
Oct
17
comment How negative are virtual machines (vms) to /dev/urandom?
In general, VM are fine because Linux distributions keep a random seed across reboots (it is part of what happens in the boot scripts) so as long as enough entropy was gathered during installation, you will have strong randomness forever. What can really hurt VM is snapshots/cloning: if you clone a VM then both machines will start with the same internal state, then slowly diverge. The interesting point is how fast they diverge; we currently lack data on that subject.
Oct
17
comment How many hostnames can be supported by a wildcard ssl certificate? Is there any limit?
@Bruno: it should be tested. RFC 2818 certainly allows wildcards to match partial names, but I am not sure deployed clients (Web browsers) actually support that. RFC 6125 lists it as a "may", which means that you cannot really count on it being universally supported.
Oct
17
comment How many hostnames can be supported by a wildcard ssl certificate? Is there any limit?
Note also that, stricto sensu, only the TBSCertificate is DER-encoded; the complete certificate structure may use BER with an indefinite length. However not many implementations support that. Moreover, the SAN extension is in the TBSCertificate.
Oct
17
comment How many hostnames can be supported by a wildcard ssl certificate? Is there any limit?
... BUT you have to subtract 1 because in 1016 bits, the biggest integer you can encode is 2^1016-1. AND then you have to add the length for the header (1 byte for the 0x30 tag, and 128 bytes for the encoding of the length).
Sep
30
comment What is a good practical (and sane) way to manage all your passwords for online sites?
In fact, it is no hardship for daily use, because I remember the passwords that I use daily. The file is for the passwords that I don't remember because I don't use them often, and, by definition, this does not happen often.
Aug
15
comment What is the purpose of “g” -> generator of the multiplicative group
Performance boots from a small "g" is related to the usual "square-and-multiply" algorithm for modular exponentiation. The "multiply" steps are "multiply by g", which will be more efficient if g is a small integer. Note, though, that with common window-based optimizations of that algorithm, more than 80% of the work is spent in the squarings, so the gain obtained by using _g_=2 (instead of any random integer) are slight. Still, if it can be done with no extra cost, there is no reason to refrain.
Aug
15
comment What is the purpose of “g” -> generator of the multiplicative group
RSA is a cryptographic algorithm which does not operate in a cyclic group (at least, not as such).
Aug
13
comment Is there a secure way to create and distribute Shamir Secrets?
"Dynamically composing a secret that no-one knows, and decrypting it": that is called Diffie-Hellman, when you think about it. The "shares" are the private/public DH pairs for both participants, that they generate freely, and they build the shared secret by combining their private key with the public key from the peer.
Aug
12
comment Is there a secure way to create and distribute Shamir Secrets?
I am not sure your question makes sense. Asymmetric encryption is about protecting the confidentiality of some data -- data which already exists. With group decryption, the collaborating private key owners recover the original plaintext, and they all get it; the point is that they do not reveal each other their key shares: further decryption will still need a threshold of key owners.
Aug
12
comment Can virus save to SIM Card?
"Rooting" a phone is often done with the computer equivalent of bashing through a door with a sledgehammer. Some unintended side-effects may occur. The symptoms you describe match more mundane bugs than a true virus. Modern virus don't remove some buttons or reboot phones; they either try to keep invisible, or, if they really want to spread mayhem, they destroy the phone a lot more effectively.
Aug
11
comment Is it Possible to use one commercial SSL Certificate to issue end user certs?
Some commercial CA do sell intermediate CA certificates (I once made such a deal with GlobalSign), but only through a heavy contractual agreement with constraints (e.g. they require that you store the private key in a HSM), and the price is non-negligible.
Jul
29
comment Known characters in passwords?
Honestly, I don't need the tell-tale '==' signs to recognize 'gorv/cp+lSiwiEfKck2dVg' as some Base64 encoding.
Jul
28
comment XTS vs AES-CBC with ESSIV for file-based filesystem encryption
GnuPG's better encryption comes from the fact that it processes the whole file in one go, with a fresh random IV. All the difficulty of FDE is that it tries to support efficient updates, where only the data chunks that are updated get reencrypted. In the file-on-Dropbox case, the encryption should really occur when uploading the filesystem image, not for each file write.
Jul
28
comment XTS vs AES-CBC with ESSIV for file-based filesystem encryption
If you put the encrypted filesystem only once, then there is no problem. Just do it. Potential vulnerabilities begin to occur if you then retrieve the filesystem, modify it, then put it back on Dropbox: the successive versions become visible to attackers. What you can do is to take a filesystem image (not necessarily encrypted with anything), then encrypt it with GnuPG before upload, and decrypting it when downloading it. This will be stronger, both against passive and active attackers.
Jul
28
comment EAP-TLS fragmentation implementation
For the CertificateVerify, you must hash all previous messages, so ClientHello, ServerHello, Certificate (from server), ServerKeyExchange, CertificateRequest, ServerHelloDone, Certificate (the one from the client) and ClientKeyExchange.
Jul
24
comment Can any ECC field element be safely serialized as “compressed” and then restored as uncompressed?
Usually, in crypto, we use finite groups and rings and fields, where there is no notion of negative at all, since there is no natural ordering of elements (you cannot have a "less than" relationship compatible with the group law on a finite group).
Jul
24
comment GPG encryption and signing
Yes, with --sign you sign but you do not encrypt. Distinct operations. The --armor is not about encryption (as in: hiding information from people who don't know some specific key) but about surviving alterations in transit (as in: some email server will convert LF end-of-line characters to CR+LF, or will replace what it supposes to be an "unprintable character" with a "?"). The "armoring" is about coping with the careless way email servers handle emails. On a similar note, Base64 is also internally used when you send a binary attachment, for pretty much the same reason.