85,551 reputation
9121233
bio website
location
age 69
visits member for 3 years, 5 months
seen Mar 15 at 23:57

I SHALL DEVOUR YOUR HEART AND FEAST ON YOUR SOUL (so don't bug me).


Mar
16
comment What certificates are needed for multi-level subdomains?
As I wrote, what RFC 2818 states and what browsers do are different things. Browsers are a lot more restrictive. RFC 6125 is closer to what actually happens in practice. (The server species does not matter here, only the certificate contents and the Web browser.)
Mar
13
comment Begin of Certificate/ End of Certificate dash “-----”
Note that for a long time, the use of encapsulation boundary for certificates was not standardized anywhere; it was best defined as "whatever OpenSSL does and can process". Not including exactly five dashes incurs the risk of being rejected by OpenSSL or one of the other implementations that can understand that format (including the certificate support code in Windows).
Mar
12
comment rainbow table for AES 256 CBC knowing IV, cipher text and plain text
Well, if they use both the same key and IV, and begin with the same sequence of bytes, then the encrypted versions will also be identical, up to the first 16-byte block where the plaintexts diverge. From the outside, you will be able to see on which block this occurs (the encrypted blocks will diverge at that point), so you indirectly gain some information on the unknown message (you learn that you actually know it up to the diverging block). That's about it.
Mar
12
comment rainbow table for AES 256 CBC knowing IV, cipher text and plain text
If you know the plaintext, then it is a known-plaintext attack. For a chosen-plaintext attack, you must be able to choose the plaintext. For once, cryptographers managed to come up with clear terminology.
Feb
25
comment SSL/TLS in-memory data interception after decryption
@Pacerier: simply terminology confusion. What I call "virtual memory" is what is known as "swap space" on Linux; but on Windows things are traditionally called differently. What matters here is data that is in RAM and then gets written to disk (as opposed to data which is conceptually in RAM but is read from disk when necessary).
Jan
7
comment Plausibly deniable SSH - does it make sense?
Conceivably the server could decide to switch to SSH behaviour (and sending a banner) if it did not get a SSL ClientHello within, say, 5 or 10 seconds after the connection. A 5-second initial delay is usually not a serious problem for SSH (SSH connections are long-lived).
Jan
7
comment PGP as method of sharing AES key?
I would not recommend using a WoT because I don't believe that WoT actually provide any substantial guarantee. It is more a ritual dance by which WoT users try to propitiate the Crypto Gods, than a really effective method for thwarting attacks. What really works against attacks is public key pinning, by which clients remember server keys. In OpenPGP, the WoT is so cumbersome to use that clients invariably use key pinning after having appeased the WoT deity, and that provides security.
Jan
7
comment Why use 256-bit symmetric encryption in TLS when 2048-bit RSA doesn't even offer 128-bit strength?
Belief that "key entropy" acts like some kind of sci-fi shield strength that is incrementally consumed by cryptanalytic attacks, is unsubstantiated. It is a common reflex to go for longer keys as if it granted some sort of "security margin", but in fact attacks don't work that way. In the case of AES and the only known non-trivial attacks (which are related-key attacks so not an immediate worry), 256-bit keys turn out to be weaker than 128-bit keys, not stronger. The only case where longer keys are actually "stronger" is against brute force, for which 128-bit keys are already strong enough.
Dec
21
comment How is user authentication sent in a public wifi? Radius/802.1x/EAP etc
Some routers intercept the first outgoing HTTP connection and replace it with the router "login page"; but the client system will not send that request unless it has first resolved the IP address of the target server, so DNS has to go through.
Dec
19
comment Does the entire AES encrypted dataset have to be present to be 'cracked'?
If the PRNG output is in some way predictable by attackers, then the security properties achieved by the "splitting" are reduced, possibly lost completely -- at which point you still have an AES-encrypted string, which should resist until the end of times (unless the encryption key can be guessed, e.g. it was generated with the same flawed PRNG; or the library that uses AES to "encrypt a string" turns out to do something stupid, e.g. CBC with a fixed IV for all strings).
Dec
18
comment Are there implementations of password hashing algorithms for major frameworks that utilizes specialized hardware like GPUs/FPGAs?
There are proposals that support heavy parallelism, and you can always turn a CPU-hard (not memory-hard) function parallel by defining h'(p,s) = h(p,s) XOR h(p,s+1) XOR h(p,s+2)... (p = password, s = salt). Whether this brings the defender on par with the attacker remains to be seen: it depends on whether the defender has GPU (e.g. on his server). There is also all the debate about buying vs running costs (e.g. GPU tend to use a lot of energy, and some people argue that in the long run, power consumption is what matters for the average attack cost).
Dec
15
comment SHA1 - S/MIME and CRL validity after deprecation?
The job of the TSA is to keep its clock accurate, in the same way as the job of a CA is to make sure that it does not issue a certificate to the wrong person. No cryptographic algorithm ever creates trust; it just moves it around.
Nov
24
comment Use of safe prime in RSA digital signature scheme
Fixed. Thank you.
Nov
24
comment Can we have https without certificates?
It is not fully automated -- otherwise you would get your certificate right away, not several hours or days later on. A human being is still involved, even if you don't get to talk to that person.
Nov
14
comment Accessing iPhone data without passcode - how difficult?
I am not sure it is documented, but it must run on the iPhone hardware within the severe time constraints of the user's patience. So it cannot be that expensive.
Nov
14
comment How to prove Bob has received Alice message
In all of this I am assuming signed receipts, with a signature algorithm that cannot be forged (because both Alice and Bob know each other's public keys).
Nov
13
comment Machine Certificate Key File Artifacts
Windows stores private keys with encryption, but the encryption is ultimately based on the password of the account that owns the key. If a machine can boot up alone and use a private key, then that machine necessarily "knows" everything that is needed to access the private key, and thus the key can be recovered. That private key encryption is there to defeat some attackers with only partial access (they can read some files, not all of them), to block a few unsophisticated malware that scan RAM brutally, and, of course, to make a show of "having sprinkled crypto everywhere".
Nov
12
comment Security of pronounceable passwords
I'd say that if passwords are hashed with a weak algorithm then you should fix that first. This is only technology -- far easier to do than changing users' minds.
Nov
12
comment Security of pronounceable passwords
40 bits of entropy are not bad, if you use the passwords for, say, user authentication on a server that uses proper password hashing like bcrypt with a high enough iteration count. If the server uses 1 second worth of CPU to check a password, an attacker with 1000 PC will need 15 years on average to crack a password with 40 bits of entropy, which should be enough to deter him.
Nov
12
comment Security of pronounceable passwords
Yes, I have used a minimizing approximation: I have deliberately restricted myself to a subset of "pronounceable passwords", so that I could more easily compute the number of combinations. The subset is still sufficient to make the main point that the number of pronounceable passwords far exceeds the number of existing English words.