89,971 reputation
9126248
bio website
location
age 69
visits member for 3 years, 7 months
seen 3 hours ago

I SHALL DEVOUR YOUR HEART AND FEAST ON YOUR SOUL (so don't bug me).


1d
comment GPG: Can't encrypt DSA 3072 keys
GPG supports DSA and DSA is a signature algorithm, so GPG will be perfectly happy to verify signatures using that key. That's the point of DSA being a signature algorithm and not an encryption algorithm: you can sign with it, you cannot encrypt with it.
1d
comment GPG: Can't encrypt DSA 3072 keys
The idea is that, for some reason, you have a copy of the recipient's master key (usable for signatures only) but not of his encryption subkey. gpg only sees the signature key, and cannot use it for encryption.
2d
comment Prevent padding oracle attack on key exchange process
RSA-KEM uses no padding (that's its point) so it should be immune to padding oracle attacks. The random integer from which the key is derived must still be generated in the proper range with enough "uniform randomness". PKCS#1 preferred OAEP over KEM because the security proofs were "tighter" in all generality.
2d
comment Is it worth it to implement both SHA2 and SHA3 at the same time?
PHC exists precisely because scrypt cannot be considered to be the one-and-only answer to such questions. In fact, scrypt was initially designed to support full hard disk encryption: at password hashing time, several seconds of CPU, and gigabytes or RAM, can be devoted to a single hashing operation. For a server that authenticates clients, the conditions are different, and forces a use of scrypt with other parameters (much less CPU and RAM usage) and it is unclear whether this yields a better bargain than bcrypt.
May
22
comment Should diffie-hellman parameters be unique to a vhost
The known methods for reusing breaking efforts work as long as the several attacked DH instances all use the exact same modulus. If the modulus has a different size, then, in particular, it is not the exact same modulus, and reuse does not apply.
May
15
comment Creating my own CA for an intranet
echo "Abandon all hope, ye who enter here."
May
14
comment Ensure that a file can only be decrypted after a specific date
@RickyDemer: in fact, parallelism-resistance can be argued to be a bad thing for password hashing, because the attacker has all the parallelism he can wish for (he has many potential passwords to hash) while the defender gets password one at a time. If the defender has a parallel architecture (e.g. a GPU or even a PC with a few cores) then he may prefer a function that supports moderate parallelism. Heavy-duty authentication servers benefit from parallelism by virtue of running multiple password-based authentication simultaneously.
May
11
comment How are digital certificates compared?
If the virus injects an attacker-controlled CA inside the set of root CA that the Java VM uses to decide whether an applet is trustworthy, then the attacker may feed you with a fake, corrupted applet that your computer will execute blissfully. My point, though, is that a virus that can do that is also able to simply alter the Java VM or browser code right away, to get a copy of your password as you type it, and send it to its master. The latter method does not even need the attacker to send you a fake Java VM, so it is even simpler for the attacker.
May
9
comment How long does an HTTPS symmetric key last
The key would be renewed exactly as often as the client and server wish it -- i.e., in practice, only when either the client or the server reboots. Which is not a problem, cryptographically speaking (encryption keys are not "used up" until a substantial amount of data has been processed with that key, where "substantial" means "250 billions of gigabytes" when AES is used).
Apr
24
comment Custom socket server on the internet running as root
"Principle of least privilege" is worth anything only as long as there is some actual difference in the available privileges. My point is that the difference between "root" and "non-root" is usually negligible with today's systems -- it mattered a lot when attackers and victims shared the same hardware and OS instance, and "root" was basically a god; but no longer for separate machines, as in your case.
Apr
23
comment This is 2015. Has SHA1 been exploited or cracked yet?
A compelling reasons for switching to SHA-256 for certificates is that some modern browsers (especially Chrome) are beginning to emit warnings when they see SHA-1 used in the signature of a certificate. Regardless of whether SHA-1 is weak or not, using it incurs the risk of scaring users away (especially when users are prospective customers).
Apr
22
comment Why don't we reward users who choose strong passwords?
Well, I don't require users to remember a random password. I suggest it, and I reward them if they do. Writing down passwords is not bad idea, as long as they keep the paper in a safe place (their wallet is not a bad place for that). The real benefit from such a system is not that the password is random; it is that the user will have a distinct password on every site, and passwords for one site cannot be inferred from passwords for the same user on another site. As long as the system enlists user cooperation, and does not try to enforce things, it may work.
Apr
22
comment Password strength with grouping of characters
@Ian the question is about adding three dots to a 20-character password, not replacing three characters in a 23-char password with dots. We assume the attacker knows all about the extra dots; he still has 20 non-dot characters to guess. The underlying question is whether these known dots induce extra structural weakness due to some postulated weird interaction with the hash function computation; that, is, weakness beyond the fact that the attacker knows 3 of the 23 password characters, and has "only" 20 more to guess.
Apr
21
comment Which is better for server-to-server-communication: IPSec or TLS?
"Layers" are ill-defined. For instance, if you use a TLS-based VPN, then the TLS must be both above layer 4 and below layer 3, a logical impossibility. Trying to map all network activity into the rigid "layer" terminology is bound to be restrictive and spread confusion. As for combining two encryption systems to obtain "maximum security", it is called cascading and is not really recommended (cascading surely increases usage cost, but it "increases" security only insofar as one of the cascaded protocols is broken, and it would be smarter not to use a broken protocol at all).
Apr
21
comment Securing a prediction about a future event
Length does not provide entropy. It merely provides room for entropy. The "80 bits" value is the traditional limit of computational feasibility, though the relentless increase in computational power of computers should warrant, at some time, a new traditional limit (cryptographers being in love with powers of 2, they now often talk about "128 bits" as that absolute limit).
Mar
16
comment What certificates are needed for multi-level subdomains?
As I wrote, what RFC 2818 states and what browsers do are different things. Browsers are a lot more restrictive. RFC 6125 is closer to what actually happens in practice. (The server species does not matter here, only the certificate contents and the Web browser.)
Mar
13
comment Begin of Certificate/ End of Certificate dash “-----”
Note that for a long time, the use of encapsulation boundary for certificates was not standardized anywhere; it was best defined as "whatever OpenSSL does and can process". Not including exactly five dashes incurs the risk of being rejected by OpenSSL or one of the other implementations that can understand that format (including the certificate support code in Windows).
Mar
12
comment rainbow table for AES 256 CBC knowing IV, cipher text and plain text
Well, if they use both the same key and IV, and begin with the same sequence of bytes, then the encrypted versions will also be identical, up to the first 16-byte block where the plaintexts diverge. From the outside, you will be able to see on which block this occurs (the encrypted blocks will diverge at that point), so you indirectly gain some information on the unknown message (you learn that you actually know it up to the diverging block). That's about it.
Mar
12
comment rainbow table for AES 256 CBC knowing IV, cipher text and plain text
If you know the plaintext, then it is a known-plaintext attack. For a chosen-plaintext attack, you must be able to choose the plaintext. For once, cryptographers managed to come up with clear terminology.
Feb
25
comment SSL/TLS in-memory data interception after decryption
@Pacerier: simply terminology confusion. What I call "virtual memory" is what is known as "swap space" on Linux; but on Windows things are traditionally called differently. What matters here is data that is in RAM and then gets written to disk (as opposed to data which is conceptually in RAM but is read from disk when necessary).