74,198 reputation
794188
bio website
location
age 69
visits member for 2 years, 11 months
seen 15 hours ago

I SHALL DEVOUR YOUR HEART AND FEAST ON YOUR SOUL (so don't bug me).


Aug
15
comment What is the purpose of “g” -> generator of the multiplicative group
Performance boots from a small "g" is related to the usual "square-and-multiply" algorithm for modular exponentiation. The "multiply" steps are "multiply by g", which will be more efficient if g is a small integer. Note, though, that with common window-based optimizations of that algorithm, more than 80% of the work is spent in the squarings, so the gain obtained by using _g_=2 (instead of any random integer) are slight. Still, if it can be done with no extra cost, there is no reason to refrain.
Aug
15
comment What is the purpose of “g” -> generator of the multiplicative group
RSA is a cryptographic algorithm which does not operate in a cyclic group (at least, not as such).
Aug
13
comment Is there a secure way to create and distribute Shamir Secrets?
"Dynamically composing a secret that no-one knows, and decrypting it": that is called Diffie-Hellman, when you think about it. The "shares" are the private/public DH pairs for both participants, that they generate freely, and they build the shared secret by combining their private key with the public key from the peer.
Aug
12
comment Is there a secure way to create and distribute Shamir Secrets?
I am not sure your question makes sense. Asymmetric encryption is about protecting the confidentiality of some data -- data which already exists. With group decryption, the collaborating private key owners recover the original plaintext, and they all get it; the point is that they do not reveal each other their key shares: further decryption will still need a threshold of key owners.
Aug
12
comment Can virus save to SIM Card?
"Rooting" a phone is often done with the computer equivalent of bashing through a door with a sledgehammer. Some unintended side-effects may occur. The symptoms you describe match more mundane bugs than a true virus. Modern virus don't remove some buttons or reboot phones; they either try to keep invisible, or, if they really want to spread mayhem, they destroy the phone a lot more effectively.
Aug
11
comment Is it Possible to use one commercial SSL Certificate to issue end user certs?
Some commercial CA do sell intermediate CA certificates (I once made such a deal with GlobalSign), but only through a heavy contractual agreement with constraints (e.g. they require that you store the private key in a HSM), and the price is non-negligible.
Jul
29
comment Known characters in passwords?
Honestly, I don't need the tell-tale '==' signs to recognize 'gorv/cp+lSiwiEfKck2dVg' as some Base64 encoding.
Jul
28
comment XTS vs AES-CBC with ESSIV for file-based filesystem encryption
GnuPG's better encryption comes from the fact that it processes the whole file in one go, with a fresh random IV. All the difficulty of FDE is that it tries to support efficient updates, where only the data chunks that are updated get reencrypted. In the file-on-Dropbox case, the encryption should really occur when uploading the filesystem image, not for each file write.
Jul
28
comment XTS vs AES-CBC with ESSIV for file-based filesystem encryption
If you put the encrypted filesystem only once, then there is no problem. Just do it. Potential vulnerabilities begin to occur if you then retrieve the filesystem, modify it, then put it back on Dropbox: the successive versions become visible to attackers. What you can do is to take a filesystem image (not necessarily encrypted with anything), then encrypt it with GnuPG before upload, and decrypting it when downloading it. This will be stronger, both against passive and active attackers.
Jul
28
comment EAP-TLS fragmentation implementation
For the CertificateVerify, you must hash all previous messages, so ClientHello, ServerHello, Certificate (from server), ServerKeyExchange, CertificateRequest, ServerHelloDone, Certificate (the one from the client) and ClientKeyExchange.
Jul
24
comment Can any ECC field element be safely serialized as “compressed” and then restored as uncompressed?
Usually, in crypto, we use finite groups and rings and fields, where there is no notion of negative at all, since there is no natural ordering of elements (you cannot have a "less than" relationship compatible with the group law on a finite group).
Jul
24
comment GPG encryption and signing
Yes, with --sign you sign but you do not encrypt. Distinct operations. The --armor is not about encryption (as in: hiding information from people who don't know some specific key) but about surviving alterations in transit (as in: some email server will convert LF end-of-line characters to CR+LF, or will replace what it supposes to be an "unprintable character" with a "?"). The "armoring" is about coping with the careless way email servers handle emails. On a similar note, Base64 is also internally used when you send a binary attachment, for pretty much the same reason.
Jul
22
comment Broadband security question
You don't get downvoted when you are not trusted; you get downvoted when your questions or answers are poorly written, off-topic, or just plain wrong.
Jul
22
comment Identifying suspicious encrypted traffic
It is good that Google uses TLS when they try to get new software version or to retrieve information about your Google+ account or anything like that. Otherwise it could be spied upon or altered by attackers. You should rejoice that such traffic is "encrypted". As for the port number, it does not really matter; in fact, using port 443 would be confusing if that which goes inside the TLS is not HTTP.
Jul
18
comment Are files hosted on cloud servers/websites/databases manually checked by people?
Password protection on file storage system is just an access control; the files still are there, ready to be read by any sysadmin on the server side. If you want a storage system where the sysadmins cannot read files, then the files must be encrypted on the client computer with a password or key that never goes to the server.
Jul
18
comment What is the collision likelihood of MD5 when non-numeric values are removed?
I don't know enough of your context to emit any recommendation. I suppose that you are trying, from a smartphone app, to obtain a kind of smartphone identifier that you wish to upload to a server of yours in order to recognize phones from each other. In that case, it seems to me that any attempt at anonymizing is hopeless, regardless of the function you use, basically because the phone can compute that function.
Jul
18
comment Is using a CA more secure if I'm self-signing anyway?
The CA private key is needed on the machine which issues certificates; that needs not be the same as the SSL server. In particular, the CA can be an offline machine. What the SSL server needs is the private key for the SSL server's own certificate. Having a separate CA allows for easier damage containment in case of compromise of the SSL server (if the CA is offline, it is assumed that it cannot be compromised remotely).
Jul
13
comment Why enable SMTP STARTTLS if OpenSSL is dangerous?
The (RSA) signature must be made anew for each connection, because that which is signed includes the DH public key, but also the client and server "randoms" (from the ClientHello and ServerHello messages), which change for each handshake. However, the DH key can be shared and reused (though the point of DHE is that the DH private key is never saved on a non-volatile medium). Since cost of generating a new DH key pair is similar to that of a RSA signature, and so is finalizing the DH key exchange, making a new key-pair for each handshake would account for at most 1/3rd of total cost.
Jul
13
comment Why enable SMTP STARTTLS if OpenSSL is dangerous?
@supercat: well, you have just described "DHE" cipher suites as commonly used in SSL. With a DHE cipher suite, the server sends a DH public key that the server signs with its "permanent" private key (often some RSA private key). The server can create a new DH key pair for each connection ! It is not very expensive, and clients don't expect the key to stay the same; they don't record it anywhere.
Jul
13
comment Why enable SMTP STARTTLS if OpenSSL is dangerous?
Private key operations take time about 1ms or so (depending on algorithm, key length, type of CPU, clock rate...). Context-switching and sending a short data element (e.g. a hash to be signed, or a signature) between two process on the same machine, or between a process and the kernel, is more a matter of a few micro-seconds, so we are talking about an overhead of less than 1% here, even when the CPU spends most of its time doing asymmetric crypto (which is a DoS situation, not something normal).