Reputation
1,085
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
1 10 20
Newest
 Yearling
Impact
~87k people reached

  • 0 posts edited
  • 0 helpful flags
  • 68 votes cast
2d
comment Why is 128bit AES considered very strong but 160bit SHA depreciated?
Interesting but I am confused about the difference between security bits and nonsecure bits. We definitely get 20bytes of data when using SHA so security bits aren't hidden from us AFAIK. Why isn't all the bits security bits or what makes the nonsecure bits so weak? But now this sounds more of a collision attack rather than brute force attack
2d
comment Why is 128bit AES considered very strong but 160bit SHA depreciated?
@forest: 2^64 sounds.... wrong. To be weaken that much you'd have to do 18,446,744,073,709,551,616 possibilities per attempt. I mean you'd need to divide 2^128 possibilities by 18446744073709551616(which is 2^64) to have it search only 2^64 space
2d
accepted Why is 128bit AES considered very strong but 160bit SHA depreciated?
2d
comment Why is 128bit AES considered very strong but 160bit SHA depreciated?
@John I think forest comment is for you
Apr
29
asked Why is 128bit AES considered very strong but 160bit SHA depreciated?
Oct
24
awarded  Yearling
Oct
8
awarded  Popular Question
Aug
20
awarded  Favorite Question
Jul
16
comment Why do we use passwords on sites?
@user23013: Than I need to integrate an openid library. I remember one major lib didn't work because it made assumptions that wasn't true of my site. It's probably fixed now or documented how to get around it
Jul
15
comment Why do we use passwords on sites?
Its strange logging in with FB is common and that isn't. I use a separate browser just for fb bc I don't want all this spam and tracking
Jul
15
asked Why do we use passwords on sites?
Jul
15
awarded  Caucus
Jul
8
revised Why can I sign but not encrypt?
added 339 characters in body
Jul
8
comment Why can I sign but not encrypt?
@GeraldDavis Hmmm that makes sense. I saw decrypt and verify to be similar because you're using the senders public key to decrypt the SHA. It's weird to hear signing is decrypting because you'd decrypt (sign) before encrypt (verify). But I see what you're saying (verify and encrypt both use the target public key
Jul
8
comment Why can I sign but not encrypt?
Well you said "The private key is generated on the card and never leaves the card" so importing would be out of the question as it stores a copy on your HD. Come to think about it. Isn't this all very ridiculous? If we wanted to have that level of security we could just have the RSA key only on the card. I see no reason why we can never encrypt with that key on the card (but then again I don't see a reason to encrypt) and I especially don't see a reason to have two keys for a casual users who might want to sign some source code, or text on his website.
Jul
8
comment Why can I sign but not encrypt?
AFAIK GPG automatically generates the signature keys and stores it on your HD. It has no prompts or suggestions (AFAIK) to store it externally. I'm unsure how to even use a key outside of the default location. I have only import/export and did various signs and encrypt to learn the software.
Jul
8
comment Why can I sign but not encrypt?
@GeraldDavis maybe I'm misunderstanding. When using RSA to encrypt it's something similar to encrypting an AES key and SHA of the message (along with some other data) then concatenate the (AES) encrypted message to it. Is signing just encrypting the SHA concatenate the plaintext and public key? Did you mean to say there are similarity between DECRYPT and VERIFY? I'm not sure what I am misunderstanding
Jul
8
comment Why can I sign but not encrypt?
This is a great answer. To me losing my encryption key is a bigger deal as losing my signing key (data loss). But now I see reasons why someone might care about signing. But all in all there is a copy of your key (on your laptop or where ever) and it could be as easily stolen. I don't see how multiple copies would be any different you never know which will be least secure. Even if they are stolen the passphrase should be strong enough to prevent people from signing. But you're saying for law only one copy should exist and only you should have access to it? A little strange but makes sense
Jul
8
accepted Why can I sign but not encrypt?
Jul
8
comment Why can I sign but not encrypt?
@ott--: Your question is flawed. I don't want to transfer a secret (or private) key to anyone. I want to give them a public key.