Reputation
1,887
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
1 10 26
Newest
 Good Answer
Impact
~404k people reached

  • 0 posts edited
  • 2 helpful flags
  • 41 votes cast
Dec
8
comment EMV(Chip) Cards - What's the point of having the chip card communicating directly to the authorising server? & Clarification of CDA in EMV
The card can indeed communicate privately with the issuer, but for various reasons, the PAN is not end-to-end encrypted between card and issuer in EMV. It is transmitted along the other transaction data (amount etc.), using whatever transport encryption the terminal, POS, merchant acquirer and card network use/mandate.
Dec
8
comment EMV as authentication technology and not a data security technology
EMV does not use a dynamic CVV. It uses a complex protocol between card, terminal and card issuer. Maybe you are thinking about legacy contactless transactions which do indeed use a dynamic CVV.
Oct
5
comment Smart cards for user authentication - is configuration of PIN complexity important?
That's an interesting authentication scheme, is there a name for it? (I've heard the term "protocredential" in a similar context.) EMV (chip) credit and debit cards work differently, though; they actually verify the PIN locally and disable themselves after a number of wrong PIN entries. (Some cards don't support local or offline PIN verification; the PIN is then encrypted and transmitted to the card issuer for verification.)
Oct
1
comment Accessing keystrokes directed at iframe?
At least the recent version of Chrome allows viewing certificate information for an iframe by right-clicking anywhere inside the iframe and selecting "View frame info", which is very useful for 3-D secure.
Jun
27
comment Android L encryption vs. iOS 8 encryption
@runeks Actually, the Secure Enclave is also located inside the SoC die. The difference lies in the logical architecture, and arguably only applies to the existing implementations: Apple states that the SE uses encrypted memory; I remember reading that many TrustZone implementations do not, making them vulnerable to certain hardware attacks (e.g. a DRAM emulator). I don't see why a TrustZone implementation couldn't include a hardware key (compare dl.acm.org/citation.cfm?id=2541949) and use encrypted memory, though.
Oct
30
comment How well is the SSL/TLS handshake protected against modifications?
That was very helpful, thank you! Out of curiosity, why is an HMAC forgery not enough? Is changing HMAC(master_key, ..., handshake_hash) to HMAC(master_key, ..., handshake_hash') not a forgery? (Of course, it would have to be a "nested forgery", since that hash is authenticated again by the selected SSL MAC, usually also HMAC, using an also unknown key. I can see that the chances of such an elaborate forgery are marginal even for MD5.)
Oct
3
comment Does Android encryption really prevent law enforcement access?
Google still seems to be able to remotely unlock a device even when using a PIN or password as of Android 4.4. On the Android Device Manager, the existing screen lock mechanism can be replaced with a password entered in the web interface. I haven't checked what happens in case the device is encrypted, though (since this would theoretically bring the lock screen password and the encryption password out of sync).
Sep
25
comment Is building an NFC payment app without a secure element like Apple Pay fundamentally insecure?
Based on the content of your question, do you actually mean something like "is creating an NFC payment app using HCE, i.e. without a secure element, inherently insecure"? Apple Pay is only one of various mobile payment systems that use a secure element.
Sep
12
comment Can custom elliptic curves be used in common TLS implementations?
Hm, maybe we're better off that way - having to explicitly specify/announce it will probably avoid many compatibility issues (for example, libs that only support 25519 as a custom curve). Somebody apparently submitted a draft for Curve25519's use in TLS three days ago; maybe somebody will do the same for X.509 and Ed25519. Let's hope we'll see an implementation this decade :) ietfreport.isoc.org/idref/draft-josefsson-tls-curve25519
Sep
12
comment Can custom elliptic curves be used in common TLS implementations?
Thanks, that was very detailed and helpful! One more question: What about djb's Curve25519 and Ed25519? Could they be implemented by specifying a custom curve, or do the limitations you mentioned in your answer to a similar question still apply? (stackoverflow.com/a/2517052/1016939)
Sep
10
comment RdRand from /dev/random
@CodesInChaos I agree, it is implemented in a weird way. Maybe they don't want to rule out a very specific weakness in the hash function used? But then /dev/random shouldn't be world-writable in the first place...
Sep
10
comment RdRand from /dev/random
For the way RdRand is currently used in Linux, see also this related question: crypto.stackexchange.com/questions/10283/…
Sep
9
comment OpenSSL: Enable cipher suites per protocol version
I definitely agree; however, at least one popular SSL setup security validation/certification service didn't (for quite a while, they used to penalize any vulnerable cipher suites in their checks). Meanwhile, they've changed their opinion and now penalize RC4 instead... Also, Google seems to trust RC4 more than AES-CBC - at least, that's what they select for Google Chrome in my experience.
Sep
6
comment Consequences of tampered /etc/ssh/moduli
Is SSH's /etc/ssh/moduli analogous to OpenSSL's dh{512,1024,2048}.pem file? I always thought those contained a fixed (non-ephemeral) secret DH value. If they are the same thing, can they also be world-readable and even shared between servers?
Sep
4
comment Do mobile OS's provide crypto-quality randomness?
This drop-in replacement should be used to fix SecureRandom in any application relying a proper RNG: android-developers.blogspot.de/2013/08/…
Jul
19
comment Why should one not use the same asymmetric key for encryption as they do for signing?
I agree that it's a bad idea. Nevertheless, S/MIME seems to provide both (encryption and signing) with a single key/certificate pair, if I'm not mistaken.
May
10
comment Is OpenGL a security problem?
Very interesting - I knew that it was hard to access the GPU over remote login sessions, but never suspected the reason was security... I also mostly agree with respect to exploiting the GPU being harder than exploiting user carelessness, but still, there is an important distinction - cautious users CAN verify the permissions before installing, but there is no permission for OpenGL.
Jul
19
comment Can an intermediate CA be trusted like a self-signed root CA?
Yes, they do. So it really is by design that the clients refuse to use the intermediate certs as roots of the validation process? Is that a consequence of the chain always being anchored by the root CA?
Jul
12
comment Is there a way to mitigate BEAST without disabling AES completely?
Are you serious? TLS 1.1 will only be supported in the upcoming version 21 of Chrome and is not supported in Firefox, and I don't even want to begin to research the state of TLS 1.1 support on mobile devices.
Nov
4
comment Are WPA2 connections with a shared key secure?
Actually, I'm wondering why the designers of 802.11 didn't use DH in WPA. It would require an active man-in-the-middle attack to recover the PTK, as opposed to just passive sniffing. Maybe they thought that it would just give users a false sense of security?