1,202 reputation
521
bio website
location
age
visits member for 2 years, 10 months
seen 8 hours ago

Sep
12
comment Can custom elliptic curves be used in common TLS implementations?
Hm, maybe we're better off that way - having to explicitly specify/announce it will probably avoid many compatibility issues (for example, libs that only support 25519 as a custom curve). Somebody apparently submitted a draft for Curve25519's use in TLS three days ago; maybe somebody will do the same for X.509 and Ed25519. Let's hope we'll see an implementation this decade :) ietfreport.isoc.org/idref/draft-josefsson-tls-curve25519
Sep
12
comment Can custom elliptic curves be used in common TLS implementations?
Thanks, that was very detailed and helpful! One more question: What about djb's Curve25519 and Ed25519? Could they be implemented by specifying a custom curve, or do the limitations you mentioned in your answer to a similar question still apply? (stackoverflow.com/a/2517052/1016939)
Sep
10
comment RdRand from /dev/random
@CodesInChaos I agree, it is implemented in a weird way. Maybe they don't want to rule out a very specific weakness in the hash function used? But then /dev/random shouldn't be world-writable in the first place...
Sep
10
comment RdRand from /dev/random
For the way RdRand is currently used in Linux, see also this related question: crypto.stackexchange.com/questions/10283/…
Sep
9
comment OpenSSL: Enable cipher suites per protocol version
I definitely agree; however, at least one popular SSL setup security validation/certification service didn't (for quite a while, they used to penalize any vulnerable cipher suites in their checks). Meanwhile, they've changed their opinion and now penalize RC4 instead... Also, Google seems to trust RC4 more than AES-CBC - at least, that's what they select for Google Chrome in my experience.
Sep
6
comment Consequences of tampered /etc/ssh/moduli
Is SSH's /etc/ssh/moduli analogous to OpenSSL's dh{512,1024,2048}.pem file? I always thought those contained a fixed (non-ephemeral) secret DH value. If they are the same thing, can they also be world-readable and even shared between servers?
Sep
4
comment Do mobile OS's provide crypto-quality randomness?
This drop-in replacement should be used to fix SecureRandom in any application relying a proper RNG: android-developers.blogspot.de/2013/08/…
Jul
19
comment Why should one not use the same asymmetric key for encryption as they do for signing?
I agree that it's a bad idea. Nevertheless, S/MIME seems to provide both (encryption and signing) with a single key/certificate pair, if I'm not mistaken.
May
10
comment Is OpenGL a security problem?
Very interesting - I knew that it was hard to access the GPU over remote login sessions, but never suspected the reason was security... I also mostly agree with respect to exploiting the GPU being harder than exploiting user carelessness, but still, there is an important distinction - cautious users CAN verify the permissions before installing, but there is no permission for OpenGL.
Jul
19
comment Can an intermediate CA be trusted like a self-signed root CA?
Yes, they do. So it really is by design that the clients refuse to use the intermediate certs as roots of the validation process? Is that a consequence of the chain always being anchored by the root CA?
Jul
12
comment Is there a way to mitigate BEAST without disabling AES completely?
Are you serious? TLS 1.1 will only be supported in the upcoming version 21 of Chrome and is not supported in Firefox, and I don't even want to begin to research the state of TLS 1.1 support on mobile devices.
Nov
4
comment Are WPA2 connections with a shared key secure?
Actually, I'm wondering why the designers of 802.11 didn't use DH in WPA. It would require an active man-in-the-middle attack to recover the PTK, as opposed to just passive sniffing. Maybe they thought that it would just give users a false sense of security?
Nov
3
comment Are WPA2 connections with a shared key secure?
Correction: Actually it's the PTK (pairwise transient key) that is derived from the PMK during every authentication of a client. The PMK is just a hash of the PSK and the SSID. But it's still as I said above; it's enough to record the handshake and know the PSK to know all the keys between an AP and a client.
Nov
3
comment Are WPA2 connections with a shared key secure?
No, you need to collect the key exchange for all the clients you want to listen in on. The key exchange is where the pairwise master key is derived from the PSK.
Nov
3
comment Are WPA2 connections with a shared key secure?
As long as the key echange is part of the collected packets and the PSK is known, it should work for an arbitrary number of clients.
Nov
2
comment Are WPA2 connections with a shared key secure?
Setting up a fake access point will not work. Since the clients are configured to use a network with WPA encryption, they will never associate with an access point that has no encryption or uses a different encryption key. In that respect, WPA-PSK provides mutual authentication between the client and the AP in addition to encryption.