124,376 reputation
20241436
bio website bolet.org/~pornin
location Quebec City, Canada
age 38
visits member for 3 years, 4 months
seen 11 mins ago

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


Apr
1
comment Force all user processes to be ptraced
The first process launched at boot time is /sbin/init and all other processes are descendent of that one. Things can become a bit complex if your Linux distribution uses an initrd or initramfs. You might prefer to trace the processes from a specific user, rather than all processes. Since there is high potential for making your system unbootable, I recommend that you try your code first in a virtual machine.
Apr
1
awarded  Nice Answer
Apr
1
comment How to securely hash passwords?
Bot nets are just big packs of computers under the effective control of one individual. Since they are all PC, they are quite good at computing PC things, including scrypt. Any password hashing function is weak against bot nets, proportionally to the bot net size. All this slow hashing business is about showing muscle, and a bot net has a lot of muscle.
Apr
1
reviewed Reject suggested edit on What technical reasons are there to have low maximum password lengths?
Apr
1
comment SSL Encryption (for HTTPs) & Security vs Performance
Using a certificate means presenting it (the public part) to the clients, and computing operations with the private key. So, indeed, using ECDSA means that the server has an ECDSA key pair, the public key of which being contained in its certificate.
Apr
1
answered Force all user processes to be ptraced
Apr
1
answered SSL Encryption (for HTTPs) & Security vs Performance
Apr
1
awarded  Good Answer
Mar
31
comment When hashing passwords, is it ok to use the hashed password as the salt?
If it was 3DES is would be dropping everything after the 24th character, which would be better; but, alas, the traditional Unix "crypt()" password hashing function is based on a modified DES, not 3DES.\
Mar
31
answered When hashing passwords, is it ok to use the hashed password as the salt?
Mar
31
reviewed Approve suggested edit on bypass a regex filtration to perform an xss attack
Mar
31
answered NTLMv2 resistance to bruteforcing
Mar
30
comment What technical reasons are there to have low maximum password lengths?
For what it's worth, good password hashing functions will not be much impacted by password length. With PBKDF2, used with HMAC, the password is the HMAC key, so, by application of HMAC, it is first normalized to a value no longer than one internal block (typically 64 bytes). To get 10 seconds of extra CPU work because of a very long password, that password should be about 1.5 GB long, not a mere megabyte.
Mar
30
revised What technical reasons are there to have low maximum password lengths?
added 1 characters in body
Mar
30
revised Certificate authorities for a PKI
there are now 193 UN full members, since the independence of South-Sudan.
Mar
30
answered Does Java's implementation of OCSP and CRL checking handle intermediate CAs?
Mar
30
awarded  Enlightened
Mar
30
awarded  Nice Answer
Mar
30
answered RSA maximum bytes to encrypt, comparison to AES in terms of security?
Mar
29
answered zero knowledge proof - where do we use it?