176,113 reputation
27377588
bio website bolet.org/~pornin
location Quebec City, Canada
age 40
visits member for 4 years, 6 months
seen 15 hours ago

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


Dec
29
reviewed Approve Learning to script tools in Python and general Pen Testing
Dec
29
awarded  Enlightened
Dec
29
awarded  Nice Answer
Dec
27
revised Client Authentication by certificates in Google APP Engine java
edited tags
Dec
27
answered Client Authentication by certificates in Google APP Engine java
Dec
27
awarded  Enlightened
Dec
27
awarded  Nice Answer
Dec
27
answered Who is the creator of the CIA triad?
Dec
27
answered Would SSH MitM attacks utilize spoof IPs?
Dec
26
awarded  Good Answer
Dec
26
comment Authencity of information displayed on an untrusted device
Your picture-based proposal relies on the existence of a picture that the human user knows of, but nobody else (in particular, not the attacker would hijacked the smartphone). This seems hardly realistic; moreover, inspections of a few such pictures-with-text will reveal most original picture pixels, so this is a one-shot security feature. Finally, your proposal also requires that any text alteration would result in gaps, which is not guaranteed (e.g. turning a 'P' into an 'R' needs only extra pixels).
Dec
26
answered ECC based Client Certificate import in Chrome/Mozilla in windows
Dec
26
reviewed Approve Regarding SQL Injection at Back End?
Dec
25
answered Authencity of information displayed on an untrusted device
Dec
25
comment Why OpenSSL can't use /dev/random directly?
That large table is the S-box (expanded) for the symmetric encryption algorithm SEED, specified in RFC 4269. It is an "official" algorithm from Korea. In OpenSSL source code, the SS[] array is defined in seed.c but used in macros defined in seed_locl.h (which is included by seed.c).
Dec
25
awarded  openssl
Dec
24
answered Why OpenSSL can't use /dev/random directly?
Dec
24
awarded  Custodian
Dec
24
reviewed Approve Can I use hardware random number generation on my computer? Am I already using it?
Dec
24
reviewed Approve mutual authentication between two clients