Henrick Hellström

less info
176 reputation
4
bio website
location
age
visits member for 2 years, 5 months
seen Jul 10 at 16:33

Apr
4
answered In SSL/TLS, what part of a data packet is Encrypted and Authenticated?
Mar
30
awarded  Commentator
Mar
29
comment In SSL/TLS, what part of a data packet is Encrypted and Authenticated?
AEAD datatracker.ietf.org/doc/rfc5246/?include_text=1 section 6.2.3.3. Your IV explanation seems adequate enough, but it depends on the context of course.
Mar
29
comment In SSL/TLS, what part of a data packet is Encrypted and Authenticated?
For TLS 1.0, this is correct. In TLS 1.1 (and later) you will also get an explicit IV between line 01 and 02 if a CBC mode cipher is negotiated. In TLS 1.2 an AEAD cipher might be negotiated, which means line 04 will depend on the cipher.
Jan
8
answered Is it possible to sign a certificate such that the issuer is different than in the CA's certificate?
May
23
comment Can attackers steal SSL certificate from server and use it for MITM attacks?
@Ramhound: Embedding the self signed certificate of the server in the software, is in principle sufficient for ensuring that the certificate sent by the server indeed belongs to the author. What you loose is the ability to transparently updating the server certificate. One might actually argue that letting a server authenticate itself to an iOS app using a commercial certificate, would introduce a vulnerability, since it is way too hard for the user to verify which CAs the device actually trusts.
May
23
awarded  Editor
May
23
revised Can attackers steal SSL certificate from server and use it for MITM attacks?
added 227 characters in body
May
23
comment Can attackers steal SSL certificate from server and use it for MITM attacks?
@Ramhound: An attacker could not sign a new certificate such that it is both binary identical to the original certificate, and the attacker has access to the corresponding private key. Hence, the important question is how certificates are verified and compared.
May
23
answered Can attackers steal SSL certificate from server and use it for MITM attacks?
Mar
11
comment Truecrypt compromised? (Coldboot attack)
"In forensics, we have known about this for years"
Dec
14
awarded  Supporter
Mar
7
comment How to protect data on your hard disk if it is in an unfriendly environment?
It would probably be cheaper to get a manufacturer to build a rugged and tamper resistant tablet, than to hire armed guards to watch over a retail device.
Mar
7
comment How to protect data on your hard disk if it is in an unfriendly environment?
Is it running on an external power supply? What prevents a reasonably skilled electrician from cross-wiring the power cord without cutting the power to the device?
Mar
7
comment How to protect data on your hard disk if it is in an unfriendly environment?
Sure, if it is going to be secure at all, there has to be ways to trigger the security mechanisms (after all, they are there to be triggered by something). But it doesn't have to be that easy. If the device is supposed to be placed in public, it is supposed to be used by the public. I presume the requirement is just that it shouldn't be possible to use it for an extended period of time in case it is stolen, so the obvious solution would be for it to send alerts to the server it is connected to in case of unusual gyro or GPS readings, and the server will eventually decide how to act.
Mar
5
comment How to protect data on your hard disk if it is in an unfriendly environment?
Equip the device with a gyro and GPS and design the hardware to automatically erase all internal data if it moves more than some tolerance limit.
Mar
5
awarded  Teacher
Mar
5
answered How to protect data on your hard disk if it is in an unfriendly environment?
Feb
17
comment Does prepending a salt to the password instead of inserting it in the middle decrease security?
Regarding the last two paragraphs of the answer: Iterating a hash algorithm ten thousand times makes it more computationally expensive. Iterating ten thousand times is equivalent to adding 13+ bits of entropy to the password, or conversely: Using a ten thousand times faster hash algorithm is equivalent to removing 13+ bits of entropy from the password. It's a matter of definition and context whether this is "significant", but there is no significant difference between iterating a fast algorithm or using one that is slow by itself.