618 reputation
48
bio website coding-stories.com
location Paris, France
age 35
visits member for 4 years, 3 months
seen Mar 26 at 12:55

I am a software engineer specialized in Java and security/cryptography. I am also interested in testing and code quality topics.


Jan
13
comment Server-based PDF Signing using HSM
Well, PKCS#11 has been designed for personal smartcards and does not fit very well with cloud services. However, for instance, with the nCipher HSM (I have some experience with it) you can configure a quorum of operators required to access the key. Such a configuration can improve the trust on the system for the customers. Unfortunately I never used Cloud HSM. At first glance I think it is possible to build a signature service on a Cloud HSM. But I also believe that, first of all, it's worth an comprehensive threat analysis
Sep
25
comment How do systems protect against a stolen code-signing certificate after the certificate expires?
I realized that may be a bit unclear in my answer. I updated my answer trying to give a little bit more details.
Mar
11
comment How does encryption/decryption work when one generate random key?
I said "encrypted file" but maybe "encrypted data" is a better term. I mean, even with the password, the encrypted data (i.e. the cipher output) does not contain itself all required information to be decrypted. The algorithm parameters are also required such as the IV for a symmetric cipher, the PBKDF2 salt or iteration count... Of course, a file encryption software should gather all these information along with the encrypted data into the "encrypted file".
Feb
26
comment Signing my certificate by using my smart card and eID card?
When you are talking about keyserver, do you mean GPG keyserver?
Feb
26
comment Signing my certificate by using my smart card and eID card?
I do not know if it is a common practice and it depends on what you want to do with your certificate. For instance if you want some third parties to validate some documents you signed, you should use the signature certificate. If you want to authenticate yourself against a web site or web service (e.g. using a SSL connection with client authentication) you should use the authentication certificate. See the CPS sections 1.3 and 1.8 for more details on the certificate usages.
Jul
3
comment GOST cipher test vectors
Maybe you can use these tested implementations to generate some test vectors.
Jan
25
comment Initialization vector with cipher block
Non random IV may lead to a "chosen plain text" attack. There is a nice description here: stackoverflow.com/questions/3008139/…
Jan
3
comment Is anybody using client browser certificates?
Yes I was unclear. I meant that the administration is able to to ensure that the identity of certificate requestor (i.e. the private holder) matches and the declared identity. Technically speaking there is a unique private number on the tax payment receipt (of the previous year) used as shared secret during the certificate generation process.