550 reputation
37
bio website coding-stories.com
location Paris, France
age 35
visits member for 3 years, 11 months
seen Dec 12 at 11:25

I am a software engineer specialized in Java and security/cryptography. I am also interested in testing and code quality topics.


Sep
25
comment How do systems protect against a stolen code-signing certificate after the certificate expires?
I realized that may be a bit unclear in my answer. I updated my answer trying to give a little bit more details.
Mar
11
comment How does encryption/decryption work when one generate random key?
I said "encrypted file" but maybe "encrypted data" is a better term. I mean, even with the password, the encrypted data (i.e. the cipher output) does not contain itself all required information to be decrypted. The algorithm parameters are also required such as the IV for a symmetric cipher, the PBKDF2 salt or iteration count... Of course, a file encryption software should gather all these information along with the encrypted data into the "encrypted file".
Feb
26
comment Signing my certificate by using my smart card and eID card?
When you are talking about keyserver, do you mean GPG keyserver?
Feb
26
comment Signing my certificate by using my smart card and eID card?
I do not know if it is a common practice and it depends on what you want to do with your certificate. For instance if you want some third parties to validate some documents you signed, you should use the signature certificate. If you want to authenticate yourself against a web site or web service (e.g. using a SSL connection with client authentication) you should use the authentication certificate. See the CPS sections 1.3 and 1.8 for more details on the certificate usages.
Jul
3
comment GOST cipher test vectors
Maybe you can use these tested implementations to generate some test vectors.
Jan
25
comment Initialization vector with cipher block
Non random IV may lead to a "chosen plain text" attack. There is a nice description here: stackoverflow.com/questions/3008139/…
Jan
3
comment Is anybody using client browser certificates?
Yes I was unclear. I meant that the administration is able to to ensure that the identity of certificate requestor (i.e. the private holder) matches and the declared identity. Technically speaking there is a unique private number on the tax payment receipt (of the previous year) used as shared secret during the certificate generation process.