296 reputation
10
bio website
location Baltimore, MD and New York, NY
age
visits member for 11 months
seen Oct 15 at 2:41

Jeff is a security architect and mobile security engineer who works with Android, iOS and Windows Phone/Windows RT. In the past, he's worked with Blackberry and Windows Mobile. Jeff has nearly 20 years of experience with C and C++, and over 6 years with Objective C. His experience includes implementing secure containers, secure transports and device management on a wide array of platforms including mobile handsets to surveillance drones.

Jeff's first programming language was Atari Basic on an Atari 400, followed by Atari Assembler to get more than two colors on the screen at the same time. It was purchased from a Sears department store because there were no computer stores at the time. It was the late 1970s and early 1980s, and the Atari had 4K or RAM but no hard drive. Non-included peripheries purchased later were a single-sided super floppy, a cassette loader, a 300 baud modem and a dot matrix printer.

Jeff's formal education includes undergad work at the University of Maryland, and graduate work at Johns Hopkins University. He majored in Computer Science at both schools.


Sep
24
awarded  Autobiographer
Jul
28
awarded  Citizen Patrol
Jul
2
awarded  Curious
Jun
29
comment Entropy of Androids motion-sensor data
"... If l is less than 81% of the sensors Peek value the set of values is ignored..." - I think this is less than ideal. When you are trying to get a PRNG in good working order or keep a PRNG in good working order, use whatever you have. Don't throw less-than-perfect ones away. Peter Gutmann said similar: "...mix every entropy source you can get your hands on into your PRNG, including less-than-perfect ones...". From Heml.is - "The Beautiful & Secure Messenger".
Jun
29
comment Entropy of Androids motion-sensor data
On both Android and iOS, I perform similar. I use the sensors to gather a seed; and I don't sample the generator for prolonged periods of time. I grab two or three samples on app startup (or during a reseed), and then feed them to the crypto library's random number generator. You get an {x,y,z}-float triplet from the sensors. Just send them into the PRNG without preprocessing like ((int) x) ^ ((((int) y) ^ ((int) z)) << 16). What's the point of preprocessing and throwing bits away? Let the PRNG handle it. That's what it was designed to do.
Jun
18
revised Trial divisions before Miller-Rabin checks?
Added info on tainting answers.
Jun
18
comment Trial divisions before Miller-Rabin checks?
Thanks @Thomas. I appreciate the help. I would like to accept both answers, but I cannot.
Jun
18
accepted Trial divisions before Miller-Rabin checks?
Jun
18
comment Trial divisions before Miller-Rabin checks?
@fgieu - Forgive my ignorance.... Isn't this log base 2: $t=\lceil{1\over2}\cdot\lg n\rceil$? When I programmed it, I believe I calculated it as ceil( (log(k)/log(2))/2 ). I'm fairly certain k was bits, and not a random k-bit number. Unfortunately, I overwrote the test program already.
Jun
18
revised Trial divisions before Miller-Rabin checks?
deleted 5 characters in body
Jun
18
revised Trial divisions before Miller-Rabin checks?
Added edit about OpenSSL and Crypto++.
Jun
15
revised Trial divisions before Miller-Rabin checks?
Algorithm 4.4 -> Algorithm 4.44
Jun
15
revised Trial divisions before Miller-Rabin checks?
Added that 17863 is the 2048-th prime.
Jun
15
asked Trial divisions before Miller-Rabin checks?
May
5
accepted Security benefits of Ed25519 generating signatures deterministically
May
5
comment Security benefits of Ed25519 generating signatures deterministically
"I think there's a slight confusion there.... Diffie-Hellman" - yes, poorly worded.
May
5
revised Security benefits of Ed25519 generating signatures deterministically
added 56 characters in body
May
5
asked Security benefits of Ed25519 generating signatures deterministically
May
2
awarded  Teacher
Apr
24
comment CVE-2014-1295 (Apple's Secure Transport and Triple Handshake Attack)
Oh, OK. I thought I read about that some time ago. I guess the attack is more recent than I first thought...