783 reputation
222
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 2 years, 9 months
seen Jul 31 at 12:18

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Oct
2
comment Is 512-bit RSA still safe for signature generation?
Is there a decent projection of the time it'd take to break a 512-bit key today?
Oct
2
asked In layman's terms, how does Shor's algorithm work?
Oct
2
asked Is 512-bit RSA still safe for signature generation?
Sep
14
comment Why RSA can't handle numbers above 76?
Interesting question. I'm guessing the answer is something to do with the number of bits you can encrypt with such low p and q (or e and d in your case) values, but I'm unsure as to how the modulus affects this. This question would be better on Crypto SE though, so I've flagged for a moderator to move it.
Aug
22
comment Security considerations for partially shared password databases
LastPass is the only solution I'm aware of. It's web-based. However, it's a "freemium" service, so you do have to pay for certain features. I'm actually working on exactly the same sort of idea, except as a client/server app for commercial environments that require shared passwords. Obviously, it could be used at home, too. I aim to make it open source.
Aug
20
accepted Entropy of system data - use all and hash, or trim least significant bits?
Aug
4
comment Blum Blum Shub vs. AES-CTR or other CSPRNGs
Absolutely wonderful answer. I had no idea about the caveats in its security proof - I'm now rather surprised that BBS gets mentioned as a functional CPSRNG at all!
Aug
3
asked Blum Blum Shub vs. AES-CTR or other CSPRNGs
Jul
23
comment How much would it cost in U.S. dollars to brute force a 256 bit key in a year?
This is post number 1337 :)
Jul
23
comment Memory-hard operations in work-factor hash functions
So state = sha512(state) + state would work?
Jul
23
revised Memory-hard operations in work-factor hash functions
Much shorter code.
Jul
22
comment Is this a secure implementation of password reset email?
That's true -- a simple hash should (probably) do the trick. However, I'd still prefer something like bcrypt, since it protects you from most weaknesses you might discover in the PRNG used to generate the tokens.
Jul
22
comment Is this a secure implementation of password reset email?
Treat all password-reset tokens and auto-login tokens as passwords. They essentially are passwords. They need to be long and generated by a strong random number generator. When storing them in the database, hash them with a strong adaptive KDF such as bcrypt.
Jul
20
comment Relation between Threshold Cryptosystem and Secure Multiparty Computation ?
There's no formal study of the relation, because that's like asking for a study on the relationship between basketball and sports. Threshold cryptosystems are a type of secure multiparty computation.
Jul
20
comment How to hack the new save encryption on ipad for uplink?
Hehe, this brings back memories. I used to be pretty active on the forums back in the early days of Uplink!
Jul
20
answered Relation between Threshold Cryptosystem and Secure Multiparty Computation ?
Jul
20
comment Is truncating a hashed private key with SHA-1 safe to use as the symmetric key for AES for data at rest?
Why bother? Just generate a completely independent random key and encrypt it with the private key.
Jul
17
awarded  Citizen Patrol
Jul
16
comment Is it possible to ensure security with zero pre-shared information?
@poncho The only thing the two parties have pre-shared is their locations, e.g. an IP address.
Jul
16
comment Is it possible to ensure security with zero pre-shared information?
I have to agree with @CodeInChaos here. I don't even have software installed to read PPT files.