2,527 reputation
622
bio website
location Netherlands
age 40
visits member for 2 years, 4 months
seen 2 hours ago

Java and security expert with over 10 years of experience with the language and with the practical application of cryptographic protocols - including the design of protocols within international standardization bodies. Creator of a heavily used common criteria certified product. Over 30 years of experience with computers. Likes kids, cats, reading, movies and several sports.


Jan
23
comment Using KDF output for password validation
Oh sorry, I overlooked that sentence, I'll rewrite some stuff... done.
Jan
23
answered Using KDF output for password validation
Jan
23
comment Can curve25519 keys be used with ed25519 keys?
@nightcracker Come again? Sun JCE, PKCS11 & JSSE + ECC. Then there are Bouncy Castle, IAIK libraries, BSAFE... If you want support for a specific curve, ask on the Bouncy mailing list! Or add it yourself of course!
Jan
23
revised Calculating amount of time for brute forcing ciphertext depending on the size of the key
edited title
Jan
23
comment Encrypting or HMACing password digests
I don't think in general that the client should perform the "hashing". Also I'm not sure that "a former employee may have had access to the static encryption key" is sufficient reason to discard a protocol; security is normally achieved by applying different layers, and this certainly makes it harder for an attacker.
Jan
23
comment Encrypting or HMACing password digests
I presume from the above text that you are planning to only store the HMAC if that protocol is choosen (storing a HMAC in addition does not seem to make sense). It may be best to put the verify method in the crypto-server by the way.
Jan
23
comment Encrypting or HMACing password digests
Besides that, normally a two different plaintext will always result in two different ciphertexts for block ciphers modes of encryption - funny enough especially if the same IV is used.
Jan
21
comment Hash 22 byte secret into 512 bit hash: Full entropy?
I guess using a Keccak with 224 bit or 256 bit output would make slightly more sense (and would alter expectations towards the actual amount of entropy in the secret), but if you are ok with the 512 bit output size then there is nothing wrong with that.
Jan
21
comment Can insecure algorithms be combined to form a secure algorithm?
@CodesInChaos In SSL they were concatenated if I'm not mistaken, for the same reason.
Jan
21
answered Hashing entropy generator output with SHA256
Jan
21
comment Which platforms are most vulnerable to Simple Power Analyse Attack
And of course CC EAL 5+ and even higher certified smart cards exist, if you want a more international take at certification. Note that there are specific documents for smart cards within CC. Be warned that certification may be specific to some parts of the entire implementation
Jan
21
comment AES mode for file encryption
I don't know why you are implementing an encrypted file system, but there are specific modes of encryption that have been created with FS encryption in mind. Neither GCM nor CBC seem very compelling for FS encryption to me. Have you looked at existing solutions?
Jan
21
comment ASCII to same-length ASCII encryption?
@fgrieu It seems you will get recommendations here for weak solutions, but we'll downvote them to -10.
Jan
6
awarded  Notable Question
Jan
6
awarded  Nice Answer
Jan
6
comment What is the difference between PKCS#5 padding and PKCS#7 padding
@user4982 blocksize=1 is not useful but possible. blocksize=1 only makes sense for stream ciphers, and stream ciphers do not need padding anyhow. I've explained that the 256 value is exclusive, but as current ciphers have normally a maximum of 256 bit (32 byte) blocks, the maximum is never reached anyway. For a more flexible (and IMHO better) padding mechanism, use bit padding (a single bit set to one, followed by all zero bits).
Jan
6
revised What is the difference between PKCS#5 padding and PKCS#7 padding
edited body
Jan
5
revised What is the difference between PKCS#5 padding and PKCS#7 padding
added point that officially PKCS#5 padding is not compatible with AES
Jan
3
comment How can A pass a message to B, while preventing a third party from sniffing infos?
This sounds like the requirements for Tor
Dec
26
comment Can padding length, and thus plaintext length, be considered public information when using aes-cbc?
@figlesquidge well, as long as the mac is n times the block size and the contents of the plaintext are not used before checking the MAC... Not the best though. Opens up to all sort of attacks.