190 reputation
10
bio website
location
age
visits member for 9 months
seen Dec 8 at 23:09

Lucky those who have knowledge to help and assist others :)


Dec
8
awarded  Quorum
Dec
5
comment Is there (this) a case in which salting is dispensable?
Stating that the salting is a necessity for the case that what is being hashed is a password, do you then leave the assumed room (and focus of my question) that there might be else cases where the salting is not strictly necessary/ to be seen as an improvement?
Dec
5
comment Is there (this) a case in which salting is dispensable?
Thank you for the insight. What leaves me a little puzzled is the idea about not to store teh nonce. I agree that there is no need to store the nonce forever. Yet I need to store it temporarily else I could not use it and I assume that it would not hurt to store it hashed as this is sufficient for verification.
Dec
5
accepted Difference RSA keypair creation openSSL and openPGP?
Dec
5
comment Is there (this) a case in which salting is dispensable?
@CodesInChaos according to what you present about multi-target attacks yourself in this answer here crypto.stackexchange.com/a/3688/12545 ,you conclude with "This means users of your system should have stronger passwords than users of normal systems.". my csPRNG generated 128bit seems to qualify perfectly for a strong password. Maybe you can let me know more about multi-target attack in an answer even, thank you!
Dec
5
asked Is there (this) a case in which salting is dispensable?
Nov
21
comment Is there a Javascript and Java implementation of a good CSPRNG
It has been asked on this forum already and to how I perceived it an XOR combination of two PNRG outputs could be a way to allow for some better results. Hence when available I assume the browsers (i.e. Mozilla's RandomSource.getRandomValues() function could be eventually "mixed in your sha256 seed hash feedback pnrg feedback".
Nov
21
comment Is there a Javascript and Java implementation of a good CSPRNG
for some inspiration you could have a look into how the linux kernel handles the /dev/urandom csprng (here: github.com/torvalds/linux/…*r%2C+__u8+*out%29 ). It looks to be the application of a SHA1 hash which the output is paritally feedback to the randomsource entropy source. To have hashing SHA256 in javacript for implementing the desired "CS"PRNG you could benefit from the standord javascript crypt lib crypto.stanford.edu/sjcl
Nov
21
comment what are the security benefits of LUKS?
@starfry all very valid points. Yet a setup using dm-crypt or else to directly encrypt a block device might not necessarily be missing any similar improvements. when really talking about pro/cons of either setup one would need to be more specific. Simply to decide to go withou LUKS must not mean that some safety measures are not adopted just as well hence making both having the same relative strength (yet having plausible deniability on the dm-setup).
Nov
19
awarded  Tumbleweed
Nov
12
asked Hokkaido (proof-of-Work system) and pseudo-random permutation table
Nov
12
revised what are the security benefits of LUKS?
added some specifictiy
Nov
12
answered what are the security benefits of LUKS?
Nov
12
revised Can hashing become encrypting?
added an update
Nov
11
awarded  Commentator
Nov
11
comment TLS - self encrypting to avoid tls setup, secure?
if they have an ideal password (hence one that provides for the amount of ramdoness to provide for the n bits key that is used for the symmetric encryption) then to what I understand yes. After als TLS also will end up using symmetric encryption in the second step, only of course not by using a key derived from a password, but a random source. Yet as I said with an ideal password and the same cipher used it is essentially the same thing :), thanks
Nov
11
awarded  Teacher
Nov
11
answered TLS - self encrypting to avoid tls setup, secure?
Nov
11
accepted Are all block ciphers FPE (format preserving encryption)?
Nov
11
asked Encryption in which ciphertext is bigger than plaintext?