5,366 reputation
1724
bio website
location
age
visits member for 2 years, 6 months
seen 2 mins ago

Sep
14
comment RSA key pair generation using PRNG with same seed
@owlstead: No problem, edit away, but perhaps you should narrow down your question, so that it becomes clear my then last paragraph is the adequate answer.
Sep
10
comment Could RDRAND (Intel) compromise entropy?
The point being raised by Dale Emmons here change.org/en-GB/petitions/… is that the hardware random bits are fetched after the other entropy has already been both collected and processed. This means that one might question the claim that the chosen string is really XORed with an unknown string.
Sep
10
comment Should new applications still use RSA? Is it worth going down the ECDH route for protocols?
Could you provide some details about which "breakthroughs" everyone is talking about? It should be noted that neither RSA nor ECC are secure for post-quantum cryptography.
Sep
10
comment Security of S/MIME in case of CA compromise
In the case we got access to several 3rd parties of which at most a limited number are hostile, some readily available alternatives ought to be using cross-signed certificates; multiple PKCS#7 counter-signatures; or PGP keys.
Sep
10
comment Security of S/MIME in case of CA compromise
I take it that you are not aware of any formal security model, in which either Alice and Bob, or Mallory, by adding a few steps can get provable security against the respective adversary?
Sep
9
comment Security of S/MIME in case of CA compromise
I am inclined to accept this answer, since it is indeed a valid conclusion from my assumptions. But are my assumptions and my usage of the term "relatively secure" really that unproblematic?
Sep
9
comment Security of S/MIME in case of CA compromise
@Nemo: Are Alice and Bob a threat to the transparency of Mallory, only if the attack is large scale, Alice and Bob have an out-of-band channel, and they go the extra length to somehow compare the cipher text?
Sep
8
comment Security of S/MIME in case of CA compromise
@nightcracker: Sorry, didn't catch what you meant. Do you want me to change the formatting?
Sep
7
comment RSA key pair generation using PRNG with same seed
Obviously, a 2048 bit two-prime RSA modulus can't have any factors in common with a 1024 bit two-prime RSA modulus, so, yes, changing the parameters might entail different output. The same goes for implementation details: E.g. using a sieve or generating every candidate at random will also lead to different output even if the DRBG sequence is the same.
Sep
7
comment Camellia or AES - which should I use?
Technically, TLS only specifies that the server selects a cipher suite, and not how the order of the client cipher suites should influence this choice. If it does, it is an implementation detail. Hence, the only possible correct answer (that would have the same implications for any theoretically possible standard compliant server), is that you should only enable a cipher suite if you would find it acceptable that the server actually selects it. It is not really a question of which one is the best choice if you only get to pick one. If it was, simply disable the other.
Sep
4
comment Will rehashing an SHA256 hash continually, eventually produce every possible value?
Just to clarify - the term "generator" has different meaning in my comment and in Gilles comment. I use the term as it is used in e.g. RNG - random number generator.
Sep
4
comment Will rehashing an SHA256 hash continually, eventually produce every possible value?
The concept of a "random function" is normally used for a function selected uniformly at random - not for a random generator. While a random generator will not fall into cycles, a function selected uniformly at random will, just like a pseudo random function will.
Aug
31
comment How terribly flawed is this design for key storage?
@TerisRiel: If you can't practically and realistically require strong pass phrases, you really shouldn't be storing the key file in an untrusted location. Using a weaker pass phrase and a PBKDF with a high iteration count, is a good solution if you store the key file locally, and want additional protection in the presumably unlikely event the key file gets into the wrong hands. That is however not an unlikely event, should you store it remotely rather than locally.
Aug
31
comment How terribly flawed is this design for key storage?
@TerisRiel: I agree that it is unrealistic to expect people to change all of their password on each rotation. I also think it is unrealistic to expect the average user to be able to pick a pass phrase with 80-128 bits of entropy. However, the logical consequence isn't that there is anything wrong with the usage policy I outlined. The correct conclusion is that your scheme requires exceptionally strong pass phrases for the key file.
Aug
27
comment Perfect zero knowledge for the Schnorr protocol?
There is a distinction between Perfect ZKPs and ZKPs that "only" rely on computationally hard problems. The title of your question includes the term "perfect", but the body of your question doesn't. Please clarify.
Aug
27
comment Should I delete cryptographic data from memory?
Excellent answer, although technically, it answers the question "how do I erase sensitive data I used in my programmed" and not the question "should I erase sensitive data I used in my program".
Aug
25
comment Do ciphertexts leak information about their algorithmic creators?
@Ninveh: The problem I pointed out is human choices have low entropy. Giving a human a choice between $n$ options, will not correspond to $log_2(n)$ bits of entropy, but far less. Also, the argument that one of the ciphers might be broken, is a completely different one. This is the usual reason why encryption software includes multiple versions - not to increase security, but to make it possible for users to use a different cipher, if their first choice gets broken.
Aug
25
comment Do ciphertexts leak information about their algorithmic creators?
@Ninveh: If an attacker has software that carries out a dictionary attack, modifying it so that it tests words with a constant letter substitution is trivial, and the modified attack will run in the exact same time as the generic attack.
Aug
23
comment Is a 1024-bit DSA key considered safe?
I don't know if the PGP software you use supports this, but given that the trust system conforms to the "web of trust" model, the best way to replace your key would probably be to first generate a new key, then use your existing key to authenticate your new key to your contacts, before you revoke the old one.
Aug
22
comment Will our app be FIPS 140-2 compliant if we use our own AES algorithm implementation?
There is a potential gotcha in the terminology: If you are a software project coordinator and hire someone to deliver a FIPS 140-2 compliant/conformant module, then the cost of validation and certification is not included, but it would be if you ordered a FIPS 140-2 certified module. The same distinction might apply to cryptographic libraries, depending on if the cryptographic boundary is expected to end up inside the library or inside your software that consumes the library.