meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 1 year, 3 months |
| seen | 2 mins ago | |
| stats | profile views | 29 |
|
May 13 |
comment |
Is there a way to do fair exchange between two parties who don't trust each other? Are you familiar with en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange? If yes, and this wouldn't meet your specific requirements, please explain why. |
|
May 12 |
comment |
Designing a security system from scratch with a custom protocol, suggestions needed Technically, it is perfectly possible to use SSL/TLS over any kind of odd transport, as long as the transport features reliable serialization of packets. Hence, you might perfectly well use the database server as a link in that communication, and let the two end nodes communicate using SSL/TLS. |
|
May 9 |
answered | Does knowledge of original file size provide a cryptographic weakness? |
|
May 9 |
comment |
Recommended way of adding a pepper/secret key to password before hashing? @JesperMortensen: Given the clarified answer, I have to agree with D.W. regarding option 3. You might use $HKDF_{key}(password)$, but it would be overkill to use HDKF for this step, presuming $key$ is already pseudorandom. |
|
May 8 |
comment |
Recommended way of adding a pepper/secret key to password before hashing? You might want to read the HKDF specification, in particular the section on "extraction". You should change the role of the salt and the password in 3. |
|
May 8 |
comment |
What does $(\mathbb{Z}_n^*)^2$ mean? @user4811: It looks that way, but perhaps more to the point, was there anything in the context of that theorem that led you to believe the notation could have anything to do with quadratic residues? |
|
May 8 |
revised |
What does $(\mathbb{Z}_n^*)^2$ mean? added 10 characters in body |
|
May 8 |
revised |
What does $(\mathbb{Z}_n^*)^2$ mean? added 608 characters in body |
|
May 8 |
comment |
What does $(\mathbb{Z}_n^*)^2$ mean? @RickyDemer: The group $(\mathbb Z_1,\cdot)$ is indeed the trivial group with just one element, which happens to be the element zero. Since it is a trivial group I don't think I have ever seen anyone use the notation $\mathbb Z_1^*$ for it (and fwiw and imho I don't see a need for it either). |
|
May 8 |
comment |
What does $(\mathbb{Z}_n^*)^2$ mean? @D.W.: Is my phrase "a mathematical notation" really correct after your edit? Should it be replaced by "used in cryptography to denote"? |
|
May 8 |
comment |
What does $(\mathbb{Z}_n^*)^2$ mean? @RickyDemer: Me too, but I consulted my text books in mathematics. The * symbol means "excluding zero", and does not necessarily entail that all elements are invertible under the implied operation. For instance, $(\mathbb Z^*,\cdot)$ means the set of non-zero integers under multiplication, which has all properties of a group except invertibility. I don't know what is the correct way of denoting the subgroup of integers relatively prime to the modulus. |
|
May 8 |
revised |
What does $(\mathbb{Z}_n^*)^2$ mean? added 610 characters in body |
|
May 7 |
revised |
What does $(\mathbb{Z}_n^*)^2$ mean? added 27 characters in body |
|
May 7 |
answered | What does $(\mathbb{Z}_n^*)^2$ mean? |
|
May 7 |
comment |
Are digital signatures secure for signing lots of small messages? You might want to pay close attention to exactly what "authentic" means in this context. It just means that the sender at some point in time, indeed signed a message with particular contents. Hence, replay attacks might be a concern in similar scenarios. If you need to know when and in response to what request the sender signed the message, the sender will have to sign that information too. |
|
May 5 |
revised |
how much is secure to encrypt a password using itself (as encryption key) for storing it on a unsecure media? edited body |
|
May 5 |
revised |
how much is secure to encrypt a password using itself (as encryption key) for storing it on a unsecure media? Moved the salt to the key extraction instead of the AES iteration. Arguably, this would make some meet-in-the-middle attacks more difficult. |
|
May 5 |
revised |
how much is secure to encrypt a password using itself (as encryption key) for storing it on a unsecure media? added 109 characters in body |
|
May 5 |
answered | how much is secure to encrypt a password using itself (as encryption key) for storing it on a unsecure media? |
|
May 5 |
comment |
how much is secure to encrypt a password using itself (as encryption key) for storing it on a unsecure media? Is there any particular reason you want to use AES for this (such as it is the only cryptographic algorithm implemented on the device and you can't implement anything else, such as some hash algorithm and password based key derivation schemes)? |
