meta user
network profile
| bio | website | spryhive.com |
|---|---|---|
| location | Seattle, WA | |
| age | 40 | |
| visits | member for | 1 year, 2 months |
| seen | Apr 18 '12 at 21:24 | |
| stats | profile views | 0 |
A long time software architect with a wide ranging background of products and other endeavors. Feel free to google me, I'm not shy. :-) I like people, tech, and I even have a couple of dogs (aussie x-breeds). I'm always happy to help people and share a good laugh.
|
Apr 9 |
revised |
Can I use guids / uuids as counters for key derivation? spelling |
|
Apr 9 |
awarded | Autobiographer |
|
Apr 8 |
comment |
Can I use guids / uuids as counters for key derivation? Ah! You just helped me understand things a little better. A KDF becomes an HMAC when padding is added to guard against extension attacks. Since I don't need to authenticate the key (and the key is never stored) the padding is optional. However, I can understand why HMACs are recommened for KDF since they are also KDFs. |
|
Apr 7 |
asked | Can I use guids / uuids as counters for key derivation? |
|
Apr 4 |
comment |
Can the premaster secret generated by SRP be used as a secure private key? Ack! I even remember reading that now. I think i was wondering if it was uniform enough, or if I needed to HMAC it to death to be sure. |
|
Apr 4 |
accepted | Can the premaster secret generated by SRP be used as a secure private key? |
|
Apr 3 |
asked | Can the premaster secret generated by SRP be used as a secure private key? |
|
Mar 23 |
awarded | Scholar |
|
Mar 23 |
accepted | How realistic is a dictionary attack on a secure remote password protocol (SRP) verifier? |
|
Mar 22 |
comment |
Does the SHA hash function always generate a fixed length hash? Both map a large set into a smaller set. Secure hashes map in a way that is difficult to reverse. Allocation maps are supposed to be easy to reverse. You can also think of them as lossy compression functions, the loss is tuned to the applications needs. |
|
Mar 22 |
answered | Checking a key before actually using it |
|
Mar 22 |
comment |
Checking a key before actually using it @Remo.D: You can use a MIC or a MAC. A message integrity code is a checksum (even a non secure one like fnv1) encrypted with the message, a message authentication code is added outside the code to ensure message authenticity and integrity. Based on computation load the check block is least, followed by the mac, and then finally the mic. Higher computation loads make brute force more time consuming. |
|
Mar 21 |
comment |
Checking a key before actually using it Why the check block? Do you only get one chance to read the cipher text before its destroyed? |
|
Mar 21 |
comment |
How realistic is a dictionary attack on a secure remote password protocol (SRP) verifier? Thanks both of you, that makes a lot more sense. Practically speaking, if the verifiers are obtained by the attacker, its only a matter of computation before the attacker discovers the original password. However, it would be more computation than recovering a table of crypto hashed passwords. |
|
Mar 21 |
comment |
How realistic is a dictionary attack on a secure remote password protocol (SRP) verifier? I added the implied modulus of n to the calculation of v. I think that makes the set of v < set of x. I don't understand the verification formula well enough to know that (B - g^x')^(a + ux') = (A · v^u)^b for all values of v = g^x' mod n. If it is for any values of where x != x' then isn't this just a fancy shared secret? |
|
Mar 21 |
awarded | Student |
|
Mar 21 |
revised |
How realistic is a dictionary attack on a secure remote password protocol (SRP) verifier? added modulus of very large prime |
|
Mar 20 |
asked | How realistic is a dictionary attack on a secure remote password protocol (SRP) verifier? |
|
Mar 20 |
awarded | Supporter |
|
Mar 20 |
awarded | Teacher |
