190 reputation
6
bio website spryhive.com
location Seattle, WA
age 41
visits member for 2 years, 7 months
seen Apr 5 at 13:54

A long time software architect with a wide ranging background of products and other endeavors. Feel free to google me, I'm not shy. :-) I like people, tech, and I even have a couple of dogs (aussie x-breeds). I'm always happy to help people and share a good laugh.


Apr
9
revised Can I use guids / uuids as counters for key derivation?
spelling
Apr
9
awarded  Autobiographer
Apr
8
comment Can I use guids / uuids as counters for key derivation?
Ah! You just helped me understand things a little better. A KDF becomes an HMAC when padding is added to guard against extension attacks. Since I don't need to authenticate the key (and the key is never stored) the padding is optional. However, I can understand why HMACs are recommened for KDF since they are also KDFs.
Apr
7
asked Can I use guids / uuids as counters for key derivation?
Apr
4
comment Can the premaster secret generated by SRP be used as a secure private key?
Ack! I even remember reading that now. I think i was wondering if it was uniform enough, or if I needed to HMAC it to death to be sure.
Apr
4
accepted Can the premaster secret generated by SRP be used as a secure private key?
Apr
3
asked Can the premaster secret generated by SRP be used as a secure private key?
Mar
23
awarded  Scholar
Mar
23
accepted How realistic is a dictionary attack on a secure remote password protocol (SRP) verifier?
Mar
22
comment Does the SHA hash function always generate a fixed length hash?
Both map a large set into a smaller set. Secure hashes map in a way that is difficult to reverse. Allocation maps are supposed to be easy to reverse. You can also think of them as lossy compression functions, the loss is tuned to the applications needs.
Mar
22
answered Checking a key before actually using it
Mar
22
comment Checking a key before actually using it
@Remo.D: You can use a MIC or a MAC. A message integrity code is a checksum (even a non secure one like fnv1) encrypted with the message, a message authentication code is added outside the code to ensure message authenticity and integrity. Based on computation load the check block is least, followed by the mac, and then finally the mic. Higher computation loads make brute force more time consuming.
Mar
21
comment Checking a key before actually using it
Why the check block? Do you only get one chance to read the cipher text before its destroyed?
Mar
21
comment How realistic is a dictionary attack on a secure remote password protocol (SRP) verifier?
Thanks both of you, that makes a lot more sense. Practically speaking, if the verifiers are obtained by the attacker, its only a matter of computation before the attacker discovers the original password. However, it would be more computation than recovering a table of crypto hashed passwords.
Mar
21
comment How realistic is a dictionary attack on a secure remote password protocol (SRP) verifier?
I added the implied modulus of n to the calculation of v. I think that makes the set of v < set of x. I don't understand the verification formula well enough to know that (B - g^x')^(a + ux') = (A · v^u)^b for all values of v = g^x' mod n. If it is for any values of where x != x' then isn't this just a fancy shared secret?
Mar
21
awarded  Student
Mar
21
revised How realistic is a dictionary attack on a secure remote password protocol (SRP) verifier?
added modulus of very large prime
Mar
20
asked How realistic is a dictionary attack on a secure remote password protocol (SRP) verifier?
Mar
20
awarded  Supporter
Mar
20
awarded  Teacher