CodesInChaos

5,964 reputation

1927

bio	website	github.com/CodesInChaos
	location	Munich, Germany
	age
visits	member for	1 year, 10 months
	seen	3 hours ago
stats	profile views	109

Jabber/XMPP: CodeInChaos@jabber.ccc.de
IRC: CodesInChaos on freenode
Email: My nick on gmail
Blog: codesinchaos.wordpress.com
GitHub: github.com/CodesInChaos
Google+
Twitter @CodesInChaos

	5,964 reputation	bio	website	github.com/CodesInChaos	visits	member for	1 year, 10 months
1927 badges		location	Munich, Germany		seen	3 hours ago

summary answers questions tags badges favorites bounties reputation activity

1,106 Actions

suggestions reviews revisions comments badges posts accepts all

Jun 19	comment	Which blind signature schemes exist, and how do they compare? First one is the original paper for Blind RSA signatures. I can't look at the second one ATM. I hope my university has a subscription.
Jun 19	comment	Are there standards for transport layer security using only symmetric keys? If you have hardware AES, does that mean that other cryptographic functions, such as SHA1 are much slower than AES? In that case I'd consider an AES based MAC, such as CBC-MAC.
Jun 19	comment	Are there standards for transport layer security using only symmetric keys? Most SSL libraries are rather big. He'll need a specialized embedded SSL library.
Jun 19	comment	Are there standards for transport layer security using only symmetric keys? "keys actually change over time" How does that work? I don't remember anything of that kind being in non ephermal suites.
Jun 19	comment	Are there standards for transport layer security using only symmetric keys? Can you give numbers for very little flash/RAM?
Jun 19	comment	Are there standards for transport layer security using only symmetric keys? Do your embedded devices have access to a good entropy source? Can you generate reliable nonces?
Jun 19	comment	Are there standards for transport layer security using only symmetric keys? You'll need to be careful about using IVs and MACs correctly. Plain AES-CBC is vulnerable to active attacks.
Jun 19	comment	Distinguishing Encryption Methods from the Output Cross post: stackoverflow.com/questions/11072921/…
Jun 18	comment	Why are there $ signs in my passwd file? The standard attack vector is guessing the password. Since GPUs are fast, you can use many password candidates.
Jun 18	revised	Why are there $ signs in my passwd file? added 24 characters in body
Jun 18	answered	Why are there $ signs in my passwd file?
Jun 18	comment	Is ECB mode secure if plaintexts guaranteed to be unique? I just want to emphasize that people often underestimate the severity of attacks against unauthenticated modes. A 16 bit checksum is nice to protect against random errors, but not enough to protect against malicious modifications.
Jun 17	comment	Is this password migration strategy secure? Looks perfectly fine to me.
Jun 15	comment	Why is ciphertext from low entropy plaintext not compressible? Compressing a ciphertext implies breaking the encryption. Since the best known algorithms for breaking AES are very expensive (about 2^128 operations), the best known algorithms for compressing the ciphertext are at least as expensive.
Jun 11	comment	Is this streamable combination of encryption and MAC secure? With CTR mode, you don't need to include $IV_i$, but you still need to include the block number. Else the reordering is still possible, and will result in corrupted plaintext. At least if you use a encrypt then MAC mode.
Jun 11	comment	Encryption vs. decryption of same plaintext That depends on the mode. Most secure modes use an IV to prevent both of them.
Jun 11	comment	How did LinkedIn “salt” all their passwords? I'd go with the second unless your website regularly deletes inactive users. For a typical website I'd expect most users to be inactive.
Jun 11	comment	Is this streamable combination of encryption and MAC secure? If you don't include $ IV_i $, random read access becomes much harder, since you still need to verify the IV somehow. Else the attacker can modify the IV, allowing him to modify your first plaintext block without you noticing. This assumes that the last block of the previous part serves as IV for the current part. If you use a different method for deriving the IV, this might not be necessary.
Jun 10	comment	Okay to use OpenSSL to encrypt then sign a message? Everybody sees who signed the message.
Jun 10	revised	What's the reason for applying the hash twice when hashing with salt? added 323 characters in body