2,422 reputation
21134
bio website stackexchange.com/users/…
location
age
visits member for 3 years, 2 months
seen 4 hours ago

Moderator♦ pro tempore on French Language, Computer Science and Software Recommendations. I'm also a unix amateur, and a developer with a computer science background and security leanings by trade.

Interested in embedded systems? Join the Embedded Programming and Design proposal!

Programmeurs francophones : participez à Stack Overflow en français.

Avatar picture slightly adapted from a photo by Luridiformis (Zonda Grattus).


Jun
6
reviewed Approve suggested edit on modes-of-operation tag wiki excerpt
Jun
4
comment Padding to increase entropy and size of (otherwise) small JSON objects
@aross Asymmetric encryption is never used for ordinary data directly — it would be technically possible but extremely slow and libraries aren't set up for it. What you do is hybrid encryption: generate a random AES key, use an AES mode to encrypt (and authenticate) the data (your JSON string), and use public-key encryption on the AES key. You can keep using the AES key as long as the other party still has it. JWT only standardizes RSAES-PKCS1-V1_5 for asymmetric encryption, which is not perfect.
Jun
4
answered Padding to increase entropy and size of (otherwise) small JSON objects
Jun
1
reviewed Close How small are we talking about when defining the small public/private key exponent
Jun
1
reviewed Leave Open How Does Progressive Hashing Work?
May
31
reviewed Reject suggested edit on Security of the iterated Hill Cipher
May
29
reviewed Leave Open Why is elliptic curve cryptography not widely used, compared to RSA?
May
27
comment Does data authenticity always, implicitly, provide data integrity?
@otus These are different meanings of integrity (or, if you prefer, different settings which both have an integrity property).
May
27
comment Does data authenticity always, implicitly, provide data integrity?
@otus Yes, that's my point. In this sense, HMAC achieves authenticity (if the HMAC is correct, the file has to be mine) but not integrity.
May
27
comment Does data authenticity always, implicitly, provide data integrity?
@otus That assumes that the sender is cooperative, which is often but not always the case (see my backup example).
May
27
answered Does data authenticity always, implicitly, provide data integrity?
May
26
reviewed Leave Open Why would splitting a password output be better than separate HMACs for encryption/authentication key derivation?
May
25
reviewed Close Journals to read in order to keep up to date with interesting research
May
25
reviewed Close Reverse engineering a single checksum byte
May
25
comment Reverse engineering a single checksum byte
This question appears to be off-topic because it is not about cryptography. It might be suitable for Reverse Engineering, though more information would probably be required for a useful answer.
May
25
reviewed Close Symmetric-Key Based authentication
May
25
comment Symmetric-Key Based authentication
Bleh. Posting a scan is lazy and rude. If you can't even be bothered to type a question, why should we be bothered to read it? And as for doing your homework, what have you tried?
May
23
reviewed Close Understanding math behind RSA key derivation
May
23
reviewed Leave Open Is a Mersenne-twister cryptographically secure if I truncate the output?
May
22
comment Which tamper-protection algorithm provides the shortest output?
@D.W. Given the information in the question, there's a generic approach to authentication and confidentiality, but not to freshness. That's why I explain in my last paragraph that replays, and more generally uses out of context, are possible.