Reputation
2,931
Top tag
Next privilege 3,500 Rep.
Protect questions
Badges
2 14 38
Newest
 Constituent
Impact
~50k people reached

Jul
2
comment How often does RSA-OAEP have a leading zero?
@TBridges42 A key that's one bit short would have the expected number of bytes, yes. But it's unclear to me whether the file with the problematic length even contains a key (and if it does, what makes you sure that it's an RSA key). At that level of remove, it's difficult to know what the vendor did wrong, what your customer is perhaps not reporting faithfully and completely, and what you might be mixing up.
Jul
1
comment How often does RSA-OAEP have a leading zero?
Did you mean bytes where you wrote bits? A 128-bit RSA key would not bring any security, a 1024-bit key is as yet unbroken but should be at least scheduled for replacement.
Jun
16
comment how does https key get shared?
See “Certificates and Authentication” in security.stackexchange.com/questions/20803/…
Jun
15
comment Should I use ECB or CBC encryption mode for my block cipher?
This answer is completely wrong. ECB has no strengths. Its only usefulness in a crypto library is as a building block for other modes that the library doesn't support.
Jun
8
comment Converting ECC Code from python to Java. Extended Euclidean Algorithm not working.
This is a programming problem, unrelated to the fact that the algorithm you're implementing is useful for cryptography. It's off-topic here, but you could ask on Stack Overflow.
Jun
7
comment Creating a LCG with m = 32767
@MaartenBodewes Computer Science
Jun
6
comment Why does anyone use elliptic curves for a CSPRNG?
Few people actually use Dual_EC_DRBG. You may want to try to investigate why the few people listed in that thread did it.
Jun
5
comment How do we know a cryptographic primitive won't fail suddenly?
@fgrieu Would it be ok to say that there is a single family of algorithms, the one-time pad and essentially equivalent variants (the key point being at least as much key material as payload, hence impractical)?
May
27
comment Asymmetric cipher with multiple public keys
@RickyDemer Why ask me here and not there? Anyway: so what? I only changed the title and the tags. I shrunk the very long title to the main point of the question, which is that it isn't enough to specify the password and “AES” in order to have compatible tools. If the IV was the only variable, all tools would be compatible in practice since they pretty much always prepend the IV to the ciphertext.
May
18
comment How to securely store data? / How to securely encrypt a file?
Given the scope, I suggest a chat or meta discussion on the topic first. There's a lot of good material in your answer, but I fear that it's all packed so tightly that it's difficult to find the relevant parts for any given problem.
May
18
comment How to securely store data? / How to securely encrypt a file?
I am voting to close as too broad because, seeing the answer, it's clear that there's just too much stuff to say on the topic. Besides, the answer to the question as written is “use an existing implementation such as dmcrypt, TrueCrypt, GPG, etc.”.
May
9
comment At what point can you you implement crypto algorithms?
I'm voting to close this question as off-topic because it is about risk management, not about cryptography. It was on-topic on Information Security.
May
8
comment At what point can you you implement crypto algorithms?
@gowenfawr This is mainly about risk management, it isn't about crypto itself. So it's far better for Information Security than for Cryptography. I'd vote to close it as off-topic on Crypto.
May
8
comment At what point can you you implement crypto algorithms?
Applied Cryptography is dated, and more targeted at people who design algorithms. His book Cryptography Engineering is more recent and more relevant to crypto implementers.
May
7
comment Why is the P-521 elliptic curve not in Suite B if AES-256 is?
This begs the question of why they weren't interested in a 256-bit security level.
Apr
24
comment Asymmetric cipher with multiple public keys
Why can't all the verifiers receive the same public key? Do you need it to be difficult to tell whether two public keys correspond to the same private key? It would seem that being able to verify the same message would give it away. If you sign a message and then generate more public keys, do the new public keys need to be able to verify the signature?
Apr
20
comment Multiple AES/ECB encryptions of different data with same key all end with same pattern
Your question is incomprehensible. You should give an example with some sample plaintexts and the corresponding ciphertexts, and explain exactly how they're computed (like you did in your comment, but it's unreadable due to the lack of formatting: edit your question). Also tell us how you're generating the IV.
Apr
4
comment What is the purpose of pre master secret in SSL/TLS?
@MaartenBodewes I disagree: this is not an IT security question, it's a protocol design question. Protocol design is cryptography.
Apr
2
comment Is there a need to encrypt data when send over https?
There are three parts here: the browser on Android, the proxy, and the server. What exactly did you install on Android? Is this a certificate for the server or for the proxy? What did you install on the proxy? How did you arrange for the proxy to be a man-in-the-middle? If what you did was to tell Android to trust a certificate for which the proxy has the private key, then this is perfectly normal: you told Android to blindly trust your proxy. In other words, if that's what you did, you opened the door and are now complaining that the zombies are coming in. The solution is: don't do that.
Mar
31
comment How can mega store my login details and still be secure?
That's interesting. Do you work on Mega? If not, where do you get your information from?