1,830 reputation
2825
bio website stackexchange.com/users/…
location Paris, France
age 34
visits member for 2 years, 8 months
seen 22 hours ago

Moderator♦ pro tempore on French Language and Usage and Computer Science. I'm also a unix amateur, and a developer with a computer science background and security leanings by trade.

Interested in embedded systems? Join the Embedded Programming and Design proposal!

Avatar picture slightly adapted from a photo by Luridiformis (Zonda Grattus) (except where I use another picture).


Apr
15
comment Could program verification techniques prevent bugs of the genre of Heartbleed from occurring?
@e-sushi Again, no, this is not a matter of opinion. Most compilers (C compilers being one of the most common exceptions) will not produce code if they detect that the program does not match some minimal specification which includes checking that no part of the program uses uninitialized memory.
Apr
15
comment Could program verification techniques prevent bugs of the genre of Heartbleed from occurring?
@HenrickHellström This is blatantly false: if the program passes the verification, it correctly implements the specification that is being verified. The specification may be incomplete — for example, it's very hard to specify the absence of side channels — but what is there can be proved in the right framework. (I'm not saying it's easy!) There is a wide gap (uncomputable, for starters) between implementation and specification.
Apr
15
comment Could program verification techniques prevent bugs of the genre of Heartbleed from occurring?
@e-sushi Nonsense. This question is not asking for “absolute security”, it's asking about “bugs of the genre of Heartbleed”. It's not just “fun to discuss”, it's a serious topics that researchers work on.
Apr
15
comment Could program verification techniques prevent bugs of the genre of Heartbleed from occurring?
@mikeazo Information Security might take it; there is a recent somewhat similar, but broader question, which is gathering close votes as unclear but not as off-topic. Computer Science would take it (I'm a moderator there).
Apr
15
comment Could program verification techniques prevent bugs of the genre of Heartbleed from occurring?
@HenrickHellström You assert that it is possible to write a correct, but unverifiable program. This is true but uninteresting. The question here is whether it is possible to write a correct and verifiable program.
Apr
13
comment How do they implement MAC in TLS?
@CuriousSam TLS “packets” (called records in the specification) are unrelated to how the stream is broken down into TCP packets.
Apr
12
comment Open SSL signatures - merkle ecdsa rsa
This question appears to be off-topic because it is purely about using the openssl tool.
Apr
9
comment SHA256-based stream cipher
Thank you @figlesquidge . I've rescinded my close vote; the question is still too broad but at least it goes well with your answer so I guess that's ok.
Apr
9
comment SHA256-based stream cipher
Please include enough information to make your question self-contained. Note that we do not do full reviews of crytographic schemes (“is this scheme secure?”). We can provide feedback about specific properties (”is this step vulnerable to this type of attack?“). If you edit your question, take care not to invalidate figlesquidge's answer.
Apr
9
comment How to attack a classical cipher using known partial plaintext?
Welcome to Stack Exchange. This answer would be more interesting if you described some algorithms to detect classical ciphers, rather than just linking to some code (whose operating principle isn't even described, at least not at that URL).
Mar
31
comment Testing hardware random number generators?
possible duplicate of How random are commercial TRNGS
Mar
24
comment What is the difference between known-plaintext attack and chosen-plaintext attack?
Well, ok. Raw RSA is a cryptographic algorithm, but it isn't a (good) encryption or signature algorithm. The key point is that signing a plaintext is not the same operation as decrypting a ciphertext. They typically use different keys (because they should have different management policies), and the padding is different.
Mar
19
comment How to create PSK key?
This question appears to be off-topic because it is about the programming aspects of using a cryptographic library, and best answered by reading the documentation anyway.
Mar
7
comment Adding “salt” to “doHash” function in Java
As stated, this is a programming question, which is off-topic here. However, you could edit this to be about cryptography proper: explain the algorithm in the code, and ask how it fails to have preimage resistance (if you don't understand why) or how the algorithm could be modified to achieve this.
Mar
2
comment NTRU crypto from unseen.is; myth busting help
This is about marketing claims regarding cryptography, rather than about cryptography itself. As such this question is off-topic here, but would be on-topic on Information Security as it touches on choosing a method to achieve a security objective. As it happens, this question has already been asked there: A service that claims beyond army level encryption
Feb
21
comment Why do we use XTS over CTR for disk encryption?
@HenrickHellström Yes, it will be a concern for integrity, but not for confidentiality. I didn't dwell on the integrity part much. For replay protection, you can't have a deterministic scheme: there has to be something that distinguishes the latest, valid content from some older, formerly valid content.
Feb
21
comment Why do we use XTS over CTR for disk encryption?
I think the most important reason not to use CTR is that it fails catastrophically due to counter reuse if the adversary can observe the ciphertext at different times. Against an active attacker, when you want integrity in addition to confidentiality, you need something else (typically MAC or AEAD) anyway.
Feb
20
comment Seed / reseed DRBG too often?
@BrockHansen I'm afraid I don't see how this relates to my answer.
Feb
15
comment My SSH server public key is 2048 bits, but my account's private key is 4096. What is my effective security?
@HenrickHellström, user2071506: These are different keys!
Feb
12
comment Certificate signature with SHA-1 and RSA: where do 1888 bits come from?
I don't understand the question (this may be a language problem). What do you mean by “a combination of 2048 bits”? Why are you subtracting 160 from 2048, or where does 1888 come from?