629 reputation
1425
bio website
location
age
visits member for 2 years, 1 month
seen May 23 at 11:38

Jan
4
comment Storing the activation status of a product and expire details Android
I am not migrating this question to Security.SE, because it would be closed as a duplicate with this answer: The standard technique to circumvent license checks is to replace the conditional-jump after the check with an unconditional one (or a no-operation instruction, if the check is the other way round).
Oct
23
comment Logics for Cryptographic Information Games
I have the feeling that a question about time travelling is not well received on Security.SE.
Sep
20
comment Can I use SHA1 as license key?
On Security.SE, I expect most answers to deal with the ease at which the program can be patched to jump over the check.
Jul
14
comment OpenPGP tag 18/19 description confusion Continuation
Hello calccrypto and welcome to Crypto SE. This site is about the mathematical concept behind cryptography, so I have migrated your question to StackOverflow.
Jul
7
comment how does https key get shared?
Related: How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it? on Security SE
Jan
14
comment Mental Poker with untrusted server (i.e. no peer to peer)
Implementing the game using web technology means that the rouge server may send a manipulated program (javascript) to the user. Therefore the user must be able to do the verification without relying on his game client.
Oct
30
comment Why is an Encrypt-and-MAC scheme with deterministic MAC not IND-CPA secure?
@IlmariKaronen, there is, but I forgot to select the checkbox. Sorry.
Oct
30
comment Why is an Encrypt-and-MAC scheme with deterministic MAC not IND-CPA secure?
@BiggBen1989 "'Deterministic' simply means that, given the same input, the algorithm always produces the same output. That is, if $m=m'$ and $k=k'$, then $Mac_k(m)=Mac_{k'}(m')$. As for "the MAC part of the message", I simply meant $t$ in the output $(c,t)$ of $Enc'$. (Ps. I've flagged your (non-)answer for the mods to convert to a comment. Hopefully they can move my comment too, but if not, I can just repost it.)" by Ilmari Karonen
Oct
12
comment What happens to the entropy of a password when you hash it?
On the practical side, please do not use MD5 to hash passwords, but a hashing function that is designed for passwords.
Aug
29
comment Finding the LFSR and connection polynomial for binary sequence.
Hi jamesj629 and welcome to crypto. Please provide a short summary of the document you linked.
Jul
4
comment Poor man's SSL - is this method as safe as SSL/TLS?
Please give more information on the environment that does not provide a SSL library. You really should try to stick to well tested standards instead of inventing your own crypto.
Jun
30
comment How are state wiretaps obtaining plaintext from encrypted transmissions?
You can add "email stored on the servers of the email providers such a gmail". So while the communication with gmail is encrypted using SSL, the stored mails are not.
Jun
24
comment How much would it cost in U.S. dollars to brute force a 256 bit key in a year?
According to xkcd, $5 for hardware.
Jun
17
comment Is this password migration strategy secure?
Do you mean? original_salt + bcrypt(MD5(original_salt + password), new_secure_salt)
Jun
16
comment Is it possible to use the RSA algorithm, or a variant, for software licensing?
Keep in mind that the common way to attack license checks is to patch the conditional jump at the end of the check. So the program will always execute the code path for successful checks.
Jun
15
comment Assistance Cracking Classical Cipher
Hello Eli and welcome to Crypto. There is a word: "If you give a man a fish, you feed him for one night. But if you teach him how to fish, he will be fed for the rest of his life." I think, it will be more helpful, if you explain how your approached the problem instead of spoiling the solution. But congratulations for finding it.
Jun
12
comment Looking for cipher that uses one ciphertext
@Globalnomad, yes, he can see at least the number of other entries.
Jun
11
comment What's the reason for applying the hash twice when hashing with salt?
LinkedIn did not know the secret, they only knew hash_without_salt(secret). That's what they stored in their database. So unless they waited for every person to login, the only way to add a salt, is to take the stored unsalted hash as input.
Jun
10
comment What is the difference between known-plaintext attack and chosen-plaintext attack?
+1, but xor is the standard example for known-plaintext based attacks: cyphertext = key xor plaintext implies key = plaintext xor cyphertext.
Jun
10
comment How did LinkedIn “salt” all their passwords?
According to media reports the Linkedin passwords have been stolen month ago and only recently published. So LinkedIn may be aware of the theft for quite some time.