John Deters

1,000 reputation

bio	website
	location
	age
visits	member for	9 months
	seen	yesterday
stats	profile views	5

	1,000 reputation	bio	website		visits	member for	9 months
8 badges		location			seen	yesterday

summary answers questions tags badges favorites bounties reputation activity

123 Actions

suggestions reviews revisions comments badges posts accepts all

Feb 25	answered	Algorithm/Technique for Steganography
Feb 25	answered	Chosen Plaintext Attacks
Feb 25	answered	Bad/Crackable Encryption Example?
Jan 14	comment	Is the One Time Pad (OTP) considered a cryptographic hash function? I removed "unique" from my statement as it's not at all relevant to your question.
Jan 14	revised	Is the One Time Pad (OTP) considered a cryptographic hash function? Removed the "unique" statement as it was misleading and not relevant to the problem.
Jan 14	comment	Is the One Time Pad (OTP) considered a cryptographic hash function? It's a reasonable question. The answer just happens to be 'no'. :-)
Jan 14	answered	Is the One Time Pad (OTP) considered a cryptographic hash function?
Jan 8	revised	Where can I learn basic cryptography to know more about passwords and Bitcoin? added MathJaX, corrected spelling
Jan 8	answered	Where can I learn basic cryptography to know more about passwords and Bitcoin?
Dec 14	comment	Is there an advantage to storing keys split between several hashes? It can't be dynamic, because you need to refer to it both at the time of encryption as well as decryption. Like I mentioned, a static value of "ABC123" provides a crib to an attacker: try a brute force approach and if any decrypts to the known value, you lose. I don't know of any asymmetric approach you could take here that wouldn't be easily bypassed. I think you'll just have to take the risk of the known plaintext attack. It's much safer than storing a hash of the key.
Nov 28	revised	Is there an advantage to storing keys split between several hashes? clarified
Nov 28	answered	Is there an advantage to storing keys split between several hashes?
Nov 21	comment	Is this how padding can work? Your code is unfortunately not complete. You need to validate the padding bytes are correct and within a valid range for your blocksize. PKCS#7 works fairly well as an integrity test for decryption - if the padding characters are ill-formed, either the message itself was corrupted, or a wrong key was used to decrypt. It has to be handled properly, of course, or this could open up some kind of padding oracle attack similar to those seen in CRIME/BEAST.
Nov 21	comment	Is storing the hash of a key together with ciphertext encrypted with that key secure? @D.W., I would propose that they only need a key ID, and that the key ID is not generated in any way based on information in the key. (It could be random, sequential, or even a name.) Having a UUID to identify the combination of key & ciphertext does not help identify which key to use to decrypt. Having a Key ID tells the decrypting party exactly which key to select (think index in a database). This is similar to the function of a Subject Key ID OID on an X.509 certificate. The difference is that a SKID can safely be a hash of the public key without compromising security.
Nov 8	answered	Randomized algorithms and the one time pad
Nov 8	comment	Randomized algorithms and the one time pad What you described is not a one-time pad. It's stream encryption using the key generation algorithm as the stream generator, and uses XOR to combine the key material with the plaintext.
Nov 5	revised	Why does HOTP use such a complex truncate function? added 9 characters in body
Nov 5	revised	Why does HOTP use such a complex truncate function? deleted 1 characters in body
Nov 5	comment	Why does HOTP use such a complex truncate function? You're right, I forgot the birthday paradox for computing collision resistance of a hash function. I edited the answer.
Nov 5	comment	Is tokenization really alternative to encryption? @PaŭloEbermann, this is actually a good question, as tokenization relates directly to cryptographic protocols, especially in the context of credit card security (which most of these articles are discussing.) Can you reopen it so we can go over those points?