139 reputation
8
bio website none.seriously
location Switzerland
age 30
visits member for 2 years, 1 month
seen Aug 12 at 13:15

Physicist.


Dec
5
comment At the current time, is SHA256 the de facto standard for strong cryptographic hashes?
Question about the previous comment: “Weaknesses” in SHA-256d?
Sep
11
comment Should we sign-then-encrypt, or encrypt-then-sign?
The more general statement to make (e.g. from your short answer) is "don't sign anything that doesn't provide enough context"
Aug
14
comment What is the actual difference between security through obscurity and true encryption?
@mikeazo I was so hoping there was an xkcd for this :-D
Aug
14
comment What is the actual difference between security through obscurity and true encryption?
Very good point. A former employee decreased inbound traffic a lot by simply remapping the (needed) SSH ports... I guess you agree with my comment then :-7 Of course an obscured system will be considered a more interesting challenge to the potentially more harmful intruders. Well, that's what honeypots are for...
Aug
14
comment What is the actual difference between security through obscurity and true encryption?
Here's a nice quote from that linked SO question: If someone discovers the password, you can change the password, which is easy. If someone finds the location, you need to dig up the money and move it somewhere else, which is much more work. And if you use security by obscurity in a program, you would have to re-write the program... – Thomas Padron-McCarthy Feb 11 '09 at 15:27
Aug
14
comment What is the actual difference between security through obscurity and true encryption?
Ah, I forgot about equal probability. That's probably the most important difference, locations to hide a letter would probably be biased by physical reachability (or its inverse).
Aug
14
comment What is the actual difference between security through obscurity and true encryption?
@mikeazo thanks for these links, nice reading. I guess when crypto get out of beta that SO question should be migrated here...
Aug
14
comment What is the actual difference between security through obscurity and true encryption?
I think I get your point, but isn't hiding the letter the method and its location the key? And the keyspace can be quite huge if I have recently booked an around the world trip... But yes, this is not exactly encryption, since decryption requires the recipient to travel instead of simply entering a key...
Aug
14
comment What is the actual difference between security through obscurity and true encryption?
Re "Everything should be made public", shouldn't that rather read "Everything becoming public should not compromise the actual encryption"? With that I mean for example a primitive rot-13-ing of an RSA encrypted message should not be considered safer than RSA alone, but it would at least keep script kiddies with a brute force cracker out for a while since they would have to find and use their brains first. And reducing the amount of potential attackers is not so bad, as is in some scenarios increasing the shortest possible attack duration
Aug
14
comment What is the actual difference between security through obscurity and true encryption?
@Maeher sorry, I misread your comment. I'd actually accept it as an answer...
Aug
14
comment What is the actual difference between security through obscurity and true encryption?
@Maeher that's my very question, is encryption basically proven STO with the obscurity being the secret key?
Aug
14
comment Is a continuous stream of encrypted data embedded in garbage more or less secure than only encrypting the data?
@Thomas Thanks for the clarification. I think this is an important preposition to countering traffic analysis. One should also keep John's point in mind, that permanent communication may make it easier to determine who are communicating with, should that be worth keeping secret...
Aug
14
comment Is a continuous stream of encrypted data embedded in garbage more or less secure than only encrypting the data?
@Thomas Won't the worst-case attacker also know the garbage-generator and can then by reproducing it deduce from deviations that a transmission occurred? Of course if one assumes the garbage is coupled to a truly random generator, that is indeed not possible. So whether this is STO or not depends on the garbage generator's randomness, correct?
Aug
14
comment Is a continuous stream of encrypted data embedded in garbage more or less secure than only encrypting the data?
Thanks, the pizza example is great! Of course one could permanently use a public transmission (i.e. order pizza for every household...) - that way, everyone knows you communicate, but there is practically no way to determine who actually decrypts the data. Which may turn out to be a disadvantage of course, since a leak will then be just as difficult to backtrack...
Aug
14
comment Is a continuous stream of encrypted data embedded in garbage more or less secure than only encrypting the data?
Ok, I checked Wikipedia: A cryptosystem should be secure even if everything about the system, except the key, is public knowledge. [...] The enemy knows the system [...] is called Shannon's maxim. Do I understand it correctly that your point is, as long as the actual data encryption works, adding garbage is just security through obscurity? In that case I don't understand the downvotes, it sounds like a valid point to me.
Aug
13
comment Is a continuous stream of encrypted data embedded in garbage more or less secure than only encrypting the data?
Well, I spotted only the symptom while you removed the cause first and then wondered about the cough :-7 Anyway you're right that the garbage shouldn't be encoded, while the "correct" garbage might allow keeping actual data transmission times sufficiently secret
Aug
13
comment Time Capsule cryptography?
Finally a solution involving uncheatable physical time
Aug
13
comment K out of N encryption
+1 since I just wanted to ask the same question...
Aug
13
comment Is a continuous stream of encrypted data embedded in garbage more or less secure than only encrypting the data?
Thanks for your answer - re "How so?" I only thought of the implication of encrypting the garbage as well, leading to the KPA, instead of simply considering the smart way™ of just using random data of entropy comparable to the encrypted data... I.e. your reply to sending encrypted pseudo-random data already makes by KPA-statement superfluous.