Thomas Pornin
Reputation
35,932
118/100 score
 Feb18 answered How can I calculate the SHA-256 “midstate”? Feb10 answered Is Common Name encoded in the certificate? Feb7 comment How are timestamps verified? There are several ways to timestamp a PDF file. You can handle it as an opaque blob, and produce an external time stamp (or evidence record). You can also embed the time stamp in the file, because the PDF format includes some provisions for it; such a time stamp can be verified from within Adobe Reader itself. Universign supports both; see: universign.eu/en/web-services Feb6 comment What are the practical differences between 256-bit, 192-bit, and 128-bit AES encryption? @DanNeely: a block cipher with 256-bit keys is supposed to offer resistance up to work factor $2^{256}$; there should not exist any (theoretical) attack which would be less expensive. An attack with cost $2^{200}$ is considered to be a "break" for a block cipher with a 256-bit key; but not for a block cipher with a 128-bit key, for which we "only" require resistance up to $2^{128}$ operations. The extra rounds help in obtaining that level of resistance. Feb6 answered How are timestamps verified? Feb6 answered How to account for moore's law in estimating time-to-crack? Feb2 reviewed Approve commitments tag wiki excerpt Feb2 comment Is RSA of a random nonce with no padding safe? @Gilles: if padding is deterministic, and you encrypt the same $K$ (padded to $\pi(K)$) for three different recipients, with $e = 3$, then you send the value $\pi(K)^3$ modulo $n_1$, $n_2$ and $n_3$. By the Chinese Remainder Theorem, this is sufficient to rebuild $\pi(K)$ modulo $n_1n_2n_3$, and since $\pi(K) \lt n_i$, the modulo disappears. This is the historical justification for using $e = 65537$ instead of $e = 3$, but the real issue is that a deterministic padding for RSA encryption is definitely unsafe. You MUST have a random padding. Feb2 awarded encryption Feb1 answered Is RSA of a random nonce with no padding safe? Feb1 answered How can I convert a DER ECDSA signature to ASN.1? Feb1 awarded Good Question Feb1 awarded Nice Answer Jan30 comment Salts, how does the script know what the salt is? Actually, for most password-related salt usages, what we need is just that salt values are distinct from each other. Unbiased selection in a big enough space is sufficient to achieve uniqueness. Dates are not bad as themselves -- as long as you never choose two salts during the same second, and you take care never to repeat dates, even when the system administrator resets the clock. Jan27 comment What is the best way to send two floating point numbers to a server on the internet from a small device such as an arduino? @DavyLandman: what I described is a single block encryption, which does not use any encryption mode -- it provides the desired properties only because it is a single block encryption, and has the specific format and rules that I mandate. CBC encryption handles longer messages but does not provide a MAC by itself; and CBC requires an IV which MUST be selected randomly and uniformly, and a new IV MUST be generated for each message. CBC is needy. I suggest you investigate EAX, which includes a MAC and has lighter IV needs (a counter suffices). Jan27 awarded Nice Answer Jan26 comment What is the best way to send two floating point numbers to a server on the internet from a small device such as an arduino? @DavyLandman: without some kind of memory, there is no way for the device to send messages which will resist malicious reordering by Eve -- unless you go with a two-directional protocol, in which the server interactively exchanges messages with the device: at that point, things become really complex, both to implement and to analyze. Jan26 revised What is the best way to send two floating point numbers to a server on the internet from a small device such as an arduino? edited body Jan26 answered What is the best way to send two floating point numbers to a server on the internet from a small device such as an arduino? Jan25 reviewed Approve Stretching a random seed to maximize entropy