Reputation
312
Top tag
Next privilege 350 Rep.
Access review queues
Badges
3 17
Newest
 Caucus
Impact
~5k people reached

13h
accepted Creating a small number from a random octet string
14h
accepted Can non-assembly crypto libraries truly be secure against timing attacks?
1d
asked Can non-assembly crypto libraries truly be secure against timing attacks?
Jul
25
asked unable to create cms signed message
Jul
16
comment Unpredictability of X.509 serial numbers
If random serial numbers are used then what would be a good length for the serial numbers? Normally integers are 32-bits but in the case of X.509 / ASN.1 the sky is the limit. Heck - you have the integer type used for RSA keys with 2048-bit "integers".
Jun
23
awarded  Caucus
Jun
23
awarded  Constituent
Jan
6
comment what is it called when encrypt('a') + encrypt('a') == encrypt('aa')?
@Steve Sether - good point. Although technically in PHP string concatenation is done with the dot operator (.). I did + because it seems that that's more common for string concatenation than .. Java, Javascript and C++ all use + for string concatenation. But I think in this forum || would have made the most sense.
Jan
2
comment what is it called when encrypt('a') + encrypt('a') == encrypt('aa')?
@Nova - fair enough!
Jan
2
comment emulating progressive encryption with RC4 / OpenSSL
I'm trying to interface with a third party API that uses RC4? I'm trying to refactor some code that decrypts RC4 encrypted data from a DB with two billion records? Does it really matter? That RC4 isn't recommended doesn't change the fact that legacy applications sometimes still use it.
Jan
2
comment what is it called when encrypt('a') + encrypt('a') == encrypt('aa')?
@Nova - +, in this case, is representing the concatenation operation - not addition. Why would you assume it means addition when, as you said, that doesn't make any sense? That's like me saying "can I do this?" and then someone else saying that that sentence doesn't make sense because can is a noun. "a usually metal typically cylindrical receptacle usually with an open top". I mean, if you have two different definitions why would you assume it's the one that doesn't make sense?
Jan
2
accepted what is it called when encrypt('a') + encrypt('a') == encrypt('aa')?
Jan
2
comment what is it called when encrypt('a') + encrypt('a') == encrypt('aa')?
sandbox.onlinephpfunctions.com/code/… When I execute that code v1 and v2 are the same (ie. encrypt('a') + encrypt('a') == encrypt('aa')) but v3 isn't. I am not asking why. I know why. yyyyyyy's post elaborates as to the why. I am wanting to know if there is a name for this behavior. And as for using two different cipher suites... idk what you're talking about. They're both des-cbc. Take a second look at the first code snippet and you'll see mcrypt_module_open(MCRYPT_DES, '', MCRYPT_MODE_CBC, ''). MCRYPT_MODE_CBC means cbc - not ecb etc
Jan
2
comment what is it called when encrypt('a') + encrypt('a') == encrypt('aa')?
yyyyyyy seemed to understand the question just fine. You asked three questions so I'll answer them in order. For #2... no. I know how to do that. See the first of the two code samples I posted. For #3... see the second code snippet I posted. The output, in that example, does not change, even tho I'm encrypting the same thing twice. As I said in my OP this makes since given the API. I was just wanting to know how best to refer to the difference between the two code samples. Both code samples do CBC mode but only one of them gives different outputs for each "block".
Jan
2
comment emulating progressive encryption with RC4 / OpenSSL
See crypto.stackexchange.com/q/21143/4520
Jan
2
asked what is it called when encrypt('a') + encrypt('a') == encrypt('aa')?
Jan
2
comment emulating progressive encryption with RC4 / OpenSSL
SSH uses it. I don't really know of any other term to describe it. The basic idea is... if you do encrypt('a') + encrypt('a') you get the same thing as encrypt('aa'). ie. if you're using CBC mode the IV doesn't get reset after you perform a round of encryption. Or if you're using a stream cipher the keystream doesn't get reset to what it was when it was created - it persists across multiple encrypt() calls.
Dec
31
comment What is the SSL private key file format?
@fgrieu - yah - 30h in binary is 0011 0000 which is universal class, constructed encoding, SEQUENCE (SEQUENCE, per luca.ntop.org/Teaching/Appunti/asn1.html, is 10h or 0001 0000; pretty much all SEQUENCEs are constructed). 02h being int is a little more straight forward.
Dec
31
comment What is the SSL private key file format?
So if all you have is p and q and you used a standard value for e (ie. 65537), you'd still need to calculate d and n. Typically private keys also include the CRT coefficieints as well. So once you have all that you could do something like pastebin.com/NW1CmYyc with phpseclib.
Dec
31
awarded  Commentator