157 reputation
3
bio website phonefactor.com
location
age
visits member for 3 years
seen Oct 2 '11 at 23:54

CTO of PhoneFactor

@dispensa


Sep
25
awarded  Editor
Sep
25
revised Webapp password storage: Salting a hash vs multiple hashes?
deleted 8 characters in body
Sep
25
comment Webapp password storage: Salting a hash vs multiple hashes?
Sure, I wasn't intending to argue against salt, only to point out that it is not sufficient to simply salt a sha-1 and move on.
Sep
23
comment Webapp password storage: Salting a hash vs multiple hashes?
I'm not saying salt doesn't do what you claim. I'm saying it doesn't matter in light of how fast brute-force is.
Sep
23
answered Webapp password storage: Salting a hash vs multiple hashes?
Sep
3
comment Time Capsule cryptography?
The problem with all of these schemes is that someone has to do it. If you tune the work to match your guess at your primary adversary's compute power, and you guess that your adversary has many times your compute power, then you guarantee that nobody but your adversary or someone with more resources than he will be able to decrypt your secret. If you want two things -- 1) it becomes public after time T 2) it becomes public not long after T -- then this system doesn't get you there. You can't do it yourself, and your adversary might decide not to do it.
Sep
3
comment Time Capsule cryptography?
Interesting. The problem is, of course, that it doesn't guarantee that anyone will decrypt whatever the secret is, only that they could given a certain amount of time. If what you want is for your secret to become public, you might not want to risk nobody trying to break it. Doing it yourself is a non-answer for a couple of reasons.
Sep
1
awarded  Teacher
Sep
1
comment How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?
Applied Crypto is getting pretty long in the tooth. I'd be interested in seeing the community's consensus on the current strength of the NSA in this area. It's not objective, but community consensus is valuable in itself; perception is reality and all. :-)
Aug
25
awarded  Supporter
Aug
23
answered What is the post-quantum cryptography alternative to Diffie-Hellman?