Reputation
538
Top tag
Next privilege 750 Rep.
See votes, expandable usercard
Badges
4 16
Impact
~25k people reached

  • 0 posts edited
  • 1 helpful flag
  • 54 votes cast
Dec
21
comment Efficient Symmetric Mutual Entity Authentication Protocol
@Martin Lundberg Kerberos is probably more efficient than your protocol because its doesn't use RSA. I would avoid asymmetric cryptography as much as possible. Not having an accurate clock has other problems. How do you void keys at noon when their time is up? This is why kerberos tokens have a timestamp!
Dec
21
answered Efficient Symmetric Mutual Entity Authentication Protocol
Dec
20
comment What is an easy method of proving that a cryptographic oracle attack is possible?
we are the cryptographers. I think that Nathan Cooper's approach is better. Try manipulating the cipher text and look at the response. See if you can get the server to respond with a Noise Block for CBC-R or simply proving malleability by attacking the padding.
Dec
20
comment What is an easy method of proving that a cryptographic oracle attack is possible?
As a penetration tester my job is to prove that software is insecure.
Dec
18
comment What is an easy method of proving that a cryptographic oracle attack is possible?
I want the best method that that can be applied in a scientific way. If this is the best, then so be it.
Dec
5
comment Ensuring integrity of a client side script
@Barry Steyn Well people try, look at the xbox... and look at all of the pirated games for the xbox.
Dec
4
comment AES encrypting multiple files
+1 i love that scrypt paper.
Dec
3
revised What is an easy method of proving that a cryptographic oracle attack is possible?
added 15 characters in body
Dec
3
comment What is an easy method of proving that a cryptographic oracle attack is possible?
@Paŭlo Ebermann♦ good question. The attacker, no more no less.
Dec
3
answered AES Secure key generation and storage
Dec
3
asked What is an easy method of proving that a cryptographic oracle attack is possible?
Dec
3
revised Ensuring integrity of a client side script
added 98 characters in body
Dec
3
answered Ensuring integrity of a client side script
Oct
26
comment Does chaining random number generators lead to loss of randomness?
@Inemesit Affia that is a question for crypto.se
Oct
26
answered Does chaining random number generators lead to loss of randomness?
Sep
5
accepted How is block cipher padding verified for consistancy?
Aug
31
comment How is block cipher padding verified for consistancy?
+1 Great answer, but I still have some questions. There appears to be some sanity checks for null byte padding, does this also lead to a padding oracle attack?
Aug
31
accepted Malleability attacks against encryption without authentication
Aug
27
comment Malleability attacks against encryption without authentication
+1 creative attack
Aug
26
comment Malleability attacks against encryption without authentication
Are you suggesting that if I replace ciphertext block N-1 with A⊕B⊕(ciphertext block N-1) I will have the message B for the plain text block N?