Rook

418 reputation

bio	website	sitewat.ch
	location	Teresina, Brazil
	age
visits	member for	1 year, 9 months
	seen	May 2 at 0:25
stats	profile views	18

Do not trust any security related answers you see on SO. Not from me, not from anyone. There are very smart people on SO and there are excellent answers given, although the right answer is almost never chosen. Test everything, trust no one.

I have been writing exploit code for more than 5 years. I have found numerous vulnerabilities. I have received three severity metrics from the Department of Homeland Security. The most severe is in the top 500 more dangerous software flaws of all time.

My CVE numbers:

CVE-2011-0050 CVE-2011-0049 CVE-2011-0048 CVE-2009-1759 CVE-2009-0468 CVE-2009-0467 CVE-2009-0389 CVE-2008-6975 CVE-2008-6499 CVE-2008-6498 CVE-2008-5621 CVE-2008-2043 CVE-2008-2002 CVE-2007-6485 CVE-2007-6458 CVE-2007-6459 CVE-2007-6471 CVE-2007-5646 CVE-2007-0134 CVE-2007-0132 CVE-2007-0130 CVE-2006-6781 CVE-2006-6780 CVE-2006-3208 CVE-2006-3207 CVE-2006-3206 CVE-2006-3205 CVE-2006-3204 CVE-2006-3203

	418 reputation	bio	website	sitewat.ch	visits	member for	1 year, 9 months
19 badges		location	Teresina, Brazil		seen	May 2 at 0:25

summary answers questions tags badges favorites bounties reputation activity

28 Comments

suggestions reviews revisions comments badges posts accepts all

Feb 7	comment	Is there a problem with constructing a CSPRNG using MD5 or SHA1? +1 Great paper. The CTR_DRBG CSPRNG design looks great. Do you know of a paper that talks about keystream generators for DRBG?
Feb 4	comment	Is there a problem with constructing a CSPRNG using MD5 or SHA1? @CodesInChaos In this case, using a CRC-like function for mixing, and md5 or sha1 for the output stream.
Dec 21	comment	Efficient Symmetric Mutual Entity Authentication Protocol @Martin Lundberg if you have a "server" then you can have a "time server". I think that not having time in your current protocol is a mistake.
Dec 21	comment	Efficient Symmetric Mutual Entity Authentication Protocol @Martin Lundberg Kerberos is probably more efficient than your protocol because its doesn't use RSA. I would avoid asymmetric cryptography as much as possible. Not having an accurate clock has other problems. How do you void keys at noon when their time is up? This is why kerberos tokens have a timestamp!
Dec 20	comment	What is an easy method of proving that a cryptographic oracle attack is possible? we are the cryptographers. I think that Nathan Cooper's approach is better. Try manipulating the cipher text and look at the response. See if you can get the server to respond with a Noise Block for CBC-R or simply proving malleability by attacking the padding.
Dec 20	comment	What is an easy method of proving that a cryptographic oracle attack is possible? As a penetration tester my job is to prove that software is insecure.
Dec 18	comment	What is an easy method of proving that a cryptographic oracle attack is possible? I want the best method that that can be applied in a scientific way. If this is the best, then so be it.
Dec 6	comment	Securing a lookup table What do you mean "secure" what attack are you trying to prevent?
Dec 5	comment	Ensuring integrity of a client side script @Barry Steyn Well people try, look at the xbox... and look at all of the pirated games for the xbox.
Dec 4	comment	AES encrypting multiple files +1 i love that scrypt paper.
Dec 3	comment	What is an easy method of proving that a cryptographic oracle attack is possible? @Paŭlo Ebermann♦ good question. The attacker, no more no less.
Oct 26	comment	Does chaining random number generators lead to loss of randomness? @Inemesit Affia that is a question for crypto.se
Aug 31	comment	How is block cipher padding verified for consistancy? +1 Great answer, but I still have some questions. There appears to be some sanity checks for null byte padding, does this also lead to a padding oracle attack?
Aug 27	comment	Malleability attacks against encryption without authentication +1 creative attack
Aug 26	comment	Malleability attacks against encryption without authentication Are you suggesting that if I replace ciphertext block N-1 with A⊕B⊕(ciphertext block N-1) I will have the message B for the plain text block N?
Aug 26	comment	Malleability attacks against encryption without authentication +1 good stuff. PKCS7 would severally undermine this attack.
Aug 26	comment	Malleability attacks against encryption without authentication How is padding checked for consistency? Do you know of a good paper that explains this?
Aug 13	comment	MD5 pre-fixing with an unkown postfix Is this a product of the prefixing attack, or is this due to the fact that this isn't an RFC'ed hmac?
Aug 13	comment	MD5 pre-fixing with an unkown postfix @fgrieu yes, you are correct.
Apr 6	comment	Efficient and stateless anti-forgery method @Ilmari Karonen Its applied cryptography, but I don't think they will help. I am asking for a new crypto design.