241 reputation
17
bio website xeoncross.com
location
age
visits member for 2 years, 7 months
seen yesterday
Another PHP programmer responsible for things like the MicroMVC PHP framework.

You may notice that some of my questions run very deep into the heart of certain issues because I strive for the highest optimization that is possible in my apps.

Sep
3
comment Why the symmetric key layer in PGP?
+1 multi-recipient encryption is a big point with email.
Jul
9
comment Why is elliptic curve cryptography not widely used, compared to RSA?
I have a question. I heard that cipher texts encrypted with RSA can possible give hints about the public key used (identify who did or did not encrypt that message) while elliptic curves do not have this weakness. Is this true?
Jun
11
comment Can you identify the public key used to encrypt something?
A similar question about GPG
Jun
11
comment Can you identify the public key used to encrypt something?
Also, are there any other key-pair encryption schemes which don't reveal data like the modulus of the public key?
Jun
11
comment Can you identify the public key used to encrypt something?
This sounds like more of a problem when you are only using 2 keys. However, if I had several hundred possible public keys that the message could be encrypted too - it seems like RSA would probably only reveal it wasn't to ~50% correct? In some cases (the highest public keys, it could single them out or reveal it wasn't to ~99% of the others right?
Jun
5
comment When making public key fingerprints - is a sha1 hash still a good idea?
I'm more interested in collisions, not password security from hashing. Besides, I would use bcrypt for passwords to increase the time needed to hash them.
Mar
28
comment It is reasonably safe to leave a SSH private key with a 30+ character passphrase public?
Actually, multiple parties can have a whole copy of the key. There is no sharding/splitting of the key and the only thing remembered is by the original human is the passphrase - the private key is stored somewhere out in the public.
Mar
28
comment It is reasonably safe to leave a SSH private key with a 30+ character passphrase public?
They don't, the physical user of the owning entity must remember it. (If they could remember the RSA key the problem would be solved right there).
Mar
28
comment It is reasonably safe to leave a SSH private key with a 30+ character passphrase public?
The RSA key will be returned to the owning party when it's needed which will then use it to do what it needs done. The problem is that the owning party can't store the key.
Mar
28
comment It is reasonably safe to leave a SSH private key with a 30+ character passphrase public?
The entity to which the private key belongs cannot store it themselves and must use a/multiple 3rd parties to store it.
Nov
7
comment Slow hash algorithm that does not require salt?
@StephenTouset, yes. Could be as small as 12 bytes.
Nov
7
comment Slow hash algorithm that does not require salt?
It's for creating slow hashes of objects, using the output, and then discarding it rather than storing it.
Nov
7
comment Slow hash algorithm that does not require salt?
+1 duh, just use a constant salt. I'm not sure why I didn't think of that.
Oct
3
comment When is each key used when encrypting an email using OpenPGP?
So if I only had a user's public key - I could encrypt a message just for them (but they won't know if it actually came from me). Likewise, if the person I was sending the message too didn't have a key-pair, all I could do would be sign the message assuming they can get a copy of my public key.
Oct
2
comment When is each key used when encrypting an email using OpenPGP?
So it's possible to only sign or only encrypt a message as well. The reason is I'm wondering what I can do with a sender which has keys and recipient who does not (and vice versa).