72 reputation
5
bio website
location London, United Kingdom
age 37
visits member for 1 year, 3 months
seen Mar 20 at 11:34

Sysadmin and sometimes BOFH :)


May
3
comment Secure encrypt-then-sign with RSA
Interesting papers that I hadn't come across before, thanks
Apr
28
revised Secure encrypt-then-sign with RSA
Added possible solution involving certificates
Apr
28
comment Secure encrypt-then-sign with RSA
@RickyDemer well, yes, but then there is the problem of anyone being able to replace the signature :/
Apr
28
comment Secure encrypt-then-sign with RSA
@RickyDemer anyone with the author's public key should be able to verify that the signature was added by the author
Apr
27
comment Secure encrypt-then-sign with RSA
@RickyDemer sorry, I mis-read your comment - BTW, what is going on with the formatting of your last comment?
Apr
27
comment Secure encrypt-then-sign with RSA
@RickyDemer I mention that in my question as a possible solution to the problem of someone replacing the signature
Apr
27
asked Secure encrypt-then-sign with RSA
Apr
27
comment Tamper-proofing log files
OK, that is more pratical :) Although I believe such devices are very expensive
Apr
27
comment Tamper-proofing log files
Yes, very practical, thanks...
Apr
26
comment Tamper-proofing log files
@JohnDeters while I agree in principle, both of the solutions I proposed involved cryptography
Apr
26
comment Tamper-proofing log files
I like the ralative simplicity of this. I guess using an external, secure timestamping service would alleviate the problem of bad guys changing the system clock
Apr
26
accepted Tamper-proofing log files
Apr
25
comment Tamper-proofing log files
An interesting paper that does seem to provide a solution. While I get the basic principles behind it, it's going to take a bit of time before I fully understand it though :)
Apr
25
comment Combining AEAD with RSA
@PaĆ­loEbermann while adding a signature would present a solution, I guess it also means there is no point in using AEAD over 'normal' encryption, since it is the signature that is providing the integrity and authenticity properties?
Apr
25
comment Combining AEAD with RSA
So my understanding is that it is pointless to combine AEAD with RSA, because anyone with your public key can create data that will be verified as 'authentic'. Using a digital signature would prevent that, but then it is the signature providing the authenticity propery, not AE - so you gain nothing from combining the two.
Apr
25
accepted Combining AEAD with RSA
Apr
24
comment Combining AEAD with RSA
@RickyDemer Ah, I see the problem now... doesn't the same problem exist for 'normal' hybrid cryposystems too? Is there a better way to do this?
Apr
24
comment Combining AEAD with RSA
@PaĆ­loEbermann Are you sure that's correct, as I don't see how that would work? The symmetric key used by AES would be randomly generated. It is only stored with the encrypted data after being RSA-encrypted.
Apr
24
comment Combining AEAD with RSA
I need to make the IV available somehow, whether it is prefixed to the data or stored in the associated data - is there any reason not to store it in the associated data?
Apr
24
revised Combining AEAD with RSA
Typo