Reputation
311
Next privilege 500 Rep.
Access review queues
Badges
1 8
Impact
~3k people reached

  • 0 posts edited
  • 0 helpful flags
  • 12 votes cast
Feb
9
awarded  Popular Question
Jan
4
accepted Does rsa-oaep provide or not plaintext integrity in addition to confidentiality?
Jan
3
comment Does rsa-oaep provide or not plaintext integrity in addition to confidentiality?
@Ricky Demer : thks I understand your answer, as anyone can encrypt anything using public key, there is no valid reference to insure plaintext integrity following decryption- I have been a little bit confused by following EMC/RSA [document ](lists.w3.org/Archives/Public/public-xmlsec/2009May/att-0032/…) which claims integrity with rsa-oaep in page 5. May integrity have another meaning in that case ?
Jan
3
awarded  Yearling
Jan
2
asked Does rsa-oaep provide or not plaintext integrity in addition to confidentiality?
Aug
30
accepted TLS Handshake : Server authentication or only Server ‘s Certificate authentication?
Aug
30
comment TLS Handshake : Server authentication or only Server ‘s Certificate authentication?
sejpm - Thanks it is more clear now for TLS handshake when considering in reality a combined authentication & key exchange operation which is closed by FINISHED message, rather than (as seen is some articles) considering a standalone authentication step followed by standalone key exchange step which confused me in case of RSA key exchange.
Aug
29
revised TLS Handshake : Server authentication or only Server ‘s Certificate authentication?
deleted 7 characters in body
Aug
29
revised TLS Handshake : Server authentication or only Server ‘s Certificate authentication?
added 35 characters in body
Aug
29
comment TLS Handshake : Server authentication or only Server ‘s Certificate authentication?
sejpm - thanks for precision - yes you're fully right with using DHE . ECDHE as Client receives messages signed by Server's private key. So effectively my post & question concerned specifically case of RSA key exchange.
Aug
29
asked TLS Handshake : Server authentication or only Server ‘s Certificate authentication?
Apr
14
comment Rationale of “r” AES key use in OTR version 3 AKE protocol?
To SOJPM - Clear; I didn't see or note such kind of DH protection on previous protocols (as TLS or IKE) but it makes full sense.
Apr
14
accepted Rationale of “r” AES key use in OTR version 3 AKE protocol?
Apr
13
asked Rationale of “r” AES key use in OTR version 3 AKE protocol?
Dec
6
accepted Will X9.31 remain a secure & acceptable deterministic random generator beyond 2015?
Dec
5
comment Will X9.31 remain a secure & acceptable deterministic random generator beyond 2015?
Ok clear. I will check more in detail Botan documentation and internal prng operation. I just add for info that in my application criticity of key generator makes that it might be implemented on a standalone Linux computer. So no more network access but inversely low activity and so low entropy available within the kernel through /dev/random device and to be compensated by a companion hardware entropy source as Intel drng for instance.
Dec
5
comment Will X9.31 remain a secure & acceptable deterministic random generator beyond 2015?
I understand your warning about lack of backtracking resistance. In the concrete case of Botan library I noted that the complete prng was : entropy source => Botan random pool => x9.31 prng => random output. So with x9.31 seed key and date/time vector issued from Botan proper random pool output. So in that case i understand the threat assumed both knowkedge of overall combined prng state plus botan proper random pool prng not based on a one way function. Is it correct ? I precise that prng is to be used for keys generation so prng state value disclosing is a major threat.
Dec
5
comment Will X9.31 remain a secure & acceptable deterministic random generator beyond 2015?
thanks for that great detailed , precise & pedagogic answer which provides rationale for confidence in NIST recommended extension of ANSSI X9.31 Appendix 2.4 PRNG with AES-256.
Dec
5
comment Will X9.31 remain a secure & acceptable deterministic random generator beyond 2015?
@fgrieu- Thanks for clarification. My post was not sufficiently precise : effectively I implicitely referred to the PRNG as defined in Appendix 2.4 of ANSI X9.31-1998 standard . And so my trouble is that NIST agreed it in FIPS-140-2 (Annex C dated from 2012) while recommending use of 3-keys triple DES or AES, while NIST SP800-131A doc dated from January 2011, indicates that X9-31 -1998 PRNG is disallowed from 2015. So it seems to me that finally as you indicate, use of such X9.31 -1998 Appendix 2.4 PRNG with using AES-256 might not be concerned and so disallowed by NIST SP800-131A doc.
Dec
3
asked Will X9.31 remain a secure & acceptable deterministic random generator beyond 2015?