123 reputation
4
bio website
location
age
visits member for 1 year
seen 2 hours ago

Aug
10
awarded  Commentator
Aug
10
comment What are the security effects of reusing a public RSA key to encrypt large data by blocks?
Here's a partially related question (regarding reusing IV) that goes into some details about the danger of re-using IVs (which would apply to re-using Keys if you aren't using a random IV): crypto.stackexchange.com/questions/2576/…
Aug
10
comment What are the security effects of reusing a public RSA key to encrypt large data by blocks?
That's generally how SSL works: a public/private key pair for transmission of the symmetric key, and the data itself is encrypted using a symmetric algorithm (and MAC thrown in for good measure). As I understand it (meaning I'm probably incorrect), the principle concern for encrypting data with the same key is the danger of guessing at plaintext... I'm not sure how much of a concern that is with sufficiently strong keys or sufficiently variable data, though.
Aug
7
comment Convert old and busted password encryption to something sensible
I've stubbed out and started running tests based on your approach and it's working marvellously. Accepted your answer. Thanks!
Aug
7
accepted Convert old and busted password encryption to something sensible
Aug
4
comment Convert old and busted password encryption to something sensible
Thanks, @PaŭloEbermann. That should have occurred to me. =]
Aug
4
comment Convert old and busted password encryption to something sensible
So the id portion (id est "\$id\$salt\$hashed, the printable form of a password hash as produced by crypt (C), where "\$id" is the algorithm used (On GNU/Linux, "\$1\$" stands for MD5, "\$2a\$" is Blowfish, "\$5\$" is SHA-256 and "\$6\$" is SHA-512, crypt(3) manpage, other Unix may have different values, like NetBSD)." is essentially up to the application? There's no real standard?
Aug
4
comment Convert old and busted password encryption to something sensible
This looks like a great answer. I'm going to spend some time today reading through the links you've provided.
Aug
3
comment Convert old and busted password encryption to something sensible
Most Significant Byte—I'm such an idiot.
Aug
3
awarded  Supporter
Aug
3
comment Convert old and busted password encryption to something sensible
I accepted Touset's answer due to proposed upcoming changed to the DB structure that coincidentally align perfectly with his approach. I'm still curious about MSB(), though... Noted it mentioned all over cryptography articles in Wikipedia, but can't figure out what it is.
Aug
3
awarded  Scholar
Aug
3
awarded  Student
Aug
3
comment Convert old and busted password encryption to something sensible
Also, Oracle is the engine. It should be up to the challenge, but I wouldn't be totally surprised if it weren't.
Aug
3
comment Convert old and busted password encryption to something sensible
I should have mentioned that I'm crypto (and math) challenged, and consequently don't understand $MSB_{64}()$. Can you provide a quick explanation or link? I prefer your method because it shows I can differentiate the scheme by inspecting the value, but I'll need to understand it in order to design it.
Aug
3
asked Convert old and busted password encryption to something sensible