SquareRootOfTwentyThree

less info
736 reputation
212
bio website
location Europe
age
visits member for 2 years, 10 months
seen 5 hours ago

Jul
14
suggested suggested edit on AES-SIV security
Jul
14
answered AES-SIV security
May
15
awarded  Organizer
May
15
revised PKCS#11: Which CKK_types are supported by CKM_PKCS5_PBKD2?
edited tags
May
15
answered PKCS#11: Which CKK_types are supported by CKM_PKCS5_PBKD2?
Feb
27
comment Why are RSA keys encoded with ASN.1 for TLS?
There are exploits that target buggy implementations of ASN.1, but not ASN.1 itself. In the same way, there are also exploits for XML implementations, but that does not mean that XML is bad. There could be also exploits for you custom hex encoding, no matter how simple.
Jan
9
answered Crypto USB Devices - where is the PIN/Password stored?
Nov
4
comment RSA and prime difference
I tried to clarify more.
Nov
4
revised RSA and prime difference
added 687 characters in body
Nov
3
comment RSA and prime difference
DSS does not cover DSA only anymore. It has been extended to include RSA and ECC. Indeed my question may be academic but I find it interesting. To say, what tells me that a 1026-bit $p$ and a 1022-bit $q$ are not actually more secure?
Nov
3
revised RSA and prime difference
added 64 characters in body
Nov
3
asked RSA and prime difference
Sep
28
awarded  Yearling
Sep
25
comment How practical are side-channel attacks and how much of a concern are they?
Uhm. You link two articles that advocate for more widespread measures against side channel attacks. However, both are authored by a company (now acquired) that sells such measures via patent licensing. Such company is (or was) definitely a serious and respectable one, but to me it does not look like a totally objective point of view.
Sep
12
revised How practical are side-channel attacks and how much of a concern are they?
added 42 characters in body
Sep
12
comment How practical are side-channel attacks and how much of a concern are they?
I agree the risk should be assessed (with the threat agent possibly being a market competitor) but that does not automatically imply that you will find a good motivation to address side-channel attacks. It's very hard to receive bad publicity out of a breach due to side channels attacks (which are today perceived as sophisticated attacks since they require some knowledge of statistics in most cases) unless the product is very widespread and there is a real brand to defend.
Sep
12
comment How practical are side-channel attacks and how much of a concern are they?
@fgrieu I have not used the word "econonomically" but only "rewards". Academic attacks, script kiddies, terrorists and so on don't go after money but they can still be modeled while doing risk analysis. Implementation of countermeasures is expensive, so I don't think they should be implemented "just in case".
Sep
12
answered How practical are side-channel attacks and how much of a concern are they?
Aug
24
answered Is it OK to use a data-encryption key for key wrapping, too?
Aug
16
comment What is the actual difference between security through obscurity and true encryption?
@stephen-harris Side channel attacks on cryptographic systems (which are nowadays a big threat, maybe more than cryptanalysis) are based on a priori knowledge of the cryptographic algorithm. If the algorithm is secret, SCAs become a lot harder (yet not impossible).