449 reputation
59
bio website entropik.net
location Istanbul, Turkey
age
visits member for 2 years, 9 months
seen Feb 14 at 15:09

Solaris, FreeBSD, GNU/Linux and Windows Server system admin. PostgreSQL DBD. PostgreSQL, Oracle and MSSQL DBA. Python, Silverlight and WPF C# developer.


Jul
13
comment Should DES be avoided when developing new systems?
Thanks for correction. Should get back reading.
Jul
13
revised Taking advantage of one-time pad key reuse?
added 69 characters in body
Jul
13
comment Should DES be avoided when developing new systems?
Correct me if I'm wrong, but I thought 3DES wasn't a "kind of" DES, but it was a separate algorithm called TDEA which implemented DES in itself. Which, if true, renders DES "easily broken", but not TDEA of course.
Jul
13
suggested suggested edit on What are the details of the DES weakness of reusing the same IV in CBC mode with the same key?
Jul
13
revised Taking advantage of one-time pad key reuse?
added 375 characters in body
Jul
13
answered Taking advantage of one-time pad key reuse?
Jul
13
revised Should DES be avoided when developing new systems?
fixed grammar
Jul
13
suggested suggested edit on Should DES be avoided when developing new systems?
Jul
12
revised How do I apply differential cryptanalysis to a block cipher?
edited tags
Jul
12
revised How do I apply differential cryptanalysis to a block cipher?
added 4 characters in body
Jul
12
answered How do I apply differential cryptanalysis to a block cipher?
Jul
12
awarded  Organizer
Jul
12
revised What are the main weaknesses, if any, of a Playfair cipher?
edited tags
Jul
12
awarded  Editor
Jul
12
revised What are the main weaknesses, if any, of a Playfair cipher?
edited body
Jul
12
awarded  Critic
Jul
12
comment Necessity of Randomness of Salts?
My point is, if the attacker has user ID's, and the cyphertexts, salt value makes it harder for the attacker to use differential cryptanalysis. In this case, using a global salt is (at least in theory) not any safer than using any salt at all, since the attacker will have access to a lot of user data to work with. Combining a global salt with user ID will make it impossible to see if two passwords are same just by looking at the cyphertext with plain eye, but it won't help against cryptanalysis at all.
Jul
12
awarded  Teacher
Jul
12
awarded  Supporter
Jul
12
comment Necessity of Randomness of Salts?
PaĆ­lo, if there's a global salt, then any two users using the same password will eventually have the very same cyphertext in the database. And even if you combine that salt with user ID's, an attacker will have quite a higher chance of retreiving the key with combining all the passwords with all the user ID's. Using a global salt value means XOR'ing the passwords with the very same salt value, and given the attacker has knowledge about the user ID's too (which themselves each act as a second, transparent salt here), it kind of goes pointless to use such a value at all.