459 reputation
510
bio website entropik.net
location Istanbul, Turkey
age
visits member for 3 years, 3 months
seen Oct 8 at 8:10

Solaris, FreeBSD, GNU/Linux and Windows Server system admin. PostgreSQL DBD. PostgreSQL, Oracle and MSSQL DBA. Python, Silverlight and WPF C# developer.


Feb
17
comment Can one implement AES on 4-bit microcontroller?
That's a good reading there... With a practical approach..
Jul
13
comment Should DES be avoided when developing new systems?
Thanks for correction. Should get back reading.
Jul
13
comment Should DES be avoided when developing new systems?
Correct me if I'm wrong, but I thought 3DES wasn't a "kind of" DES, but it was a separate algorithm called TDEA which implemented DES in itself. Which, if true, renders DES "easily broken", but not TDEA of course.
Jul
12
comment Necessity of Randomness of Salts?
My point is, if the attacker has user ID's, and the cyphertexts, salt value makes it harder for the attacker to use differential cryptanalysis. In this case, using a global salt is (at least in theory) not any safer than using any salt at all, since the attacker will have access to a lot of user data to work with. Combining a global salt with user ID will make it impossible to see if two passwords are same just by looking at the cyphertext with plain eye, but it won't help against cryptanalysis at all.
Jul
12
comment Necessity of Randomness of Salts?
PaĆ­lo, if there's a global salt, then any two users using the same password will eventually have the very same cyphertext in the database. And even if you combine that salt with user ID's, an attacker will have quite a higher chance of retreiving the key with combining all the passwords with all the user ID's. Using a global salt value means XOR'ing the passwords with the very same salt value, and given the attacker has knowledge about the user ID's too (which themselves each act as a second, transparent salt here), it kind of goes pointless to use such a value at all.