436 reputation
210
bio website Delphi.org
location Boise, ID
age 41
visits member for 3 years, 4 months
seen Jan 30 '13 at 17:20

Lead World Wide Developer Evangelist for Embarcadero Technologies

Invented and patented swipe to unlock in 2000. See US Patent # 8352745 & 6766456, and others.

Host of the Podcast at Delphi.org. (mostly a blog, but some podcast episodes).

Preferred Languages:

  1. Delphi / Object Pascal
  2. C# / .NET
  3. JavaScript
  4. Java
  5. C++
  6. Objective-C

Sep
24
comment Which is more secure using a CSPRNG for a One-time pad, or AES?
@Thomas No, I just wanted to clarify my question based on the answers.
Sep
3
comment How to encrypt data and know it will be secure for at least a few decades?
@poncho Ah, good advice. This is what happens when I get creative. I forget the fundamentals.
Sep
3
comment How to encrypt data and know it will be secure for at least a few decades?
Thanks Simon. Good advice. Was not familiar with GCM but will do some research and see if I can find an implementation. Was going to use CBC.
Sep
2
comment How to encrypt data and know it will be secure for at least a few decades?
@poncho The key and ciphertext are held by two different parties until the time comes for decryption. The objective for the encryption is to be sure neither party can decrypt the message without the other.
Sep
2
comment How to encrypt data and know it will be secure for at least a few decades?
@CodesInChaos The keys will be stored on a sperate system. Obviously if the key is compromised then the system fails. That is true if I just use AES one time. Does nesting different algorithms help against cryptanalysis and brute force?
Sep
2
comment How to encrypt data and know it will be secure for at least a few decades?
Hadn't considered hashing together CSPRNGs.
Sep
2
comment How to encrypt data and know it will be secure for at least a few decades?
Like I said, I'm fine with overkill. Does combining Serpent and Rijndael like I'm describing improve the strength?
Sep
2
comment How to encrypt data and know it will be secure for at least a few decades?
@PaĆ­loEbermann Prefer resistance to cryptanalysis as well as brute force. Updated question.
Sep
2
comment How to encrypt data and know it will be secure for at least a few decades?
@CodesInChaos Was going to use a system level CSPRNG. I would be using CBC with a random IV generated with each key. There would be a single hash stored for the original message, not for each level of nesting.
Jan
11
comment Does the position of the salt improve its effectiveness when hashing?
Hmm . . . . So follow the spec, and if you don't have a spec . . ..
Jan
11
comment Does the position of the salt improve its effectiveness when hashing?
So you are saying position may matter. Which is better then, Prefix or Suffix?
Jan
10
comment Feedback on rolling my own entropy gatherer
So you are saying collect the whole message (including parts that are always the same), don't bother stirring it, and then use a SHA-256 hash to retrieve a value to use as a seed? How often should the pool be flushed or new entropy be gathered?
Jan
10
comment Would it be secure to use random numbers from random.org in a cryptographic solution?
@mikeazo: So as long as Random.org is not the attacker it would work.
Jan
10
comment Would it be secure to use random numbers from random.org in a cryptographic solution?
So there is no use for them in cryptography?
Jan
10
comment two public keys with same passphrase insecure? | can two hashes be compared?
@mikeazo: At best the attacker gets a two for one, but since the user withdraws the first key it gets the attacker no where. If both keys use a secure hash algorithm then they are both as secure for reversing to the passphrase.
Oct
24
comment How to require two keyholders to decrypt a document?
They are "trusted" but it is a matter of timing and liability. If they cannot decrypt it until a specific time, then they are not liable for it.
Oct
24
comment How to require two keyholders to decrypt a document?
Who knew XOR would be the "best practice" answer to a question on Cryptography.
Jul
13
comment Salting when encrypting?
I asked him if he was referring to the initialization vector, and that is what it sounds like from that explanation. Thanks!
Jul
12
comment Salting when encrypting?
I thought I misunderstood too, which is why I asked for clarification.