{
"total": 690,
"page": 1,
"pagesize": 100,
"questions": [
{
"tags": [
"cryptography"
],
"answer_count": 0,
"favorite_count": 0,
"closed_date": 1369389233,
"closed_reason": "off topic",
"question_timeline_url": "/questions/36414/timeline",
"question_comments_url": "/questions/36414/comments",
"question_answers_url": "/questions/36414/answers",
"question_id": 36414,
"owner": {
"user_id": 26348,
"user_type": "registered",
"display_name": "JJR",
"reputation": 95,
"email_hash": "55bd09089602714f908c8c0c0e5f97ae"
},
"creation_date": 1369362029,
"last_activity_date": 1369362029,
"up_vote_count": 0,
"down_vote_count": 3,
"view_count": 60,
"score": -3,
"community_owned": false,
"title": "Recommended skills for a career in security",
"comments": [
{
"comment_id": 56874,
"creation_date": 1369364059,
"owner": {
"user_id": 18541,
"user_type": "registered",
"display_name": "D3C4FF",
"reputation": 3127,
"email_hash": "b376fbe6933daa281c17c4eb4720461f"
},
"post_id": 36414,
"post_type": "question",
"score": 6,
"body": "This question will probably be closed shortly. I'd suggest joining us in the DMZ chatroom and posing your question there :) chat.stackexchange.com Cheers"
},
{
"comment_id": 56879,
"creation_date": 1369371220,
"owner": {
"user_id": 13820,
"user_type": "registered",
"display_name": "Deer Hunter",
"reputation": 751,
"email_hash": "bf43cac729d5848deabbbacbf17e5e41"
},
"post_id": 36414,
"post_type": "question",
"score": 2,
"body": "Ahh, this NSA. Problem-solving is indeed a required skill."
}
]
},
{
"tags": [
"encryption",
"cryptography",
"aes",
"cipher"
],
"answer_count": 1,
"answers": [
{
"answer_id": 36410,
"accepted": true,
"answer_comments_url": "/answers/36410/comments",
"question_id": 36409,
"owner": {
"user_id": 16228,
"user_type": "registered",
"display_name": "Adnan",
"reputation": 6521,
"email_hash": "e5afea27d0dd34e10b58bbaa9c9aa749"
},
"creation_date": 1369347912,
"last_edit_date": 1369349162,
"last_activity_date": 1369349162,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 49,
"score": 3,
"community_owned": false,
"title": "AES in CTR mode with same random IV to create same ciphertext",
"comments": []
}
],
"accepted_answer_id": 36410,
"favorite_count": 0,
"question_timeline_url": "/questions/36409/timeline",
"question_comments_url": "/questions/36409/comments",
"question_answers_url": "/questions/36409/answers",
"question_id": 36409,
"owner": {
"user_id": 10346,
"user_type": "registered",
"display_name": "Richard",
"reputation": 113,
"email_hash": "cc10ab64534f01f38d19a4a594b5e744"
},
"creation_date": 1369346731,
"last_activity_date": 1369349162,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 49,
"score": 2,
"community_owned": false,
"title": "AES in CTR mode with same random IV to create same ciphertext",
"comments": [
{
"comment_id": 56855,
"creation_date": 1369347166,
"owner": {
"user_id": 16228,
"user_type": "registered",
"display_name": "Adnan",
"reputation": 6521,
"email_hash": "e5afea27d0dd34e10b58bbaa9c9aa749"
},
"post_id": 36409,
"post_type": "question",
"score": 1,
"edit_count": 3,
"body": "What you're doing is way more complicated that it needs to be. I think what you're looking for is a PBKDF2. You can feed it the user's password, and as long as you feed it the same parameters, it will give you the same fixed-length key. You can use that key for your encryption and later decryption. Also, it makes perfect sense to get different outputs in your case, you're generating a random IV, the whole point of the IV is to get a different starting state in order to prevent getting the same ciphertext for the same plaintext."
},
{
"comment_id": 56857,
"creation_date": 1369347782,
"owner": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"post_id": 36409,
"post_type": "question",
"score": 0,
"body": "If you really have to do it this way, why AES encrypt the RSA key, and not the other way around? Please read the RSA maximum bytes to encrypt, comparison to AES in terms of security? thread for explanation on what I mean."
},
{
"comment_id": 56858,
"creation_date": 1369348011,
"owner": {
"user_id": 16228,
"user_type": "registered",
"display_name": "Adnan",
"reputation": 6521,
"email_hash": "e5afea27d0dd34e10b58bbaa9c9aa749"
},
"reply_to_user": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"post_id": 36409,
"post_type": "question",
"score": 0,
"edit_count": 2,
"body": "@TildalWave Why would you suggest the other way around? The guy might just be trying to protect his private RSA key with a password. RSAing your AES keys is a totally different matter (used in SSL, for example). I might agree with you that what he's doing doesn't make much sense, though."
},
{
"comment_id": 56859,
"creation_date": 1369348511,
"owner": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"reply_to_user": {
"user_id": 16228,
"user_type": "registered",
"display_name": "Adnan",
"reputation": 6521,
"email_hash": "e5afea27d0dd34e10b58bbaa9c9aa749"
},
"post_id": 36409,
"post_type": "question",
"score": 0,
"body": "@Adnan - Then I guess I have problems extracting OP's intended use from the question. It's by far more usual to see it the other way around, but yes, there would be cases where you'd symmetrically encrypt the private key also, as you said. Still, I'd expect AES to repeat more frequently in the suggested model then."
},
{
"comment_id": 56860,
"creation_date": 1369348558,
"owner": {
"user_id": 10346,
"user_type": "registered",
"display_name": "Richard",
"reputation": 113,
"email_hash": "cc10ab64534f01f38d19a4a594b5e744"
},
"post_id": 36409,
"post_type": "question",
"score": 0,
"body": "Thanks Adnan & TidalWave for the quick responses! In fact, I would like to protect my RSA private key. Thats the only purpose. And I do not want to store in any matter the key with which I protect it. I will accept Adnan's answer as it seems more practical for me at the moment. Thank you."
},
{
"comment_id": 56861,
"creation_date": 1369348685,
"owner": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"reply_to_user": {
"user_id": 16228,
"user_type": "registered",
"display_name": "Adnan",
"reputation": 6521,
"email_hash": "e5afea27d0dd34e10b58bbaa9c9aa749"
},
"post_id": 36409,
"post_type": "question",
"score": 0,
"body": "Yes, in that case, @Adnan anticipated your intended use correctly, and I apologise for not seeing it as well."
},
{
"comment_id": 56862,
"creation_date": 1369348827,
"owner": {
"user_id": 16228,
"user_type": "registered",
"display_name": "Adnan",
"reputation": 6521,
"email_hash": "e5afea27d0dd34e10b58bbaa9c9aa749"
},
"reply_to_user": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"post_id": 36409,
"post_type": "question",
"score": 1,
"body": "@TildalWave Naah, you just need one of these."
}
]
},
{
"tags": [
"web-application",
"cryptography",
"java"
],
"answer_count": 0,
"favorite_count": 0,
"closed_date": 1369321095,
"closed_reason": "exact duplicate",
"question_timeline_url": "/questions/36392/timeline",
"question_comments_url": "/questions/36392/comments",
"question_answers_url": "/questions/36392/answers",
"question_id": 36392,
"owner": {
"user_id": 26307,
"user_type": "registered",
"display_name": "lucianovcnt",
"reputation": 1,
"email_hash": "fd08d49d01ab5f3843a1542e21f5873c"
},
"creation_date": 1369318200,
"last_activity_date": 1369318200,
"up_vote_count": 0,
"down_vote_count": 5,
"view_count": 28,
"score": -5,
"community_owned": false,
"title": "Encrypt .war file java web application?",
"comments": [
{
"comment_id": 56817,
"creation_date": 1369318559,
"owner": {
"user_id": 12,
"user_type": "registered",
"display_name": "Xander",
"reputation": 2464,
"email_hash": "e8b50a4728b3393a9a16ddecb0d82abb"
},
"post_id": 36392,
"post_type": "question",
"score": 3,
"body": "Deplicate of your earlier question here: security.stackexchange.com/q/36359/12"
},
{
"comment_id": 56818,
"creation_date": 1369318754,
"owner": {
"user_id": 26307,
"user_type": "registered",
"display_name": "lucianovcnt",
"reputation": 1,
"email_hash": "fd08d49d01ab5f3843a1542e21f5873c"
},
"reply_to_user": {
"user_id": 12,
"user_type": "registered",
"display_name": "Xander",
"reputation": 2464,
"email_hash": "e8b50a4728b3393a9a16ddecb0d82abb"
},
"post_id": 36392,
"post_type": "question",
"score": 0,
"edit_count": 1,
"body": "If u look better, are questions for different purposes, it is more specific. @Xander"
},
{
"comment_id": 56823,
"creation_date": 1369320591,
"owner": {
"user_id": 12,
"user_type": "registered",
"display_name": "Xander",
"reputation": 2464,
"email_hash": "e8b50a4728b3393a9a16ddecb0d82abb"
},
"post_id": 36392,
"post_type": "question",
"score": 2,
"body": "In my opinion, it's too close. I think you'd be better off editing your existing question."
}
]
},
{
"tags": [
"encryption",
"cryptography",
"linux",
"openssl",
"rsa"
],
"answer_count": 2,
"answers": [
{
"answer_id": 36385,
"accepted": true,
"answer_comments_url": "/answers/36385/comments",
"question_id": 36358,
"owner": {
"user_id": 18555,
"user_type": "registered",
"display_name": "mr.spuratic",
"reputation": 1271,
"email_hash": "51f65677a32bd9404865b8c65e79afc7"
},
"creation_date": 1369306581,
"last_edit_date": 1369311165,
"last_activity_date": 1369311165,
"up_vote_count": 4,
"down_vote_count": 0,
"view_count": 97,
"score": 4,
"community_owned": false,
"title": "Decrypt from cipher text encrypted using RSA",
"comments": [
{
"comment_id": 56801,
"creation_date": 1369306936,
"owner": {
"user_id": 16228,
"user_type": "registered",
"display_name": "Adnan",
"reputation": 6521,
"email_hash": "e5afea27d0dd34e10b58bbaa9c9aa749"
},
"post_id": 36385,
"post_type": "answer",
"score": 0,
"body": "Fantastic answer!"
},
{
"comment_id": 56808,
"creation_date": 1369308968,
"owner": {
"user_id": 19800,
"user_type": "registered",
"display_name": "javad_shareef",
"reputation": 118,
"email_hash": "f66e8ee04ed1f28d28f4447d8f4b16a8"
},
"post_id": 36385,
"post_type": "answer",
"score": 0,
"body": "Thanks spuratic. As far as i understood that key.b64 contains public key, crt.b64 contains private key and blob.b64 contains ciphertext. Correct me if i am wrong."
},
{
"comment_id": 56810,
"creation_date": 1369310817,
"owner": {
"user_id": 18555,
"user_type": "registered",
"display_name": "mr.spuratic",
"reputation": 1271,
"email_hash": "51f65677a32bd9404865b8c65e79afc7"
},
"post_id": 36385,
"post_type": "answer",
"score": 0,
"body": "crt.b64 is the public key, since it turns out it's not an actual cert, I'll rename it to be more obvious. In general the "public key" is wrapped up in a cert, hence the name I used."
},
{
"comment_id": 56815,
"creation_date": 1369313975,
"owner": {
"user_id": 19800,
"user_type": "registered",
"display_name": "javad_shareef",
"reputation": 118,
"email_hash": "f66e8ee04ed1f28d28f4447d8f4b16a8"
},
"post_id": 36385,
"post_type": "answer",
"score": 0,
"body": "It worked well mr.spuratic. Thanks.. :)"
}
]
},
{
"answer_id": 36384,
"accepted": false,
"answer_comments_url": "/answers/36384/comments",
"question_id": 36358,
"owner": {
"user_id": 26270,
"user_type": "registered",
"display_name": "Thomas Chopitea",
"reputation": 1,
"email_hash": "ac697a6c6b26dce1888a01a7fa8963aa"
},
"creation_date": 1369306450,
"last_activity_date": 1369306450,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 97,
"score": 0,
"community_owned": false,
"title": "Decrypt from cipher text encrypted using RSA",
"comments": []
}
],
"accepted_answer_id": 36385,
"favorite_count": 0,
"question_timeline_url": "/questions/36358/timeline",
"question_comments_url": "/questions/36358/comments",
"question_answers_url": "/questions/36358/answers",
"question_id": 36358,
"owner": {
"user_id": 19800,
"user_type": "registered",
"display_name": "javad_shareef",
"reputation": 118,
"email_hash": "f66e8ee04ed1f28d28f4447d8f4b16a8"
},
"creation_date": 1369254138,
"last_activity_date": 1369311165,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 97,
"score": 2,
"community_owned": false,
"title": "Decrypt from cipher text encrypted using RSA",
"comments": [
{
"comment_id": 56743,
"creation_date": 1369256753,
"owner": {
"user_id": 10836,
"user_type": "registered",
"display_name": "miniBill",
"reputation": 109,
"email_hash": "fdb435376f06014566318fd7e920d25c"
},
"post_id": 36358,
"post_type": "question",
"score": 0,
"body": "The strings are all encoded in base64. Now, how does one interpret them it's another business. Can you name the application or not? Can you RE it?"
},
{
"comment_id": 56745,
"creation_date": 1369257021,
"owner": {
"user_id": 19800,
"user_type": "registered",
"display_name": "javad_shareef",
"reputation": 118,
"email_hash": "f66e8ee04ed1f28d28f4447d8f4b16a8"
},
"reply_to_user": {
"user_id": 10836,
"user_type": "registered",
"display_name": "miniBill",
"reputation": 109,
"email_hash": "fdb435376f06014566318fd7e920d25c"
},
"post_id": 36358,
"post_type": "question",
"score": 0,
"body": "RSA public key, private key, and data will be in base64 right?(Correct me if am wrong.)"
},
{
"comment_id": 56746,
"creation_date": 1369257076,
"owner": {
"user_id": 10836,
"user_type": "registered",
"display_name": "miniBill",
"reputation": 109,
"email_hash": "fdb435376f06014566318fd7e920d25c"
},
"post_id": 36358,
"post_type": "question",
"score": 0,
"body": "That's right, those strings are all [most probably] base64. You can tell from the charset and the trailing =s"
},
{
"comment_id": 56747,
"creation_date": 1369257222,
"owner": {
"user_id": 19800,
"user_type": "registered",
"display_name": "javad_shareef",
"reputation": 118,
"email_hash": "f66e8ee04ed1f28d28f4447d8f4b16a8"
},
"reply_to_user": {
"user_id": 10836,
"user_type": "registered",
"display_name": "miniBill",
"reputation": 109,
"email_hash": "fdb435376f06014566318fd7e920d25c"
},
"post_id": 36358,
"post_type": "question",
"score": 0,
"body": "How to do it so?"
},
{
"comment_id": 56749,
"creation_date": 1369257329,
"owner": {
"user_id": 10836,
"user_type": "registered",
"display_name": "miniBill",
"reputation": 109,
"email_hash": "fdb435376f06014566318fd7e920d25c"
},
"post_id": 36358,
"post_type": "question",
"score": 0,
"edit_count": 1,
"body": "You would have to understand how the private and public keys are represented. Is the application a windows or linux binary? What does it link to? Can you reverse engineer it?"
},
{
"comment_id": 56754,
"creation_date": 1369258490,
"owner": {
"user_id": 19800,
"user_type": "registered",
"display_name": "javad_shareef",
"reputation": 118,
"email_hash": "f66e8ee04ed1f28d28f4447d8f4b16a8"
},
"reply_to_user": {
"user_id": 10836,
"user_type": "registered",
"display_name": "miniBill",
"reputation": 109,
"email_hash": "fdb435376f06014566318fd7e920d25c"
},
"post_id": 36358,
"post_type": "question",
"score": 0,
"body": "The application for MAC. Application store private in a file in local machine. It send public key to server to pass a authentication token. Server will encrypt authentication token with the public send by client machine."
},
{
"comment_id": 56770,
"creation_date": 1369282486,
"owner": {
"user_id": 20195,
"user_type": "registered",
"display_name": "user93353",
"reputation": 137,
"email_hash": "f7ff87618295a44fdc2f237b1cd1712e"
},
"post_id": 36358,
"post_type": "question",
"score": 0,
"body": "Is SSL used here or some other protocol?"
},
{
"comment_id": 56786,
"creation_date": 1369299957,
"owner": {
"user_id": 19800,
"user_type": "registered",
"display_name": "javad_shareef",
"reputation": 118,
"email_hash": "f66e8ee04ed1f28d28f4447d8f4b16a8"
},
"post_id": 36358,
"post_type": "question",
"score": 0,
"body": "NO.. There is no SSL used in app."
},
{
"comment_id": 56788,
"creation_date": 1369301999,
"owner": {
"user_id": 10836,
"user_type": "registered",
"display_name": "miniBill",
"reputation": 109,
"email_hash": "fdb435376f06014566318fd7e920d25c"
},
"post_id": 36358,
"post_type": "question",
"score": 0,
"body": "If it doesn't use a standard library your best approach is decompiling it. Consider that this may be illegal, depending on the EULA and where do you live in"
}
]
},
{
"tags": [
"encryption",
"cryptography",
"cryptanalysis",
"cipher"
],
"answer_count": 1,
"answers": [
{
"answer_id": 36179,
"accepted": false,
"answer_comments_url": "/answers/36179/comments",
"question_id": 36169,
"owner": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"creation_date": 1368937846,
"last_edit_date": 1368942452,
"last_activity_date": 1368942452,
"up_vote_count": 12,
"down_vote_count": 0,
"view_count": 122,
"score": 12,
"community_owned": false,
"title": "Known plaintext; What cipher is being used here?",
"comments": []
}
],
"favorite_count": 0,
"closed_date": 1368975051,
"closed_reason": "off topic",
"question_timeline_url": "/questions/36169/timeline",
"question_comments_url": "/questions/36169/comments",
"question_answers_url": "/questions/36169/answers",
"question_id": 36169,
"owner": {
"user_id": 26170,
"user_type": "unregistered",
"display_name": "princessbubblebutt",
"reputation": 30,
"email_hash": "e3aece38e7a05cc1310037f76c7a6c8c"
},
"creation_date": 1368923199,
"last_edit_date": 1368924391,
"last_activity_date": 1368942452,
"up_vote_count": 7,
"down_vote_count": 3,
"view_count": 122,
"score": 4,
"community_owned": false,
"title": "Known plaintext; What cipher is being used here?",
"comments": [
{
"comment_id": 56413,
"creation_date": 1368926278,
"owner": {
"user_id": 10863,
"user_type": "registered",
"display_name": "Luc",
"reputation": 3386,
"email_hash": "993b5c15ca4a2d520f80f0c0120f13e6"
},
"post_id": 36169,
"post_type": "question",
"score": 2,
"edit_count": 4,
"body": "For all we know, it could be a one-time pad. A good cipher should produce output indistinguishable from random data, so if it's something good, we don't have any way of telling what this is. The only real clue you gave is the default output format that it uses (or I guess that's what it's formatted in) and that input and output are the same length (which still can be almost anything)."
},
{
"comment_id": 56414,
"creation_date": 1368928207,
"owner": {
"user_id": 26170,
"user_type": "unregistered",
"display_name": "princessbubblebutt",
"reputation": 30,
"email_hash": "e3aece38e7a05cc1310037f76c7a6c8c"
},
"reply_to_user": {
"user_id": 10863,
"user_type": "registered",
"display_name": "Luc",
"reputation": 3386,
"email_hash": "993b5c15ca4a2d520f80f0c0120f13e6"
},
"post_id": 36169,
"post_type": "question",
"score": 0,
"body": "what other useful info could i figure out to help discover what it is?"
},
{
"comment_id": 56417,
"creation_date": 1368930725,
"owner": {
"user_id": 7497,
"user_type": "registered",
"display_name": "Manishearth",
"reputation": 2296,
"email_hash": "0a3069491bfded90cdf623341cadc1d1"
},
"post_id": 36169,
"post_type": "question",
"score": 0,
"body": "It could be one of these with an extended charset."
},
{
"comment_id": 56418,
"creation_date": 1368930825,
"owner": {
"user_id": 7497,
"user_type": "registered",
"display_name": "Manishearth",
"reputation": 2296,
"email_hash": "0a3069491bfded90cdf623341cadc1d1"
},
"post_id": 36169,
"post_type": "question",
"score": 0,
"body": "Also, you have given two different outputs for the same http input"
},
{
"comment_id": 56579,
"creation_date": 1369144514,
"owner": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"reply_to_user": {
"user_id": 7497,
"user_type": "registered",
"display_name": "Manishearth",
"reputation": 2296,
"email_hash": "0a3069491bfded90cdf623341cadc1d1"
},
"post_id": 36169,
"post_type": "question",
"score": 0,
"edit_count": 1,
"body": "@Manishearth - I could be Vigenère cipher, but then a number of distinct shifted alphabets (supporting key length also of such length) would have to be equal or greater than 28, otherwise it would still produce a distinct repetition. For example, taking the Wikipedia example for a spin, the plaintext ATTACKATDAWN and ciphertext LXFOPVEFRNHR would result in letter shifts of 11,4,-14,14,13,11,4,-14,14,13,-15,4 in UTF-8 character space, clearly indicating key length of 5 (Wiki used a key LEMON in the example) and letter space of 26 (shift of first and first before last character)."
},
{
"comment_id": 56580,
"creation_date": 1369144640,
"owner": {
"user_id": 7497,
"user_type": "registered",
"display_name": "Manishearth",
"reputation": 2296,
"email_hash": "0a3069491bfded90cdf623341cadc1d1"
},
"reply_to_user": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"post_id": 36169,
"post_type": "question",
"score": 0,
"body": "@TildalWave: No, it need not be: Like I mentioned, it would have an extended charset. Until we have a notion of an assigned number for each letter and character, we don't know if there is a loop in the above example or not."
},
{
"comment_id": 56581,
"creation_date": 1369144776,
"owner": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"reply_to_user": {
"user_id": 7497,
"user_type": "registered",
"display_name": "Manishearth",
"reputation": 2296,
"email_hash": "0a3069491bfded90cdf623341cadc1d1"
},
"post_id": 36169,
"post_type": "question",
"score": 0,
"body": "@Manishearth - Oh sure, I'm not trying to prove anything here, I'm just killing time before lunch, like proper geeks like me do. :)"
},
{
"comment_id": 56583,
"creation_date": 1369145028,
"owner": {
"user_id": 7497,
"user_type": "registered",
"display_name": "Manishearth",
"reputation": 2296,
"email_hash": "0a3069491bfded90cdf623341cadc1d1"
},
"reply_to_user": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"post_id": 36169,
"post_type": "question",
"score": 0,
"body": "@TildalWave: Ah lol. I spend like 15 minutes on a JS console with this cipher. using ASCII as a base didn't work, neither did some other reshufflings. Then I have up :P"
},
{
"comment_id": 56584,
"creation_date": 1369147006,
"owner": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"reply_to_user": {
"user_id": 7497,
"user_type": "registered",
"display_name": "Manishearth",
"reputation": 2296,
"email_hash": "0a3069491bfded90cdf623341cadc1d1"
},
"post_id": 36169,
"post_type": "question",
"score": 0,
"body": "@Manishearth - Similar here, only went with Pascal as the language of choice because I'm better versed in character code translations there. Found a nifty online compile tool too, sadly it doesn't save projects like some others do, but it does support all kinds of languages, including some rather obscure ones. :)"
}
]
},
{
"tags": [
"encryption",
"cryptography"
],
"answer_count": 0,
"favorite_count": 0,
"closed_date": 1368892628,
"closed_reason": "off topic",
"question_timeline_url": "/questions/36159/timeline",
"question_comments_url": "/questions/36159/comments",
"question_answers_url": "/questions/36159/answers",
"question_id": 36159,
"locked_date": 1368892628,
"owner": {
"user_id": 23781,
"user_type": "registered",
"display_name": "MMA",
"reputation": 101,
"email_hash": "310d0f8c87eab2e231e6490cecfcd81e"
},
"creation_date": 1368886957,
"last_edit_date": 1368891162,
"last_activity_date": 1368891162,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 19,
"score": 0,
"community_owned": false,
"title": "Why this k parameter is in unary in adversary PPT algorithm?",
"comments": [
{
"comment_id": 56392,
"creation_date": 1368889017,
"owner": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"post_id": 36159,
"post_type": "question",
"score": 0,
"body": "Welcome to IT Security! Your question is regarding cryptography theory and as such a better fit on Cryptography, a StackExchange website dedicated to such topics. I see you're a registered member of Cryptography already, so I gather it shouldn't pose a problem once your question is migrated there. Thanks!"
}
]
},
{
"tags": [
"cryptography",
"key-management",
"backup"
],
"answer_count": 2,
"answers": [
{
"answer_id": 36064,
"accepted": true,
"answer_comments_url": "/answers/36064/comments",
"question_id": 36038,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1368746129,
"last_activity_date": 1368746129,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 75,
"score": 2,
"community_owned": false,
"title": "Backup schedule for Encryption Keys",
"comments": []
},
{
"answer_id": 36044,
"accepted": false,
"answer_comments_url": "/answers/36044/comments",
"question_id": 36038,
"owner": {
"user_id": 23735,
"user_type": "registered",
"display_name": "Brandon Franklin",
"reputation": 101,
"email_hash": "537a26d9b38a7b880593ff913fdb2f9b"
},
"creation_date": 1368717693,
"last_activity_date": 1368717693,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 75,
"score": 1,
"community_owned": false,
"title": "Backup schedule for Encryption Keys",
"comments": [
{
"comment_id": 56188,
"creation_date": 1368719313,
"owner": {
"user_id": 33,
"user_type": "moderator",
"display_name": "AviD",
"reputation": 20366,
"email_hash": "a88248f632c039340efa02505be355e5"
},
"post_id": 36044,
"post_type": "answer",
"score": 0,
"body": "Thanks, Brandon. Missing details as per my comment up top, I'm not asking about a single specific situation, but rather general guidelines. "Restoring and testing" - this is obvious, or rather always true with backups."
},
{
"comment_id": 56189,
"creation_date": 1368719368,
"owner": {
"user_id": 33,
"user_type": "moderator",
"display_name": "AviD",
"reputation": 20366,
"email_hash": "a88248f632c039340efa02505be355e5"
},
"post_id": 36044,
"post_type": "answer",
"score": 0,
"body": "Re the cryptography I actually have no idea either. But if keys are exported every X days, regularly, I don't know that there is NOT an issue."
},
{
"comment_id": 56203,
"creation_date": 1368728232,
"owner": {
"user_id": 23735,
"user_type": "registered",
"display_name": "Brandon Franklin",
"reputation": 101,
"email_hash": "537a26d9b38a7b880593ff913fdb2f9b"
},
"reply_to_user": {
"user_id": 33,
"user_type": "moderator",
"display_name": "AviD",
"reputation": 20366,
"email_hash": "a88248f632c039340efa02505be355e5"
},
"post_id": 36044,
"post_type": "answer",
"score": 0,
"body": "That's kind of my point. Exporting the keys doesn't reduce security, provided they're properly handled. If you have a secure export and backup process, you don't impact your security with frequent export."
},
{
"comment_id": 56268,
"creation_date": 1368776436,
"owner": {
"user_id": 33,
"user_type": "moderator",
"display_name": "AviD",
"reputation": 20366,
"email_hash": "a88248f632c039340efa02505be355e5"
},
"post_id": 36044,
"post_type": "answer",
"score": 0,
"body": "I meant more about the timing, i.e. every time a key is exported, that is a sign that the key was generated. I dont think that it is likely that this would directly expose the key, but I wasn't sure that it doesnt leak some info."
},
{
"comment_id": 56272,
"creation_date": 1368779270,
"owner": {
"user_id": 33,
"user_type": "moderator",
"display_name": "AviD",
"reputation": 20366,
"email_hash": "a88248f632c039340efa02505be355e5"
},
"post_id": 36044,
"post_type": "answer",
"score": 0,
"body": "But even more so, as @Thomas put it so well: you do not want to make too many copies of your encryption keys because encryption keys are, by definition, extremely sensitive, and multiple copies are, also by definition, at odds with confidentiality."
}
]
}
],
"accepted_answer_id": 36064,
"favorite_count": 0,
"question_timeline_url": "/questions/36038/timeline",
"question_comments_url": "/questions/36038/comments",
"question_answers_url": "/questions/36038/answers",
"question_id": 36038,
"owner": {
"user_id": 33,
"user_type": "moderator",
"display_name": "AviD",
"reputation": 20366,
"email_hash": "a88248f632c039340efa02505be355e5"
},
"creation_date": 1368713553,
"last_edit_date": 1368713587,
"last_activity_date": 1368746129,
"up_vote_count": 6,
"down_vote_count": 0,
"view_count": 75,
"score": 6,
"community_owned": false,
"title": "Backup schedule for Encryption Keys",
"comments": [
{
"comment_id": 56183,
"creation_date": 1368716570,
"owner": {
"user_id": 3173,
"user_type": "registered",
"display_name": "ewanm89",
"reputation": 1268,
"email_hash": "a0f08dd3a120988e576a16f0c3dc0384"
},
"post_id": 36038,
"post_type": "question",
"score": 0,
"body": "This also depends on how one is doing the backup? If one went to the bank to put a USB memory stick in safety deposit box every week, And once a year when keys change they take 2 USB memory sticks instead, it is not likely that an attacker would notice it."
},
{
"comment_id": 56184,
"creation_date": 1368716825,
"owner": {
"user_id": 33,
"user_type": "moderator",
"display_name": "AviD",
"reputation": 20366,
"email_hash": "a88248f632c039340efa02505be355e5"
},
"reply_to_user": {
"user_id": 3173,
"user_type": "registered",
"display_name": "ewanm89",
"reputation": 1268,
"email_hash": "a0f08dd3a120988e576a16f0c3dc0384"
},
"post_id": 36038,
"post_type": "question",
"score": 0,
"body": "@ewanm89 I suppose that's also true, but would be a factor in an answer. Make any assumptions on this you like, but they should be explicit..."
}
]
},
{
"tags": [
"passwords",
"cryptography",
"hash",
"linux",
"unix"
],
"answer_count": 2,
"answers": [
{
"answer_id": 36041,
"accepted": false,
"answer_comments_url": "/answers/36041/comments",
"question_id": 36037,
"owner": {
"user_id": 2213,
"user_type": "registered",
"display_name": "Antony Vennard",
"reputation": 11333,
"email_hash": "93e7e626a9493e05cb0e75dd246461b2"
},
"creation_date": 1368715394,
"last_activity_date": 1368715394,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 34,
"score": 0,
"community_owned": false,
"title": "Does glibc2 version of the crypt function still use DES for alternative hashing methods?",
"comments": [
{
"comment_id": 56176,
"creation_date": 1368715638,
"owner": {
"user_id": 25922,
"user_type": "registered",
"display_name": "Vilhelm Gray",
"reputation": 111,
"email_hash": "c9778d5cd689a99bc776f771a67b1bfb"
},
"post_id": 36041,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "Why is the resulting string 370xDLmeGD9m4aF/ciIlC.? I would expect an MD5 hash to consist of a series of hexadecimal digits, but this string does not fit that format."
},
{
"comment_id": 56177,
"creation_date": 1368715791,
"owner": {
"user_id": 2213,
"user_type": "registered",
"display_name": "Antony Vennard",
"reputation": 11333,
"email_hash": "93e7e626a9493e05cb0e75dd246461b2"
},
"reply_to_user": {
"user_id": 25922,
"user_type": "registered",
"display_name": "Vilhelm Gray",
"reputation": 111,
"email_hash": "c9778d5cd689a99bc776f771a67b1bfb"
},
"post_id": 36041,
"post_type": "answer",
"score": 0,
"body": "@VilhelmGray I imagine they encoded the hash value in a range of printable characters. It looks like BASE64 but I could be wrong. Either way, encoding in just 0-9,A-F requires two bytes per byte of actual data and is therefore quite expensive to use."
},
{
"comment_id": 56178,
"creation_date": 1368716064,
"owner": {
"user_id": 25922,
"user_type": "registered",
"display_name": "Vilhelm Gray",
"reputation": 111,
"email_hash": "c9778d5cd689a99bc776f771a67b1bfb"
},
"post_id": 36041,
"post_type": "answer",
"score": 0,
"body": "Oh I see, so the process the process would probably be similar to: pass ==> MD5(pass+salt) ==> encoding-func(hash) ==> encoded-hash"
},
{
"comment_id": 56180,
"creation_date": 1368716205,
"owner": {
"user_id": 2213,
"user_type": "registered",
"display_name": "Antony Vennard",
"reputation": 11333,
"email_hash": "93e7e626a9493e05cb0e75dd246461b2"
},
"reply_to_user": {
"user_id": 25922,
"user_type": "registered",
"display_name": "Vilhelm Gray",
"reputation": 111,
"email_hash": "c9778d5cd689a99bc776f771a67b1bfb"
},
"post_id": 36041,
"post_type": "answer",
"score": 1,
"body": "@VilhelmGray yep. MD5(pass+salt) will just be an array of bytes, e.g. uint8_t arr[20]; (adjust 20 for bits/8) and the encoded version will be too, just modified so that each byte is printable. Technically, you could just store it in the file unprintable (what you might call a binary file) but Unix configuration has always traditionally used readable text files."
}
]
},
{
"answer_id": 36042,
"accepted": true,
"answer_comments_url": "/answers/36042/comments",
"question_id": 36037,
"owner": {
"user_id": 414,
"user_type": "registered",
"display_name": "Gilles",
"reputation": 10126,
"email_hash": "a717291747c76567bb0f086e15ae6e43"
},
"creation_date": 1368715920,
"last_edit_date": 1368716371,
"last_activity_date": 1368716371,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 34,
"score": 0,
"community_owned": false,
"title": "Does glibc2 version of the crypt function still use DES for alternative hashing methods?",
"comments": [
{
"comment_id": 56181,
"creation_date": 1368716241,
"owner": {
"user_id": 25922,
"user_type": "registered",
"display_name": "Vilhelm Gray",
"reputation": 111,
"email_hash": "c9778d5cd689a99bc776f771a67b1bfb"
},
"post_id": 36042,
"post_type": "answer",
"score": 0,
"edit_count": 3,
"body": "crypt encodes using a variant of Base64. This can be verified in code: static const char b64t[64] =\n"./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";"
}
]
}
],
"accepted_answer_id": 36042,
"favorite_count": 0,
"question_timeline_url": "/questions/36037/timeline",
"question_comments_url": "/questions/36037/comments",
"question_answers_url": "/questions/36037/answers",
"question_id": 36037,
"owner": {
"user_id": 25922,
"user_type": "registered",
"display_name": "Vilhelm Gray",
"reputation": 111,
"email_hash": "c9778d5cd689a99bc776f771a67b1bfb"
},
"creation_date": 1368713552,
"last_edit_date": 1368714075,
"last_activity_date": 1368716371,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 34,
"score": 2,
"community_owned": false,
"title": "Does glibc2 version of the crypt function still use DES for alternative hashing methods?",
"comments": []
},
{
"tags": [
"encryption",
"passwords",
"cryptography",
"password-management"
],
"answer_count": 2,
"answers": [
{
"answer_id": 35832,
"accepted": true,
"answer_comments_url": "/answers/35832/comments",
"question_id": 35831,
"owner": {
"user_id": 10211,
"user_type": "registered",
"display_name": "Terry Chia",
"reputation": 11070,
"email_hash": "b62ccba5dd465e468c77c495dd67b737"
},
"creation_date": 1368448894,
"last_activity_date": 1368448894,
"up_vote_count": 17,
"down_vote_count": 0,
"view_count": 1028,
"score": 17,
"community_owned": false,
"title": "Does versioning an encrypted file make it less secure?",
"comments": [
{
"comment_id": 55820,
"creation_date": 1368461010,
"owner": {
"user_id": 13719,
"user_type": "registered",
"display_name": "Aidenn",
"reputation": 121,
"email_hash": "0205f36cae862840e34b0a8d7d06cc6c"
},
"post_id": 35832,
"post_type": "answer",
"score": 0,
"body": "It does open you up to implementation bugs though. If poor entropy is used for selecting the IV then you start to run into possible collisions there."
},
{
"comment_id": 55840,
"creation_date": 1368449656,
"owner": {
"user_id": 8460,
"user_type": "registered",
"display_name": "Øyvind Skaar",
"reputation": 101,
"email_hash": "ba835b0bf7f6d2e5c4ddd4deceb90be9"
},
"post_id": 35832,
"post_type": "answer",
"score": 0,
"body": "Just to add to what Terry said, this is not something you should worry about. It's a little bit like worrying about being hit by a meteor while you drive.. and talk on your phone.. drunk."
},
{
"comment_id": 55851,
"creation_date": 1368482621,
"owner": {
"user_id": 4895,
"user_type": "registered",
"display_name": "Eric G",
"reputation": 3031,
"email_hash": "e0fa10de11b7e78147fe2a17e5165b6d"
},
"post_id": 35832,
"post_type": "answer",
"score": 0,
"body": "A factor to consider in general is compression and any patterns that may create, however, specifically for KeePass this is not going to likely come into play"
}
]
},
{
"answer_id": 35860,
"accepted": false,
"answer_comments_url": "/answers/35860/comments",
"question_id": 35831,
"owner": {
"user_id": 9404,
"user_type": "registered",
"display_name": "bgt421",
"reputation": 151,
"email_hash": "f760992ff98281c46119c3bbba87576f"
},
"creation_date": 1368480008,
"last_activity_date": 1368480008,
"up_vote_count": 5,
"down_vote_count": 0,
"view_count": 1028,
"score": 5,
"community_owned": false,
"title": "Does versioning an encrypted file make it less secure?",
"comments": []
}
],
"accepted_answer_id": 35832,
"favorite_count": 1,
"question_timeline_url": "/questions/35831/timeline",
"question_comments_url": "/questions/35831/comments",
"question_answers_url": "/questions/35831/answers",
"question_id": 35831,
"owner": {
"user_id": 13510,
"user_type": "registered",
"display_name": "Janus Troelsen",
"reputation": 228,
"email_hash": "d797538504a367f277d19bd8369e9a19"
},
"creation_date": 1368448673,
"last_activity_date": 1368480008,
"up_vote_count": 20,
"down_vote_count": 0,
"view_count": 1028,
"score": 20,
"community_owned": false,
"title": "Does versioning an encrypted file make it less secure?",
"comments": []
},
{
"tags": [
"encryption",
"cryptography",
"homomorphic-encryption"
],
"answer_count": 2,
"answers": [
{
"answer_id": 35827,
"accepted": true,
"answer_comments_url": "/answers/35827/comments",
"question_id": 35813,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1368445309,
"last_edit_date": 1368447485,
"last_activity_date": 1368447485,
"up_vote_count": 10,
"down_vote_count": 0,
"view_count": 341,
"score": 10,
"community_owned": false,
"title": "Homomorphic encryption used for e-voting?",
"comments": [
{
"comment_id": 55818,
"creation_date": 1368459889,
"owner": {
"user_id": 25932,
"user_type": "registered",
"display_name": "Volatile",
"reputation": 78,
"email_hash": "f04785c0bd80955099ff28b72d1c6ed1"
},
"post_id": 35827,
"post_type": "answer",
"score": 2,
"body": "I think I understand what Lucas meant with "bear territory". Thank you."
}
]
},
{
"answer_id": 35822,
"accepted": false,
"answer_comments_url": "/answers/35822/comments",
"question_id": 35813,
"owner": {
"user_id": 8266,
"user_type": "registered",
"display_name": "Indolering",
"reputation": 90,
"email_hash": "29074f4b551f6a2d97d644e4cb5843ee"
},
"creation_date": 1368436110,
"last_edit_date": 1368754715,
"last_activity_date": 1368754715,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 341,
"score": 3,
"community_owned": false,
"title": "Homomorphic encryption used for e-voting?",
"comments": [
{
"comment_id": 55782,
"creation_date": 1368438062,
"owner": {
"user_id": 25932,
"user_type": "registered",
"display_name": "Volatile",
"reputation": 78,
"email_hash": "f04785c0bd80955099ff28b72d1c6ed1"
},
"post_id": 35822,
"post_type": "answer",
"score": 2,
"body": "In the link from the above comment from TildalWave, Ben Adida talks about how the problem with e-voting is that your computer can contain malware that does the voting for you. So, in that case; it could change the values prior to encryption... What i'm asking is; isn't that still possible after the encryption? Being homomorphic 'n' all."
},
{
"comment_id": 56104,
"creation_date": 1368648559,
"owner": {
"user_id": 8266,
"user_type": "registered",
"display_name": "Indolering",
"reputation": 90,
"email_hash": "29074f4b551f6a2d97d644e4cb5843ee"
},
"reply_to_user": {
"user_id": 25932,
"user_type": "registered",
"display_name": "Volatile",
"reputation": 78,
"email_hash": "f04785c0bd80955099ff28b72d1c6ed1"
},
"post_id": 35822,
"post_type": "answer",
"score": 0,
"body": "That's why they do ballot mailings on the back-end. They only need to then scan a tiny fraction of the ballots to tell if the computer value and the mailed ballot to get the same level of confidence as a hand recount."
},
{
"comment_id": 56149,
"creation_date": 1368689590,
"owner": {
"user_id": 25932,
"user_type": "registered",
"display_name": "Volatile",
"reputation": 78,
"email_hash": "f04785c0bd80955099ff28b72d1c6ed1"
},
"post_id": 35822,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "Is it possible to only look at a portion of the encryption to know something about the encryption?"
},
{
"comment_id": 56244,
"creation_date": 1368754762,
"owner": {
"user_id": 8266,
"user_type": "registered",
"display_name": "Indolering",
"reputation": 90,
"email_hash": "29074f4b551f6a2d97d644e4cb5843ee"
},
"reply_to_user": {
"user_id": 25932,
"user_type": "registered",
"display_name": "Volatile",
"reputation": 78,
"email_hash": "f04785c0bd80955099ff28b72d1c6ed1"
},
"post_id": 35822,
"post_type": "answer",
"score": 0,
"body": "Does the above revision answer your question?"
}
]
}
],
"accepted_answer_id": 35827,
"favorite_count": 2,
"question_timeline_url": "/questions/35813/timeline",
"question_comments_url": "/questions/35813/comments",
"question_answers_url": "/questions/35813/answers",
"question_id": 35813,
"owner": {
"user_id": 25932,
"user_type": "registered",
"display_name": "Volatile",
"reputation": 78,
"email_hash": "f04785c0bd80955099ff28b72d1c6ed1"
},
"creation_date": 1368428541,
"last_activity_date": 1368754715,
"up_vote_count": 15,
"down_vote_count": 0,
"view_count": 341,
"score": 15,
"community_owned": false,
"title": "Homomorphic encryption used for e-voting?",
"comments": [
{
"comment_id": 55769,
"creation_date": 1368430773,
"owner": {
"user_id": 3339,
"user_type": "registered",
"display_name": "Lucas Kauffman",
"reputation": 12355,
"email_hash": "7d6ab282108ec8402127fed2498b29a3"
},
"post_id": 35813,
"post_type": "question",
"score": 6,
"body": "shopchristophers.com/objects/catalog/product/image/…"
},
{
"comment_id": 55773,
"creation_date": 1368432400,
"owner": {
"user_id": 3530,
"user_type": "registered",
"display_name": "Christoffer",
"reputation": 590,
"email_hash": "8a3de12811e381154270decce3bef776"
},
"post_id": 35813,
"post_type": "question",
"score": 4,
"body": "+1 for interesting question."
},
{
"comment_id": 55775,
"creation_date": 1368433532,
"owner": {
"user_id": 13663,
"user_type": "registered",
"display_name": "Fake51",
"reputation": 156,
"email_hash": "6906d020c3456ee0725b0a0f6b7d1095"
},
"post_id": 35813,
"post_type": "question",
"score": 0,
"body": "I would expect it should have read "can be used to create more secure voting systems" or rather solve some problems of e-voting. However, the privacy issues and the transparency issues are still present, so you still won't end up with a result that's usable for largescale voting."
},
{
"comment_id": 55777,
"creation_date": 1368435974,
"owner": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"post_id": 35813,
"post_type": "question",
"score": 2,
"body": "It's not an exact duplicate (I'm saying this to prevent unnecessary flags being raised), but your question was already at least partially answered in the In what ways does Full or Partial Homomorphic Encryption benefit the cloud? thread by three top rated answers there. If you could expand more on what's discussed there, that would be great IMO. ;)"
},
{
"comment_id": 55778,
"creation_date": 1368436039,
"owner": {
"user_id": 25932,
"user_type": "registered",
"display_name": "Volatile",
"reputation": 78,
"email_hash": "f04785c0bd80955099ff28b72d1c6ed1"
},
"reply_to_user": {
"user_id": 13663,
"user_type": "registered",
"display_name": "Fake51",
"reputation": 156,
"email_hash": "6906d020c3456ee0725b0a0f6b7d1095"
},
"post_id": 35813,
"post_type": "question",
"score": 0,
"body": "@Fake51 Even without all the issues, isn't there a fundamental problem with the statement; homomorphic encryption can be used in conjecture with something that requires absolute data integrity? Or am I just missing the bigger picture?"
},
{
"comment_id": 55780,
"creation_date": 1368436658,
"owner": {
"user_id": 485,
"user_type": "moderator",
"display_name": "Rory Alsop",
"reputation": 32567,
"email_hash": "af1ed0816ed5a2164a4e343ad09309ad"
},
"reply_to_user": {
"user_id": 3339,
"user_type": "registered",
"display_name": "Lucas Kauffman",
"reputation": 12355,
"email_hash": "7d6ab282108ec8402127fed2498b29a3"
},
"post_id": 35813,
"post_type": "question",
"score": 3,
"body": "And for those new here who might not get @Lucas' joke: meta.security.stackexchange.com/a/884/485"
},
{
"comment_id": 55898,
"creation_date": 1368528407,
"owner": {
"user_id": 13663,
"user_type": "registered",
"display_name": "Fake51",
"reputation": 156,
"email_hash": "6906d020c3456ee0725b0a0f6b7d1095"
},
"post_id": 35813,
"post_type": "question",
"score": 0,
"edit_count": 1,
"body": "@Volatile I think Thomas Pornin explained it well below. If I read it right, a voter can check that his vote was actually what it should be. If that is the case though, it introduces a huge gaping privacy hole, as that means you could possibly force someone to vote in a specific way and check that they did."
}
]
},
{
"tags": [
"cryptography",
"authentication",
"pgp",
"gnupg"
],
"answer_count": 3,
"answers": [
{
"answer_id": 35669,
"accepted": true,
"answer_comments_url": "/answers/35669/comments",
"question_id": 35666,
"owner": {
"user_id": 19837,
"user_type": "registered",
"display_name": "Jens Erat",
"reputation": 448,
"email_hash": "dfce9b07c3b7869fdb805e12200d4046"
},
"creation_date": 1368137371,
"last_activity_date": 1368137371,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 196,
"score": 3,
"community_owned": false,
"title": "Is it okay to sign a PGP key without an IRL meeting?",
"comments": [
{
"comment_id": 55434,
"creation_date": 1368139796,
"owner": {
"user_id": 23710,
"user_type": "registered",
"display_name": "Diti",
"reputation": 28,
"email_hash": "b08e7d38f4c40fd7294812923ad5a2c5"
},
"post_id": 35669,
"post_type": "answer",
"score": 0,
"body": "Kudos for this well-understandable, detailed answer! Your explanation is great because it relates my case (you are talking about my friend), while still being general enough for other readers to understand. Anyway, if I get it correctly, “trust in identity” and “vouching” are both labelled as “trust” in GnuPG, but the first should actually be labelled “ownertrust”, shouldn’t it? Thank you kindly!"
}
]
},
{
"answer_id": 35674,
"accepted": false,
"answer_comments_url": "/answers/35674/comments",
"question_id": 35666,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1368152569,
"last_activity_date": 1368152569,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 196,
"score": 2,
"community_owned": false,
"title": "Is it okay to sign a PGP key without an IRL meeting?",
"comments": []
},
{
"answer_id": 35668,
"accepted": false,
"answer_comments_url": "/answers/35668/comments",
"question_id": 35666,
"owner": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"creation_date": 1368135536,
"last_activity_date": 1368135536,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 196,
"score": 0,
"community_owned": false,
"title": "Is it okay to sign a PGP key without an IRL meeting?",
"comments": [
{
"comment_id": 55426,
"creation_date": 1368137029,
"owner": {
"user_id": 23710,
"user_type": "registered",
"display_name": "Diti",
"reputation": 28,
"email_hash": "b08e7d38f4c40fd7294812923ad5a2c5"
},
"post_id": 35668,
"post_type": "answer",
"score": 0,
"edit_count": 2,
"body": "I do understand that there is a difference between trusting a person, and trusting that the person who claims their key to be 0xB16B00B5 is the exact same person the key 0xB16B00B5 designs. My question is being asked with this consideration already in mind."
},
{
"comment_id": 55430,
"creation_date": 1368138406,
"owner": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"reply_to_user": {
"user_id": 23710,
"user_type": "registered",
"display_name": "Diti",
"reputation": 28,
"email_hash": "b08e7d38f4c40fd7294812923ad5a2c5"
},
"post_id": 35668,
"post_type": "answer",
"score": 1,
"body": "Your question is being asked with this information you just described left out of it. But granted, I have yet to master telepathy. In fact you go at length proving my point - you're putting in bold "Can I sign, with level 3, the key of a friend I have been knowing for several years?" but the PGP question asks "How carefully have you verified the key you are about to sign actually belongs to the person named above?". Can you see the difference in what's being asked of you and what you're asking us?"
},
{
"comment_id": 55431,
"creation_date": 1368139301,
"owner": {
"user_id": 23710,
"user_type": "registered",
"display_name": "Diti",
"reputation": 28,
"email_hash": "b08e7d38f4c40fd7294812923ad5a2c5"
},
"post_id": 35668,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "Yes, I can see the difference (and I also apologize for being not explicit enough in my question; the information I just described was implicitly contained in first paragraph of my preamble). Also, I agree with your observation: the question GnuPG asks for ownertrust certification is clear."
}
]
}
],
"accepted_answer_id": 35669,
"favorite_count": 1,
"question_timeline_url": "/questions/35666/timeline",
"question_comments_url": "/questions/35666/comments",
"question_answers_url": "/questions/35666/answers",
"question_id": 35666,
"owner": {
"user_id": 23710,
"user_type": "registered",
"display_name": "Diti",
"reputation": 28,
"email_hash": "b08e7d38f4c40fd7294812923ad5a2c5"
},
"creation_date": 1368134780,
"last_edit_date": 1368140180,
"last_activity_date": 1368152569,
"up_vote_count": 5,
"down_vote_count": 1,
"view_count": 196,
"score": 4,
"community_owned": false,
"title": "Is it okay to sign a PGP key without an IRL meeting?",
"comments": [
{
"comment_id": 55437,
"creation_date": 1368139991,
"owner": {
"user_id": 23710,
"user_type": "registered",
"display_name": "Diti",
"reputation": 28,
"email_hash": "b08e7d38f4c40fd7294812923ad5a2c5"
},
"post_id": 35666,
"post_type": "question",
"score": 0,
"body": "The “I have been knowing for several years” bit of my question is relatively significant, because it implies that I know enough about the person to be able to confirm his/her identity; the only thing left to me is to verify/validate that he/she is the actual owner of the key."
}
]
},
{
"tags": [
"cryptography",
"pgp",
"disk-encryption",
"file-system",
"truecrypt"
],
"answer_count": 1,
"answers": [
{
"answer_id": 35466,
"accepted": false,
"answer_comments_url": "/answers/35466/comments",
"question_id": 35456,
"owner": {
"user_id": 18555,
"user_type": "registered",
"display_name": "mr.spuratic",
"reputation": 1271,
"email_hash": "51f65677a32bd9404865b8c65e79afc7"
},
"creation_date": 1367924173,
"last_activity_date": 1367924173,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 105,
"score": 3,
"community_owned": false,
"title": "Recognizing PGP-encrypted disks",
"comments": [
{
"comment_id": 55185,
"creation_date": 1368014954,
"owner": {
"user_id": 25647,
"user_type": "registered",
"display_name": "Gopal",
"reputation": 16,
"email_hash": "a11f905d093a9b68f0dae807b38c139b"
},
"post_id": 35466,
"post_type": "answer",
"score": 0,
"body": "Thank u sir for sharing this useful information. The link you shared about forensic analysis of OS X FileVault2 was really interesting and useful. It was more about FileVault2 full disk encryption. I searched on google for forensic analysis for other disk encryption schemes, but I didn't get any useful relevant info there. Can you Please share similar links about other disk encryption schemes (like PGP, TrueCrypt, BitLocker)?"
},
{
"comment_id": 55969,
"creation_date": 1368555584,
"owner": {
"user_id": 18555,
"user_type": "registered",
"display_name": "mr.spuratic",
"reputation": 1271,
"email_hash": "51f65677a32bd9404865b8c65e79afc7"
},
"reply_to_user": {
"user_id": 25647,
"user_type": "registered",
"display_name": "Gopal",
"reputation": 16,
"email_hash": "a11f905d093a9b68f0dae807b38c139b"
},
"post_id": 35466,
"post_type": "answer",
"score": 0,
"body": "Sorry, I have not found anything as comprehensive for other implementations. Even the Forensics Wiki is light on details."
}
]
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/35456/timeline",
"question_comments_url": "/questions/35456/comments",
"question_answers_url": "/questions/35456/answers",
"question_id": 35456,
"owner": {
"user_id": 25647,
"user_type": "registered",
"display_name": "Gopal",
"reputation": 16,
"email_hash": "a11f905d093a9b68f0dae807b38c139b"
},
"creation_date": 1367910084,
"last_edit_date": 1367915054,
"last_activity_date": 1367924173,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 105,
"score": 3,
"community_owned": false,
"title": "Recognizing PGP-encrypted disks",
"comments": []
},
{
"tags": [
"cryptography",
"architecture"
],
"answer_count": 1,
"answers": [
{
"answer_id": 35251,
"accepted": true,
"answer_comments_url": "/answers/35251/comments",
"question_id": 35243,
"owner": {
"user_id": 5411,
"user_type": "registered",
"display_name": "Tom Leek",
"reputation": 24996,
"email_hash": "e2e94675a01dd4477eef7750db006817"
},
"creation_date": 1367514271,
"last_activity_date": 1367514271,
"up_vote_count": 6,
"down_vote_count": 0,
"view_count": 131,
"score": 6,
"community_owned": false,
"title": "Do the new instruction sets found on Intel's Haswell Architecture make any difference in cryptographic operations?",
"comments": []
}
],
"accepted_answer_id": 35251,
"favorite_count": 1,
"question_timeline_url": "/questions/35243/timeline",
"question_comments_url": "/questions/35243/comments",
"question_answers_url": "/questions/35243/answers",
"question_id": 35243,
"owner": {
"user_id": 10211,
"user_type": "registered",
"display_name": "Terry Chia",
"reputation": 11070,
"email_hash": "b62ccba5dd465e468c77c495dd67b737"
},
"creation_date": 1367510064,
"last_activity_date": 1367514271,
"up_vote_count": 6,
"down_vote_count": 0,
"view_count": 131,
"score": 6,
"community_owned": false,
"title": "Do the new instruction sets found on Intel's Haswell Architecture make any difference in cryptographic operations?",
"comments": []
},
{
"tags": [
"cryptography",
"php",
"cookies"
],
"answer_count": 0,
"favorite_count": 0,
"closed_date": 1367438387,
"closed_reason": "too localized",
"question_timeline_url": "/questions/35174/timeline",
"question_comments_url": "/questions/35174/comments",
"question_answers_url": "/questions/35174/answers",
"question_id": 35174,
"owner": {
"user_id": 25469,
"user_type": "registered",
"display_name": "Barry Brian",
"reputation": 1,
"email_hash": "e8fe0dbfe1d567f1941f75e9c979273f"
},
"creation_date": 1367437017,
"last_edit_date": 1367450326,
"last_activity_date": 1367450326,
"up_vote_count": 0,
"down_vote_count": 3,
"view_count": 95,
"score": -3,
"community_owned": false,
"title": "Decrypt my cookie",
"comments": [
{
"comment_id": 54683,
"creation_date": 1367437039,
"owner": {
"user_id": 25469,
"user_type": "registered",
"display_name": "Barry Brian",
"reputation": 1,
"email_hash": "e8fe0dbfe1d567f1941f75e9c979273f"
},
"post_id": 35174,
"post_type": "question",
"score": 0,
"body": "Thank you in advance :)"
},
{
"comment_id": 54686,
"creation_date": 1367438379,
"owner": {
"user_id": 665,
"user_type": "moderator",
"display_name": "Hendrik Brummermann",
"reputation": 15677,
"email_hash": "900952cb86814ff8ff512d9d2c9ba02b"
},
"post_id": 35174,
"post_type": "question",
"score": 1,
"body": "Hello Barry and welcome to IT Security Stack Exchange. Unfortunately your question is not a good fit for this site because it is not helpful for anyone else."
},
{
"comment_id": 54690,
"creation_date": 1367441032,
"owner": {
"user_id": 485,
"user_type": "moderator",
"display_name": "Rory Alsop",
"reputation": 32567,
"email_hash": "af1ed0816ed5a2164a4e343ad09309ad"
},
"post_id": 35174,
"post_type": "question",
"score": 1,
"body": "Additionally, you could use any encoding you want when creating a cookie, so there is not a single useful answer."
},
{
"comment_id": 54705,
"creation_date": 1367454161,
"owner": {
"user_id": 16235,
"user_type": "registered",
"display_name": "Johnny",
"reputation": 426,
"email_hash": "1f5076155eabfff040f6ead2cb5fc25b"
},
"post_id": 35174,
"post_type": "question",
"score": 0,
"body": "That sessionID probably contains no information itself, it's just a pointer to session data on the server, so there's no way to "decode" it because there's nothing encoded, it's just a pointer into a session table."
}
]
},
{
"tags": [
"cryptography",
"hash",
"salt",
"bcrypt"
],
"answer_count": 0,
"favorite_count": 0,
"closed_date": 1367420800,
"closed_reason": "off topic",
"question_timeline_url": "/questions/35151/timeline",
"question_comments_url": "/questions/35151/comments",
"question_answers_url": "/questions/35151/answers",
"question_id": 35151,
"locked_date": 1367420800,
"owner": {
"user_id": 8052,
"user_type": "registered",
"display_name": "Claudio Floreani",
"reputation": 111,
"email_hash": "462183a7e1aa06a89cb656c024aa3b09"
},
"creation_date": 1367409998,
"last_activity_date": 1367417459,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 55,
"score": 2,
"community_owned": false,
"title": "Knowing a valid salted hash for an unknown secret, is it possible to compute another valid hash?",
"comments": [
{
"comment_id": 54671,
"creation_date": 1367420792,
"owner": {
"user_id": 836,
"user_type": "moderator",
"display_name": "Jeff Ferland",
"reputation": 21466,
"email_hash": "34e5e0b41202f3c375552750c0d6f309"
},
"post_id": 35151,
"post_type": "question",
"score": 0,
"body": "Generally once we start talking about crypto with formal logic notations, I punt that over to our sister site that focuses on crypto."
}
]
},
{
"tags": [
"encryption",
"cryptography",
".net",
"web-service"
],
"answer_count": 1,
"answers": [
{
"answer_id": 35044,
"accepted": false,
"answer_comments_url": "/answers/35044/comments",
"question_id": 35043,
"owner": {
"user_id": 2553,
"user_type": "registered",
"display_name": "oleksii",
"reputation": 362,
"email_hash": "8440c1cc847e9fd1e0272853724e6060"
},
"creation_date": 1367252462,
"last_activity_date": 1367252462,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 67,
"score": 2,
"community_owned": false,
"title": "How to Verify the Identity of the Caller of a Web Service",
"comments": []
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/35043/timeline",
"question_comments_url": "/questions/35043/comments",
"question_answers_url": "/questions/35043/answers",
"question_id": 35043,
"owner": {
"user_id": 25197,
"user_type": "registered",
"display_name": "Joe Borg",
"reputation": 40,
"email_hash": "5e0f3fa79d59da6aca7147ab96087756"
},
"creation_date": 1367249923,
"last_activity_date": 1367252462,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 67,
"score": 2,
"community_owned": false,
"title": "How to Verify the Identity of the Caller of a Web Service",
"comments": [
{
"comment_id": 54504,
"creation_date": 1367251701,
"owner": {
"user_id": 10950,
"user_type": "registered",
"display_name": "GdD",
"reputation": 5530,
"email_hash": "ba6ac1e6a6edf384f4a26035ce5ad825"
},
"post_id": 35043,
"post_type": "question",
"score": 0,
"body": "How much effort to put into this depends on what you are trying to accomplish. What is your goal?"
},
{
"comment_id": 54508,
"creation_date": 1367252250,
"owner": {
"user_id": 25197,
"user_type": "registered",
"display_name": "Joe Borg",
"reputation": 40,
"email_hash": "5e0f3fa79d59da6aca7147ab96087756"
},
"reply_to_user": {
"user_id": 10950,
"user_type": "registered",
"display_name": "GdD",
"reputation": 5530,
"email_hash": "ba6ac1e6a6edf384f4a26035ce5ad825"
},
"post_id": 35043,
"post_type": "question",
"score": 0,
"body": "@GdD The web service will be used to make payments online using credit card details. Even though I authenticate the user everytime a call is made, I would like to verify that the call was made from the mobile phone app itself and not from a normal computer app."
}
]
},
{
"tags": [
"encryption",
"cryptography",
"windows",
"phone"
],
"answer_count": 1,
"answers": [
{
"answer_id": 35048,
"accepted": true,
"answer_comments_url": "/answers/35048/comments",
"question_id": 35040,
"owner": {
"user_id": 5411,
"user_type": "registered",
"display_name": "Tom Leek",
"reputation": 24996,
"email_hash": "e2e94675a01dd4477eef7750db006817"
},
"creation_date": 1367260795,
"last_activity_date": 1367260795,
"up_vote_count": 5,
"down_vote_count": 0,
"view_count": 83,
"score": 5,
"community_owned": false,
"title": "Windows Phone and Hardcoding Values",
"comments": [
{
"comment_id": 54519,
"creation_date": 1367260976,
"owner": {
"user_id": 28,
"user_type": "registered",
"display_name": "SteveS",
"reputation": 6935,
"email_hash": "0a75c8ca1046d24847d55cd748f53ea3"
},
"post_id": 35048,
"post_type": "answer",
"score": 0,
"body": "+1 Did not know there was such a StackExchange site."
},
{
"comment_id": 54520,
"creation_date": 1367261350,
"owner": {
"user_id": 5411,
"user_type": "registered",
"display_name": "Tom Leek",
"reputation": 24996,
"email_hash": "e2e94675a01dd4477eef7750db006817"
},
"reply_to_user": {
"user_id": 28,
"user_type": "registered",
"display_name": "SteveS",
"reputation": 6935,
"email_hash": "0a75c8ca1046d24847d55cd748f53ea3"
},
"post_id": 35048,
"post_type": "answer",
"score": 0,
"body": "It is very recent. Got out of private beta one or two weeks ago, I think."
}
]
}
],
"accepted_answer_id": 35048,
"favorite_count": 1,
"question_timeline_url": "/questions/35040/timeline",
"question_comments_url": "/questions/35040/comments",
"question_answers_url": "/questions/35040/answers",
"question_id": 35040,
"owner": {
"user_id": 25197,
"user_type": "registered",
"display_name": "Joe Borg",
"reputation": 40,
"email_hash": "5e0f3fa79d59da6aca7147ab96087756"
},
"creation_date": 1367243119,
"last_activity_date": 1367260795,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 83,
"score": 3,
"community_owned": false,
"title": "Windows Phone and Hardcoding Values",
"comments": [
{
"comment_id": 54494,
"creation_date": 1367245348,
"owner": {
"user_id": 16228,
"user_type": "registered",
"display_name": "Adnan",
"reputation": 6521,
"email_hash": "e5afea27d0dd34e10b58bbaa9c9aa749"
},
"post_id": 35040,
"post_type": "question",
"score": 3,
"body": "Yes, they can."
},
{
"comment_id": 54496,
"creation_date": 1367245572,
"owner": {
"user_id": 25197,
"user_type": "registered",
"display_name": "Joe Borg",
"reputation": 40,
"email_hash": "5e0f3fa79d59da6aca7147ab96087756"
},
"reply_to_user": {
"user_id": 16228,
"user_type": "registered",
"display_name": "Adnan",
"reputation": 6521,
"email_hash": "e5afea27d0dd34e10b58bbaa9c9aa749"
},
"post_id": 35040,
"post_type": "question",
"score": 0,
"body": "Thanks for the response Adnan"
},
{
"comment_id": 54502,
"creation_date": 1367251053,
"owner": {
"user_id": 21426,
"user_type": "registered",
"display_name": "void_in",
"reputation": 446,
"email_hash": "1443bef7663f2d6c3db9927567a3d11a"
},
"reply_to_user": {
"user_id": 16228,
"user_type": "registered",
"display_name": "Adnan",
"reputation": 6521,
"email_hash": "e5afea27d0dd34e10b58bbaa9c9aa749"
},
"post_id": 35040,
"post_type": "question",
"score": 1,
"body": "@Adnan would you at least write a proper and complete answer for how they are going to extract that private key? I know once the device is in the user's hand, they can practically take it apart bit by bit. But your comment doesn't add anything to this site's knowledge."
},
{
"comment_id": 54503,
"creation_date": 1367251565,
"owner": {
"user_id": 16228,
"user_type": "registered",
"display_name": "Adnan",
"reputation": 6521,
"email_hash": "e5afea27d0dd34e10b58bbaa9c9aa749"
},
"reply_to_user": {
"user_id": 21426,
"user_type": "registered",
"display_name": "void_in",
"reputation": 446,
"email_hash": "1443bef7663f2d6c3db9927567a3d11a"
},
"post_id": 35040,
"post_type": "question",
"score": 2,
"edit_count": 1,
"body": "@void_in This is exactly what comments are for. I know that what I've written isn't a complete answer, so I didn't write it as an answer. Also, OP isn't interested in knowing how they can do it. He asked about the possibility of doing so. Now, let's think together, does your comment add anything to the site's knowledge?"
},
{
"comment_id": 54507,
"creation_date": 1367252240,
"owner": {
"user_id": 21426,
"user_type": "registered",
"display_name": "void_in",
"reputation": 446,
"email_hash": "1443bef7663f2d6c3db9927567a3d11a"
},
"post_id": 35040,
"post_type": "question",
"score": 0,
"edit_count": 1,
"body": ""I am asking this because I have found no way of accessing installed certificates from the phone." Obviously the OP is asking the question because he didn't know any way of doing it. If someone can prove it to him that he is wrong in his assumption, that would be a constructive answer/comment. I won't respond on your last part. I guess there is an unwritten code of ethics that every professional should follow."
},
{
"comment_id": 54522,
"creation_date": 1367262552,
"owner": {
"user_id": 16228,
"user_type": "registered",
"display_name": "Adnan",
"reputation": 6521,
"email_hash": "e5afea27d0dd34e10b58bbaa9c9aa749"
},
"post_id": 35040,
"post_type": "question",
"score": 0,
"body": "@JoeBorg This might be relevant: Reverse Engineering Windows 8 Apps."
}
]
},
{
"tags": [
"encryption",
"cryptography",
"ssl",
"certificates",
"proxy"
],
"answer_count": 1,
"answers": [
{
"answer_id": 34993,
"accepted": false,
"answer_comments_url": "/answers/34993/comments",
"question_id": 34988,
"owner": {
"user_id": 7497,
"user_type": "registered",
"display_name": "Manishearth",
"reputation": 2296,
"email_hash": "0a3069491bfded90cdf623341cadc1d1"
},
"creation_date": 1367178318,
"last_activity_date": 1367178318,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 71,
"score": 2,
"community_owned": false,
"title": "SSL Communication and Proxy",
"comments": []
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/34988/timeline",
"question_comments_url": "/questions/34988/comments",
"question_answers_url": "/questions/34988/answers",
"question_id": 34988,
"owner": {
"user_id": 25197,
"user_type": "registered",
"display_name": "Joe Borg",
"reputation": 40,
"email_hash": "5e0f3fa79d59da6aca7147ab96087756"
},
"creation_date": 1367173567,
"last_edit_date": 1367176230,
"last_activity_date": 1367208134,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 71,
"score": 1,
"community_owned": false,
"title": "SSL Communication and Proxy",
"comments": []
},
{
"tags": [
"encryption",
"cryptography",
"man-in-the-middle",
"protocols"
],
"answer_count": 1,
"answers": [
{
"answer_id": 34989,
"accepted": false,
"answer_comments_url": "/answers/34989/comments",
"question_id": 34986,
"owner": {
"user_id": 5411,
"user_type": "registered",
"display_name": "Tom Leek",
"reputation": 24996,
"email_hash": "e2e94675a01dd4477eef7750db006817"
},
"creation_date": 1367173568,
"last_activity_date": 1367173568,
"up_vote_count": 6,
"down_vote_count": 0,
"view_count": 174,
"score": 6,
"community_owned": false,
"title": "What is a man in the middle attack?",
"comments": []
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/34986/timeline",
"question_comments_url": "/questions/34986/comments",
"question_answers_url": "/questions/34986/answers",
"question_id": 34986,
"owner": {
"user_id": 25312,
"user_type": "registered",
"display_name": "JimmyK",
"reputation": 11,
"email_hash": "5e2fa3f0291deba923a121e3cbde0d3e"
},
"creation_date": 1367172157,
"last_edit_date": 1367324432,
"last_activity_date": 1367477697,
"up_vote_count": 1,
"down_vote_count": 2,
"view_count": 174,
"score": -1,
"community_owned": false,
"title": "What is a man in the middle attack?",
"comments": []
},
{
"tags": [
"encryption",
"cryptography",
"protocols"
],
"answer_count": 1,
"answers": [
{
"answer_id": 34984,
"accepted": true,
"answer_comments_url": "/answers/34984/comments",
"question_id": 34983,
"owner": {
"user_id": 5411,
"user_type": "registered",
"display_name": "Tom Leek",
"reputation": 24996,
"email_hash": "e2e94675a01dd4477eef7750db006817"
},
"creation_date": 1367171353,
"last_activity_date": 1367171353,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 64,
"score": 2,
"community_owned": false,
"title": "Symmetric Key Cryptography vs Public Key Cryptography",
"comments": [
{
"comment_id": 54395,
"creation_date": 1367172124,
"owner": {
"user_id": 25312,
"user_type": "registered",
"display_name": "JimmyK",
"reputation": 11,
"email_hash": "5e2fa3f0291deba923a121e3cbde0d3e"
},
"post_id": 34984,
"post_type": "answer",
"score": 0,
"body": "Perfect answer, thank you"
}
]
}
],
"accepted_answer_id": 34984,
"favorite_count": 0,
"closed_date": 1367339295,
"closed_reason": "exact duplicate",
"question_timeline_url": "/questions/34983/timeline",
"question_comments_url": "/questions/34983/comments",
"question_answers_url": "/questions/34983/answers",
"question_id": 34983,
"owner": {
"user_id": 25312,
"user_type": "registered",
"display_name": "JimmyK",
"reputation": 11,
"email_hash": "5e2fa3f0291deba923a121e3cbde0d3e"
},
"creation_date": 1367171094,
"last_activity_date": 1367171353,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 64,
"score": 1,
"community_owned": false,
"title": "Symmetric Key Cryptography vs Public Key Cryptography",
"comments": []
},
{
"tags": [
"encryption",
"cryptography",
"certificates"
],
"answer_count": 1,
"answers": [
{
"answer_id": 34982,
"accepted": true,
"answer_comments_url": "/answers/34982/comments",
"question_id": 34979,
"owner": {
"user_id": 22425,
"user_type": "registered",
"display_name": "Matthew",
"reputation": 182,
"email_hash": "8ac0a4a406e83fdf1313ca62c5771ba7"
},
"creation_date": 1367169998,
"last_activity_date": 1367169998,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 64,
"score": 0,
"community_owned": false,
"title": "Determine the Identity of Caller",
"comments": []
}
],
"accepted_answer_id": 34982,
"favorite_count": 0,
"question_timeline_url": "/questions/34979/timeline",
"question_comments_url": "/questions/34979/comments",
"question_answers_url": "/questions/34979/answers",
"question_id": 34979,
"owner": {
"user_id": 22425,
"user_type": "registered",
"display_name": "Matthew",
"reputation": 182,
"email_hash": "8ac0a4a406e83fdf1313ca62c5771ba7"
},
"creation_date": 1367161195,
"last_edit_date": 1367161502,
"last_activity_date": 1367169998,
"up_vote_count": 1,
"down_vote_count": 1,
"view_count": 64,
"score": 0,
"community_owned": false,
"title": "Determine the Identity of Caller",
"comments": []
},
{
"tags": [
"encryption",
"cryptography",
".net",
"algorithm"
],
"answer_count": 1,
"answers": [
{
"answer_id": 34977,
"accepted": true,
"answer_comments_url": "/answers/34977/comments",
"question_id": 34970,
"owner": {
"user_id": 5411,
"user_type": "registered",
"display_name": "Tom Leek",
"reputation": 24996,
"email_hash": "e2e94675a01dd4477eef7750db006817"
},
"creation_date": 1367156609,
"last_activity_date": 1367156609,
"up_vote_count": 5,
"down_vote_count": 0,
"view_count": 67,
"score": 5,
"community_owned": false,
"title": "Asymmetric encryption algorithms",
"comments": []
}
],
"accepted_answer_id": 34977,
"favorite_count": 0,
"closed_date": 1367341033,
"closed_reason": "not a real question",
"question_timeline_url": "/questions/34970/timeline",
"question_comments_url": "/questions/34970/comments",
"question_answers_url": "/questions/34970/answers",
"question_id": 34970,
"owner": {
"user_id": 22425,
"user_type": "registered",
"display_name": "Matthew",
"reputation": 182,
"email_hash": "8ac0a4a406e83fdf1313ca62c5771ba7"
},
"creation_date": 1367151677,
"last_activity_date": 1367156609,
"up_vote_count": 0,
"down_vote_count": 7,
"view_count": 67,
"score": -7,
"community_owned": false,
"title": "Asymmetric encryption algorithms",
"comments": [
{
"comment_id": 54371,
"creation_date": 1367151917,
"owner": {
"user_id": 10211,
"user_type": "registered",
"display_name": "Terry Chia",
"reputation": 11070,
"email_hash": "b62ccba5dd465e468c77c495dd67b737"
},
"post_id": 34970,
"post_type": "question",
"score": 0,
"body": "Where exactly did you read that?"
},
{
"comment_id": 54372,
"creation_date": 1367152065,
"owner": {
"user_id": 9377,
"user_type": "registered",
"display_name": "lynks",
"reputation": 4352,
"email_hash": "9a21812b9a1037044c110bc3c8948627"
},
"post_id": 34970,
"post_type": "question",
"score": 1,
"body": "RSA is secure, it is by far the most widely used asymmetric algorithm out there."
},
{
"comment_id": 54373,
"creation_date": 1367152251,
"owner": {
"user_id": 22425,
"user_type": "registered",
"display_name": "Matthew",
"reputation": 182,
"email_hash": "8ac0a4a406e83fdf1313ca62c5771ba7"
},
"post_id": 34970,
"post_type": "question",
"score": 0,
"body": "Oops! I misread some information. However, I read that RSA cannot be used to encrypt very long messages. The encrypted message should not exceed 128 bytes. Is that correct?"
},
{
"comment_id": 54374,
"creation_date": 1367152923,
"owner": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 34970,
"post_type": "question",
"score": 0,
"edit_count": 2,
"body": "@Matthew That's why you should use hybrid encryption. Choose a random key, encrypt the actual message with symmetric crypto (for example AES-GCM) and then encrypt that key with RSA (don't forget proper padding i.e. OAEP)."
}
]
},
{
"tags": [
"cryptography"
],
"answer_count": 2,
"answers": [
{
"answer_id": 34967,
"accepted": true,
"answer_comments_url": "/answers/34967/comments",
"question_id": 34950,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1367150788,
"last_activity_date": 1367150788,
"up_vote_count": 6,
"down_vote_count": 0,
"view_count": 188,
"score": 6,
"community_owned": false,
"title": "What are the practical uses of large asymmetric keys?",
"comments": [
{
"comment_id": 54377,
"creation_date": 1367154141,
"owner": {
"user_id": 10211,
"user_type": "registered",
"display_name": "Terry Chia",
"reputation": 11070,
"email_hash": "b62ccba5dd465e468c77c495dd67b737"
},
"post_id": 34967,
"post_type": "answer",
"score": 0,
"body": "Is the mathematician half mad because he discovers a killer algorithm for integer factorization, or is he half mad because he is a mathematician?"
},
{
"comment_id": 54378,
"creation_date": 1367154187,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"reply_to_user": {
"user_id": 10211,
"user_type": "registered",
"display_name": "Terry Chia",
"reputation": 11070,
"email_hash": "b62ccba5dd465e468c77c495dd67b737"
},
"post_id": 34967,
"post_type": "answer",
"score": 6,
"body": "Rather, he is a mathematician because he is half-mad."
}
]
},
{
"answer_id": 34954,
"accepted": false,
"answer_comments_url": "/answers/34954/comments",
"question_id": 34950,
"owner": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"creation_date": 1367121644,
"last_edit_date": 1367122920,
"last_activity_date": 1367122920,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 188,
"score": 1,
"community_owned": false,
"title": "What are the practical uses of large asymmetric keys?",
"comments": [
{
"comment_id": 54335,
"creation_date": 1367125541,
"owner": {
"user_id": 21417,
"user_type": "registered",
"display_name": "copy",
"reputation": 306,
"email_hash": "ba5cd4b361ecdb2a17a8558d980f9d35"
},
"post_id": 34954,
"post_type": "answer",
"score": 2,
"body": "OTP is a symmetric (theoretical, because the key is too big) algorithm for encryption. It's not related to public key cryptography. Also, your post seems to be regarding symmetric key cryptography mostly, not public key cryptography."
},
{
"comment_id": 54339,
"creation_date": 1367126584,
"owner": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"reply_to_user": {
"user_id": 21417,
"user_type": "registered",
"display_name": "copy",
"reputation": 306,
"email_hash": "ba5cd4b361ecdb2a17a8558d980f9d35"
},
"post_id": 34954,
"post_type": "answer",
"score": 0,
"body": "@copy - You're probably right, but I wanted to have a go at it anyway. I can't pretend to be too knowledgeable on the subject, but one way to learn is to make mistakes, and I'll be looking forward (no joke) where I failed and learn new things (or unlearn old ones LOL). If I got any at least partially correct, I'll have a small party tho. :) I'm curious though, why do you think that my (admittedly) speculative musings don't apply to PKI as well?"
},
{
"comment_id": 54388,
"creation_date": 1367163353,
"owner": {
"user_id": 21417,
"user_type": "registered",
"display_name": "copy",
"reputation": 306,
"email_hash": "ba5cd4b361ecdb2a17a8558d980f9d35"
},
"post_id": 34954,
"post_type": "answer",
"score": 0,
"body": "If quantum computers appear, all public key cryptography based on integer factorization and the DLP will be broken completely, whereas quantum attacks against symmetric ciphers require at least 2^(n/2) steps (this is what your Futureproofing point is about)"
},
{
"comment_id": 54488,
"creation_date": 1367242978,
"owner": {
"user_id": 2138,
"user_type": "registered",
"display_name": "Michael Kjörling",
"reputation": 277,
"email_hash": "fe2211d28f1196deadce36ba7f9cd93e"
},
"post_id": 34954,
"post_type": "answer",
"score": 0,
"body": "The number of atoms in the observable universe is estimated at up to about 10^82. Public-key cryptography doesn't work that way, but 2048 bits of key material means about 3x10^616 possible keys. To reach 10^82 possible values, you need just under 272.5 bits of entropy (2^272.5 = 1.07x10^82)."
},
{
"comment_id": 54501,
"creation_date": 1367250895,
"owner": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"reply_to_user": {
"user_id": 2138,
"user_type": "registered",
"display_name": "Michael Kjörling",
"reputation": 277,
"email_hash": "fe2211d28f1196deadce36ba7f9cd93e"
},
"post_id": 34954,
"post_type": "answer",
"score": 0,
"body": "@MichaelKjörling - You're taking it too literal. If we calculate the theoretical number of hydrogen atoms in Sun, then we'd get roughly a number 10^52. That is of course nothing compared to ~ 10^1232 possible values for a 4096-bit key. Being more precise with such numbers is beyond the point, for example our Sun will emit during its entire lifetime roughly 1.21e+62 photons (rough estimate) before it turns into a red giant and engulfs Earth in the process. You only need key lengths of 207 bits to hold as many unique keys, and you're still left with enough to see it collapse into a white dwarf."
}
]
}
],
"accepted_answer_id": 34967,
"favorite_count": 0,
"question_timeline_url": "/questions/34950/timeline",
"question_comments_url": "/questions/34950/comments",
"question_answers_url": "/questions/34950/answers",
"question_id": 34950,
"owner": {
"user_id": 28,
"user_type": "registered",
"display_name": "SteveS",
"reputation": 6935,
"email_hash": "0a75c8ca1046d24847d55cd748f53ea3"
},
"creation_date": 1367116606,
"last_activity_date": 1367150788,
"up_vote_count": 10,
"down_vote_count": 0,
"view_count": 188,
"score": 10,
"community_owned": false,
"title": "What are the practical uses of large asymmetric keys?",
"comments": [
{
"comment_id": 54327,
"creation_date": 1367117837,
"owner": {
"user_id": 21417,
"user_type": "registered",
"display_name": "copy",
"reputation": 306,
"email_hash": "ba5cd4b361ecdb2a17a8558d980f9d35"
},
"post_id": 34950,
"post_type": "question",
"score": 0,
"body": "This should probably be on crypto.stackexchange.com"
},
{
"comment_id": 54328,
"creation_date": 1367118830,
"owner": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"reply_to_user": {
"user_id": 21417,
"user_type": "registered",
"display_name": "copy",
"reputation": 306,
"email_hash": "ba5cd4b361ecdb2a17a8558d980f9d35"
},
"post_id": 34950,
"post_type": "question",
"score": 2,
"body": "@copy - I think it's fine here too. It's one of those topics that overlap both here and on Crypto. For example, check the number of questions tagged cryptography on Sec.SE. Besides, whichever of the two subsites it ends up on, it'll probably be answered by the same people anyway. ;)"
},
{
"comment_id": 54375,
"creation_date": 1367153296,
"owner": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 34950,
"post_type": "question",
"score": 0,
"edit_count": 1,
"body": "I'd rather use ECC than huge RSA. A 256 bit curve is about as strong as 3000 bit RSA and the advantage of ECC increases the higher the desired security level."
}
]
},
{
"tags": [
"encryption",
"cryptography",
"public-key-infrastructure",
"iis"
],
"answer_count": 1,
"answers": [
{
"answer_id": 34938,
"accepted": true,
"answer_comments_url": "/answers/34938/comments",
"question_id": 34932,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1367079614,
"last_activity_date": 1367079614,
"up_vote_count": 5,
"down_vote_count": 0,
"view_count": 51,
"score": 5,
"community_owned": false,
"title": "Clarification on Digital Certificates",
"comments": [
{
"comment_id": 54307,
"creation_date": 1367080685,
"owner": {
"user_id": 22425,
"user_type": "registered",
"display_name": "Matthew",
"reputation": 182,
"email_hash": "8ac0a4a406e83fdf1313ca62c5771ba7"
},
"post_id": 34938,
"post_type": "answer",
"score": 0,
"body": "Thank you very much Thomas :) Thank you for taking the time to answer my question in detail :)"
},
{
"comment_id": 54310,
"creation_date": 1367080846,
"owner": {
"user_id": 22425,
"user_type": "registered",
"display_name": "Matthew",
"reputation": 182,
"email_hash": "8ac0a4a406e83fdf1313ca62c5771ba7"
},
"post_id": 34938,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "With regards to the .pvk file, in case it gets stolen, can they get the private key from it? If I remember correctly, I had to enter a password when creating the .pvk file. I assume that one has to enter the same password in order to get the private key from it. Is that correct?"
}
]
}
],
"accepted_answer_id": 34938,
"favorite_count": 0,
"question_timeline_url": "/questions/34932/timeline",
"question_comments_url": "/questions/34932/comments",
"question_answers_url": "/questions/34932/answers",
"question_id": 34932,
"owner": {
"user_id": 22425,
"user_type": "registered",
"display_name": "Matthew",
"reputation": 182,
"email_hash": "8ac0a4a406e83fdf1313ca62c5771ba7"
},
"creation_date": 1367074564,
"last_activity_date": 1367079614,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 51,
"score": 3,
"community_owned": false,
"title": "Clarification on Digital Certificates",
"comments": [
{
"comment_id": 54305,
"creation_date": 1367080272,
"owner": {
"user_id": 21234,
"user_type": "registered",
"display_name": "Mayank Sharma",
"reputation": 1213,
"email_hash": "99056008c256828c617121c2f3763040"
},
"post_id": 34932,
"post_type": "question",
"score": 0,
"body": "Certificate holds only the public key."
}
]
},
{
"tags": [
"encryption",
"cryptography",
"certificates",
"certificate-authority",
"iis"
],
"answer_count": 1,
"answers": [
{
"answer_id": 34960,
"accepted": true,
"answer_comments_url": "/answers/34960/comments",
"question_id": 34931,
"owner": {
"user_id": 22425,
"user_type": "registered",
"display_name": "Matthew",
"reputation": 182,
"email_hash": "8ac0a4a406e83fdf1313ca62c5771ba7"
},
"creation_date": 1367134959,
"last_activity_date": 1367134959,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 40,
"score": 0,
"community_owned": false,
"title": "Sending Digital Certificates",
"comments": []
}
],
"accepted_answer_id": 34960,
"favorite_count": 0,
"question_timeline_url": "/questions/34931/timeline",
"question_comments_url": "/questions/34931/comments",
"question_answers_url": "/questions/34931/answers",
"question_id": 34931,
"owner": {
"user_id": 22425,
"user_type": "registered",
"display_name": "Matthew",
"reputation": 182,
"email_hash": "8ac0a4a406e83fdf1313ca62c5771ba7"
},
"creation_date": 1367074477,
"last_activity_date": 1367134959,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 40,
"score": 2,
"community_owned": false,
"title": "Sending Digital Certificates",
"comments": [
{
"comment_id": 54323,
"creation_date": 1367093354,
"owner": {
"user_id": 28,
"user_type": "registered",
"display_name": "SteveS",
"reputation": 6935,
"email_hash": "0a75c8ca1046d24847d55cd748f53ea3"
},
"post_id": 34931,
"post_type": "question",
"score": 0,
"body": "Have you tried dropping the ServicePointManager.SecurityProtocol = SecurityProtocolType.Ssl3 | SecurityProtocolType.Tls; line?"
},
{
"comment_id": 54352,
"creation_date": 1367141684,
"owner": {
"user_id": 20195,
"user_type": "registered",
"display_name": "user93353",
"reputation": 137,
"email_hash": "f7ff87618295a44fdc2f237b1cd1712e"
},
"post_id": 34931,
"post_type": "question",
"score": 0,
"body": "It's not necessary to install the server certificate in the Personal section in mmc."
}
]
},
{
"tags": [
"cryptography",
"hash"
],
"answer_count": 1,
"answers": [
{
"answer_id": 34936,
"accepted": true,
"answer_comments_url": "/answers/34936/comments",
"question_id": 34930,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1367079135,
"last_activity_date": 1367079135,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 62,
"score": 3,
"community_owned": false,
"title": "Hash extension(padding) attack",
"comments": [
{
"comment_id": 54311,
"creation_date": 1367081434,
"owner": {
"user_id": 12462,
"user_type": "registered",
"display_name": "ysj",
"reputation": 110,
"email_hash": "5b96048e5243879d0a77e014998f28f6"
},
"post_id": 34936,
"post_type": "answer",
"score": 0,
"body": "Thanks so much dude!"
},
{
"comment_id": 54336,
"creation_date": 1367125635,
"owner": {
"user_id": 12462,
"user_type": "registered",
"display_name": "ysj",
"reputation": 110,
"email_hash": "5b96048e5243879d0a77e014998f28f6"
},
"post_id": 34936,
"post_type": "answer",
"score": 0,
"body": "Hey, sorry just wondering if hmac was used then this a recommended implementation in the real world?"
}
]
}
],
"accepted_answer_id": 34936,
"favorite_count": 0,
"question_timeline_url": "/questions/34930/timeline",
"question_comments_url": "/questions/34930/comments",
"question_answers_url": "/questions/34930/answers",
"question_id": 34930,
"owner": {
"user_id": 12462,
"user_type": "registered",
"display_name": "ysj",
"reputation": 110,
"email_hash": "5b96048e5243879d0a77e014998f28f6"
},
"creation_date": 1367072670,
"last_activity_date": 1367079135,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 62,
"score": 2,
"community_owned": false,
"title": "Hash extension(padding) attack",
"comments": []
},
{
"tags": [
"encryption",
"cryptography",
"certificates",
"certificate-authority"
],
"answer_count": 1,
"answers": [
{
"answer_id": 34928,
"accepted": true,
"answer_comments_url": "/answers/34928/comments",
"question_id": 34927,
"owner": {
"user_id": 21234,
"user_type": "registered",
"display_name": "Mayank Sharma",
"reputation": 1213,
"email_hash": "99056008c256828c617121c2f3763040"
},
"creation_date": 1367068066,
"last_edit_date": 1367070683,
"last_activity_date": 1367070683,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 64,
"score": 3,
"community_owned": false,
"title": "Security Certificates - Tools to Generate Security Certificates",
"comments": [
{
"comment_id": 54301,
"creation_date": 1367071223,
"owner": {
"user_id": 22425,
"user_type": "registered",
"display_name": "Matthew",
"reputation": 182,
"email_hash": "8ac0a4a406e83fdf1313ca62c5771ba7"
},
"post_id": 34928,
"post_type": "answer",
"score": 0,
"body": "Thank you so much for the link :)"
}
]
}
],
"accepted_answer_id": 34928,
"favorite_count": 0,
"question_timeline_url": "/questions/34927/timeline",
"question_comments_url": "/questions/34927/comments",
"question_answers_url": "/questions/34927/answers",
"question_id": 34927,
"owner": {
"user_id": 22425,
"user_type": "registered",
"display_name": "Matthew",
"reputation": 182,
"email_hash": "8ac0a4a406e83fdf1313ca62c5771ba7"
},
"creation_date": 1367065513,
"last_activity_date": 1367070683,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 64,
"score": 2,
"community_owned": false,
"title": "Security Certificates - Tools to Generate Security Certificates",
"comments": []
},
{
"tags": [
"passwords",
"cryptography",
"hash",
"tools"
],
"answer_count": 1,
"answers": [
{
"answer_id": 34889,
"accepted": true,
"answer_comments_url": "/answers/34889/comments",
"question_id": 34864,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1366975693,
"last_activity_date": 1366975693,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 138,
"score": 3,
"community_owned": false,
"title": "How to determine hashes/second in password cryptanalysis",
"comments": [
{
"comment_id": 54224,
"creation_date": 1366982939,
"owner": {
"user_id": 21105,
"user_type": "registered",
"display_name": "Ian Muscat",
"reputation": 35,
"email_hash": "5138e39747a9730c4c4d822425517059"
},
"post_id": 34889,
"post_type": "answer",
"score": 0,
"body": "That clears it up. I thought as much - that it would be difficult to get stats out of rainbow table cracking tools. Thank you for your answer!"
}
]
}
],
"accepted_answer_id": 34889,
"favorite_count": 1,
"question_timeline_url": "/questions/34864/timeline",
"question_comments_url": "/questions/34864/comments",
"question_answers_url": "/questions/34864/answers",
"question_id": 34864,
"owner": {
"user_id": 21105,
"user_type": "registered",
"display_name": "Ian Muscat",
"reputation": 35,
"email_hash": "5138e39747a9730c4c4d822425517059"
},
"creation_date": 1366929162,
"last_edit_date": 1366933687,
"last_activity_date": 1366975693,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 138,
"score": 3,
"community_owned": false,
"title": "How to determine hashes/second in password cryptanalysis",
"comments": [
{
"comment_id": 54168,
"creation_date": 1366933377,
"owner": {
"user_id": 2568,
"user_type": "registered",
"display_name": "dr jimbob",
"reputation": 11749,
"email_hash": "2318229ef6310b03ab828bff43d2ad66"
},
"post_id": 34864,
"post_type": "question",
"score": 3,
"body": "openwall.info/wiki/john/benchmarks E.g., use the --test flag."
},
{
"comment_id": 54169,
"creation_date": 1366934228,
"owner": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"post_id": 34864,
"post_type": "question",
"score": 0,
"edit_count": 1,
"body": "You might also find this real-world example on password cracking leaked LinkedIn password hashes from Robert David Graham an interesting read."
},
{
"comment_id": 54223,
"creation_date": 1366982766,
"owner": {
"user_id": 21105,
"user_type": "registered",
"display_name": "Ian Muscat",
"reputation": 35,
"email_hash": "5138e39747a9730c4c4d822425517059"
},
"post_id": 34864,
"post_type": "question",
"score": 0,
"body": "Thank you for your answers - they are very helpful."
}
]
},
{
"tags": [
"encryption",
"cryptography",
"certificates",
"certificate-authority",
"key-exchange"
],
"answer_count": 1,
"answers": [
{
"answer_id": 34849,
"accepted": true,
"answer_comments_url": "/answers/34849/comments",
"question_id": 34847,
"owner": {
"user_id": 12217,
"user_type": "registered",
"display_name": "Sean Madden",
"reputation": 267,
"email_hash": "2fccd244dd888650399c9fcc05129fcb"
},
"creation_date": 1366911939,
"last_activity_date": 1366911939,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 102,
"score": 0,
"community_owned": false,
"title": "The request was aborted: Could not create SSL/TLS secure channel Exception",
"comments": [
{
"comment_id": 54156,
"creation_date": 1366912778,
"owner": {
"user_id": 25197,
"user_type": "registered",
"display_name": "Joe Borg",
"reputation": 40,
"email_hash": "5e0f3fa79d59da6aca7147ab96087756"
},
"post_id": 34849,
"post_type": "answer",
"score": 0,
"body": "The certificate is being located and loaded from the store. I checked by debugging the program. The problem is when the call for the web service is being made"
}
]
}
],
"accepted_answer_id": 34849,
"favorite_count": 0,
"question_timeline_url": "/questions/34847/timeline",
"question_comments_url": "/questions/34847/comments",
"question_answers_url": "/questions/34847/answers",
"question_id": 34847,
"owner": {
"user_id": 25197,
"user_type": "registered",
"display_name": "Joe Borg",
"reputation": 40,
"email_hash": "5e0f3fa79d59da6aca7147ab96087756"
},
"creation_date": 1366907997,
"last_activity_date": 1366911939,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 102,
"score": 1,
"community_owned": false,
"title": "The request was aborted: Could not create SSL/TLS secure channel Exception",
"comments": []
},
{
"tags": [
"cryptography",
"java"
],
"answer_count": 0,
"favorite_count": 0,
"closed_date": 1366828608,
"closed_reason": "off topic",
"question_timeline_url": "/questions/34790/timeline",
"question_comments_url": "/questions/34790/comments",
"question_answers_url": "/questions/34790/answers",
"question_id": 34790,
"locked_date": 1366828608,
"owner": {
"user_id": 11712,
"user_type": "registered",
"display_name": "Kishor Sharma",
"reputation": 9,
"email_hash": "a810cc8cecf3024d1dd3af6914e1e0ef"
},
"creation_date": 1366827681,
"last_activity_date": 1366827681,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 7,
"score": 0,
"community_owned": false,
"title": "Why SecureRandomSpi or other SPI (Service Provider Interface) in java security are abstract not interface?",
"comments": []
},
{
"tags": [
"encryption",
"cryptography",
"wifi"
],
"answer_count": 4,
"answers": [
{
"answer_id": 34740,
"accepted": false,
"answer_comments_url": "/answers/34740/comments",
"question_id": 34739,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"creation_date": 1366745136,
"last_edit_date": 1366748907,
"last_activity_date": 1366748907,
"up_vote_count": 6,
"down_vote_count": 0,
"view_count": 245,
"score": 6,
"community_owned": false,
"title": "Is it possible to configure any of wifi protocols so that the network is undetectable?",
"comments": []
},
{
"answer_id": 34741,
"accepted": false,
"answer_comments_url": "/answers/34741/comments",
"question_id": 34739,
"owner": {
"user_id": 24855,
"user_type": "registered",
"display_name": "Francois Valiquette",
"reputation": 184,
"email_hash": "035c292f842f63fbf994a7c43173755c"
},
"creation_date": 1366745583,
"last_edit_date": 1366746805,
"last_activity_date": 1366746805,
"up_vote_count": 4,
"down_vote_count": 0,
"view_count": 245,
"score": 4,
"community_owned": false,
"title": "Is it possible to configure any of wifi protocols so that the network is undetectable?",
"comments": [
{
"comment_id": 54005,
"creation_date": 1366745888,
"owner": {
"user_id": 15648,
"user_type": "registered",
"display_name": "d33tah",
"reputation": 277,
"email_hash": "15098b2b940cacd8b4d07026e01e3102"
},
"post_id": 34741,
"post_type": "answer",
"score": 0,
"body": "I answered your question from the first paragraph in an edit of my original post."
},
{
"comment_id": 54008,
"creation_date": 1366746845,
"owner": {
"user_id": 24855,
"user_type": "registered",
"display_name": "Francois Valiquette",
"reputation": 184,
"email_hash": "035c292f842f63fbf994a7c43173755c"
},
"reply_to_user": {
"user_id": 15648,
"user_type": "registered",
"display_name": "d33tah",
"reputation": 277,
"email_hash": "15098b2b940cacd8b4d07026e01e3102"
},
"post_id": 34741,
"post_type": "answer",
"score": 0,
"body": "I updated my answer..."
}
]
},
{
"answer_id": 34753,
"accepted": true,
"answer_comments_url": "/answers/34753/comments",
"question_id": 34739,
"owner": {
"user_id": 217,
"user_type": "registered",
"display_name": "rox0r",
"reputation": 3522,
"email_hash": "e2d4efb1b50577b5e7f6da9354a80e63"
},
"creation_date": 1366770016,
"last_activity_date": 1366770016,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 245,
"score": 3,
"community_owned": false,
"title": "Is it possible to configure any of wifi protocols so that the network is undetectable?",
"comments": []
},
{
"answer_id": 34760,
"accepted": false,
"answer_comments_url": "/answers/34760/comments",
"question_id": 34739,
"owner": {
"user_id": 13820,
"user_type": "registered",
"display_name": "Deer Hunter",
"reputation": 751,
"email_hash": "bf43cac729d5848deabbbacbf17e5e41"
},
"creation_date": 1366787611,
"last_activity_date": 1366787611,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 245,
"score": 3,
"community_owned": false,
"title": "Is it possible to configure any of wifi protocols so that the network is undetectable?",
"comments": []
}
],
"accepted_answer_id": 34753,
"favorite_count": 3,
"question_timeline_url": "/questions/34739/timeline",
"question_comments_url": "/questions/34739/comments",
"question_answers_url": "/questions/34739/answers",
"question_id": 34739,
"owner": {
"user_id": 15648,
"user_type": "registered",
"display_name": "d33tah",
"reputation": 277,
"email_hash": "15098b2b940cacd8b4d07026e01e3102"
},
"creation_date": 1366744178,
"last_edit_date": 1366745866,
"last_activity_date": 1366787611,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 245,
"score": 3,
"community_owned": false,
"title": "Is it possible to configure any of wifi protocols so that the network is undetectable?",
"comments": [
{
"comment_id": 54007,
"creation_date": 1366746702,
"owner": {
"user_id": 24855,
"user_type": "registered",
"display_name": "Francois Valiquette",
"reputation": 184,
"email_hash": "035c292f842f63fbf994a7c43173755c"
},
"post_id": 34739,
"post_type": "question",
"score": 0,
"edit_count": 1,
"body": "Even by using noise and not-noise signals a device that can listen to a range of frequencies will notice the unusual transmission signal. I am not an expert in that field, but the men made signals are probably easy to distinguish from the natural ones. Therefore, this would give suspicion to any attacker."
},
{
"comment_id": 54014,
"creation_date": 1366753108,
"owner": {
"user_id": 16235,
"user_type": "registered",
"display_name": "Johnny",
"reputation": 426,
"email_hash": "1f5076155eabfff040f6ead2cb5fc25b"
},
"post_id": 34739,
"post_type": "question",
"score": 0,
"edit_count": 1,
"body": "Imagine that your Wifi network emitted sound instead of radio waves. To someone without the decrypting receiver, the encrypted stream would sound exactly like noise -- i.e. a hissing sound. If several people in a crowded room were using that noise to communicate, you could easily find them by following the sound, even if you can't decipher what they are sending to each other."
},
{
"comment_id": 54025,
"creation_date": 1366792734,
"owner": {
"user_id": 16126,
"user_type": "registered",
"display_name": "Daniel B",
"reputation": 269,
"email_hash": "57c3668e04823e4c9f979fbadad9197c"
},
"post_id": 34739,
"post_type": "question",
"score": 0,
"edit_count": 3,
"body": "To comment on your edit - I believe that's the difference between encryption and steganography. Encryption doesn't try to hide the existence of a signal, just the data being transmitted. You are right in the sense that encrypted data should be indistinguishable from "noise", however (in order to be resiliant to various analyses), but here you're comparing apples and oranges - data being sent as part of the signal, and things that are not part of the signal at all."
}
]
},
{
"tags": [
"encryption",
"cryptography",
"known-vulnerabilities",
"threat-mitigation"
],
"answer_count": 1,
"answers": [
{
"answer_id": 34681,
"accepted": true,
"answer_comments_url": "/answers/34681/comments",
"question_id": 34676,
"owner": {
"user_id": 5400,
"user_type": "registered",
"display_name": "Polynomial",
"reputation": 32757,
"email_hash": "6fc641bdddde78a51c0db6b8527c54f7"
},
"creation_date": 1366635502,
"last_edit_date": 1366636610,
"last_activity_date": 1366636610,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 90,
"score": 3,
"community_owned": false,
"title": "Switching to new encryption method (without losing data?)",
"comments": [
{
"comment_id": 53881,
"creation_date": 1366635678,
"owner": {
"user_id": 22415,
"user_type": "registered",
"display_name": "anaximander",
"reputation": 180,
"email_hash": "1d8611cad8be99d0bd0b1026667b0f90"
},
"post_id": 34681,
"post_type": "answer",
"score": 0,
"body": "One of those cases where the solution is a little counter-intuitive. I'd feel pretty nervous sitting on data that I know isn't securely encrypted... but I guess that only becomes a problem if the bad guys can get at that data in the first place. Defence in depth, people!"
},
{
"comment_id": 53883,
"creation_date": 1366636093,
"owner": {
"user_id": 5400,
"user_type": "registered",
"display_name": "Polynomial",
"reputation": 32757,
"email_hash": "6fc641bdddde78a51c0db6b8527c54f7"
},
"reply_to_user": {
"user_id": 22415,
"user_type": "registered",
"display_name": "anaximander",
"reputation": 180,
"email_hash": "1d8611cad8be99d0bd0b1026667b0f90"
},
"post_id": 34681,
"post_type": "answer",
"score": 0,
"body": "@anaximander Yup. Though you could double-hash or double-encrypt as a temporary measure and then migrate after a login."
},
{
"comment_id": 53884,
"creation_date": 1366636131,
"owner": {
"user_id": 5400,
"user_type": "registered",
"display_name": "Polynomial",
"reputation": 32757,
"email_hash": "6fc641bdddde78a51c0db6b8527c54f7"
},
"reply_to_user": {
"user_id": 22415,
"user_type": "registered",
"display_name": "anaximander",
"reputation": 180,
"email_hash": "1d8611cad8be99d0bd0b1026667b0f90"
},
"post_id": 34681,
"post_type": "answer",
"score": 0,
"body": "@anaximander Also, are you the same Anax from xkcd-pub? if so, hi! :)"
},
{
"comment_id": 53887,
"creation_date": 1366637346,
"owner": {
"user_id": 22415,
"user_type": "registered",
"display_name": "anaximander",
"reputation": 180,
"email_hash": "1d8611cad8be99d0bd0b1026667b0f90"
},
"post_id": 34681,
"post_type": "answer",
"score": 1,
"body": "I am indeed. Hi!"
}
]
}
],
"accepted_answer_id": 34681,
"favorite_count": 0,
"question_timeline_url": "/questions/34676/timeline",
"question_comments_url": "/questions/34676/comments",
"question_answers_url": "/questions/34676/answers",
"question_id": 34676,
"owner": {
"user_id": 22415,
"user_type": "registered",
"display_name": "anaximander",
"reputation": 180,
"email_hash": "1d8611cad8be99d0bd0b1026667b0f90"
},
"creation_date": 1366630692,
"last_edit_date": 1366632455,
"last_activity_date": 1366636610,
"up_vote_count": 4,
"down_vote_count": 0,
"view_count": 90,
"score": 4,
"community_owned": false,
"title": "Switching to new encryption method (without losing data?)",
"comments": []
},
{
"tags": [
"encryption",
"ssl",
"cryptography",
"hmac",
"asymmetric"
],
"answer_count": 3,
"answers": [
{
"answer_id": 34227,
"accepted": false,
"answer_comments_url": "/answers/34227/comments",
"question_id": 34217,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1365764556,
"last_activity_date": 1365764556,
"up_vote_count": 6,
"down_vote_count": 0,
"view_count": 99,
"score": 6,
"community_owned": false,
"title": "What SSL options should not be used?",
"comments": []
},
{
"answer_id": 34230,
"accepted": false,
"answer_comments_url": "/answers/34230/comments",
"question_id": 34217,
"owner": {
"user_id": 6862,
"user_type": "registered",
"display_name": "Novice User",
"reputation": 396,
"email_hash": "1014ba58176f5e095219c3447f85285c"
},
"creation_date": 1365766008,
"last_activity_date": 1365766008,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 99,
"score": 2,
"community_owned": false,
"title": "What SSL options should not be used?",
"comments": []
},
{
"answer_id": 34220,
"accepted": false,
"answer_comments_url": "/answers/34220/comments",
"question_id": 34217,
"owner": {
"user_id": 20822,
"user_type": "registered",
"display_name": "Hennes",
"reputation": 146,
"email_hash": "7a5f112a5f894a1bbe29f4d87c2de8d1"
},
"creation_date": 1365760586,
"last_activity_date": 1365760586,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 99,
"score": 0,
"community_owned": false,
"title": "What SSL options should not be used?",
"comments": []
}
],
"favorite_count": 1,
"question_timeline_url": "/questions/34217/timeline",
"question_comments_url": "/questions/34217/comments",
"question_answers_url": "/questions/34217/answers",
"question_id": 34217,
"owner": {
"user_id": 24508,
"user_type": "registered",
"display_name": "sybind",
"reputation": 156,
"email_hash": "59fc5327303a91f0c075353c98375422"
},
"creation_date": 1365759938,
"last_activity_date": 1365766008,
"up_vote_count": 4,
"down_vote_count": 0,
"view_count": 99,
"score": 4,
"community_owned": false,
"title": "What SSL options should not be used?",
"comments": []
},
{
"tags": [
"cryptography",
"professional-education"
],
"answer_count": 1,
"answers": [
{
"answer_id": 34164,
"accepted": true,
"answer_comments_url": "/answers/34164/comments",
"question_id": 34163,
"owner": {
"user_id": 5411,
"user_type": "registered",
"display_name": "Tom Leek",
"reputation": 24996,
"email_hash": "e2e94675a01dd4477eef7750db006817"
},
"creation_date": 1365718858,
"last_activity_date": 1365718858,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 96,
"score": 3,
"community_owned": false,
"title": "Cryptography Online Education",
"comments": [
{
"comment_id": 53162,
"creation_date": 1365720084,
"owner": {
"user_id": 2210,
"user_type": "registered",
"display_name": "Andrew Russell",
"reputation": 1394,
"email_hash": "74462caba83604f6556bdc906360395b"
},
"post_id": 34164,
"post_type": "answer",
"score": 0,
"body": "I enjoyed the beginning of Cryptography I, but had to drop out because of work work work. It was challenging and interesting."
}
]
}
],
"accepted_answer_id": 34164,
"favorite_count": 0,
"question_timeline_url": "/questions/34163/timeline",
"question_comments_url": "/questions/34163/comments",
"question_answers_url": "/questions/34163/answers",
"question_id": 34163,
"owner": {
"user_id": 21882,
"user_type": "registered",
"display_name": "nitrl",
"reputation": 139,
"email_hash": "f520072cfd2bf3b804ec999b81376b79"
},
"creation_date": 1365717193,
"last_activity_date": 1365718858,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 96,
"score": 2,
"community_owned": false,
"title": "Cryptography Online Education",
"comments": [
{
"comment_id": 53160,
"creation_date": 1365718829,
"owner": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 34163,
"post_type": "question",
"score": 1,
"body": "I've heard a lot of praise for the coursera crypto course."
}
]
},
{
"tags": [
"cryptography"
],
"answer_count": 1,
"answers": [
{
"answer_id": 33715,
"accepted": true,
"answer_comments_url": "/answers/33715/comments",
"question_id": 33712,
"owner": {
"user_id": 5400,
"user_type": "registered",
"display_name": "Polynomial",
"reputation": 32757,
"email_hash": "6fc641bdddde78a51c0db6b8527c54f7"
},
"creation_date": 1365028857,
"last_edit_date": 1365030069,
"last_activity_date": 1365030069,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 74,
"score": 3,
"community_owned": false,
"title": "3DES with fixed-encoded random key",
"comments": []
}
],
"accepted_answer_id": 33715,
"favorite_count": 0,
"question_timeline_url": "/questions/33712/timeline",
"question_comments_url": "/questions/33712/comments",
"question_answers_url": "/questions/33712/answers",
"question_id": 33712,
"owner": {
"user_id": 24256,
"user_type": "registered",
"display_name": "kappa",
"reputation": 18,
"email_hash": "3047dcb2fd22e91f13999fa1a8e5f27b"
},
"creation_date": 1365027898,
"last_activity_date": 1365030069,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 74,
"score": 3,
"community_owned": false,
"title": "3DES with fixed-encoded random key",
"comments": []
},
{
"tags": [
"encryption",
"cryptography"
],
"answer_count": 4,
"answers": [
{
"answer_id": 33576,
"accepted": true,
"answer_comments_url": "/answers/33576/comments",
"question_id": 33569,
"owner": {
"user_id": 5400,
"user_type": "registered",
"display_name": "Polynomial",
"reputation": 32757,
"email_hash": "6fc641bdddde78a51c0db6b8527c54f7"
},
"creation_date": 1364845561,
"last_edit_date": 1364847650,
"last_activity_date": 1364847650,
"up_vote_count": 5,
"down_vote_count": 0,
"view_count": 164,
"score": 5,
"community_owned": false,
"title": "Why do you need message authentication in addition to encryption?",
"comments": [
{
"comment_id": 52248,
"creation_date": 1364870111,
"owner": {
"user_id": 2000,
"user_type": "registered",
"display_name": "Rein Henrichs",
"reputation": 141,
"email_hash": "f30b04ed4d0b3fc4bc791a28815f34ca"
},
"post_id": 33576,
"post_type": "answer",
"score": 0,
"edit_count": 2,
"body": "There are actually four primary properties. The fourth is availability. It doesn't matter how well you do on the other three pillars if an attacker can take your service down at will so no one can use it. Excellent answer though!"
},
{
"comment_id": 52276,
"creation_date": 1364901462,
"owner": {
"user_id": 24133,
"user_type": "registered",
"display_name": "Jonathan",
"reputation": 123,
"email_hash": "86f4d2be79a5afea95717f2fd26fe658"
},
"post_id": 33576,
"post_type": "answer",
"score": 0,
"body": "Thank-you for the incredibly detailed response. In my particular use case, the data is not particularly sensitive, so an HMAC to verify authenticity (integrity?) is likely sufficient. This is great information though."
}
]
},
{
"answer_id": 33570,
"accepted": false,
"answer_comments_url": "/answers/33570/comments",
"question_id": 33569,
"owner": {
"user_id": 13159,
"user_type": "registered",
"display_name": "jwernerny",
"reputation": 101,
"email_hash": "1ffdc5279fd70540799b762c14e66665"
},
"creation_date": 1364823923,
"last_activity_date": 1364823923,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 164,
"score": 0,
"community_owned": false,
"title": "Why do you need message authentication in addition to encryption?",
"comments": [
{
"comment_id": 52213,
"creation_date": 1364824488,
"post_id": 33570,
"post_type": "answer",
"score": 2,
"body": "That's a different kind of authentication."
},
{
"comment_id": 52214,
"creation_date": 1364835476,
"owner": {
"user_id": 6858,
"user_type": "registered",
"display_name": "Donal Fellows",
"reputation": 101,
"email_hash": "965220a70d38e6a29466f44cdb4f804e"
},
"post_id": 33570,
"post_type": "answer",
"score": 1,
"body": "The authentication is what allows you to know for sure that you are talking about your account to your bank, and not actually to some random cybercriminal. You might want to know that sort of thing…"
}
]
},
{
"answer_id": 33571,
"accepted": false,
"answer_comments_url": "/answers/33571/comments",
"question_id": 33569,
"creation_date": 1364826645,
"last_activity_date": 1364826645,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 164,
"score": 0,
"community_owned": false,
"title": "Why do you need message authentication in addition to encryption?",
"comments": []
},
{
"answer_id": 33574,
"accepted": false,
"answer_comments_url": "/answers/33574/comments",
"question_id": 33569,
"owner": {
"user_id": 24000,
"user_type": "registered",
"display_name": "Lehrling",
"reputation": 13,
"email_hash": "aca5a7eeb275b6f4b3885a54f01b90f2"
},
"creation_date": 1364844111,
"last_activity_date": 1364844111,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 164,
"score": 0,
"community_owned": false,
"title": "Why do you need message authentication in addition to encryption?",
"comments": []
}
],
"accepted_answer_id": 33576,
"favorite_count": 0,
"question_timeline_url": "/questions/33569/timeline",
"question_comments_url": "/questions/33569/comments",
"question_answers_url": "/questions/33569/answers",
"question_id": 33569,
"owner": {
"user_id": 24133,
"user_type": "registered",
"display_name": "Jonathan",
"reputation": 123,
"email_hash": "86f4d2be79a5afea95717f2fd26fe658"
},
"creation_date": 1364821463,
"last_activity_date": 1364847650,
"up_vote_count": 4,
"down_vote_count": 0,
"view_count": 164,
"score": 4,
"community_owned": false,
"title": "Why do you need message authentication in addition to encryption?",
"comments": [
{
"comment_id": 52212,
"creation_date": 1364826404,
"owner": {
"user_id": 2901,
"user_type": "registered",
"display_name": "Peter Smith",
"reputation": 215,
"email_hash": "7071943b065c93c44fc3d065b2752fb0"
},
"post_id": 33569,
"post_type": "question",
"score": 3,
"body": "If I remember my cryptography correctly, encryption without authentication does not protect communications from a replay attack."
}
]
},
{
"tags": [
"cryptography",
"windows",
"hash",
"brute-force",
"md5"
],
"answer_count": 2,
"answers": [
{
"answer_id": 33483,
"accepted": false,
"answer_comments_url": "/answers/33483/comments",
"question_id": 33479,
"owner": {
"user_id": 971,
"user_type": "registered",
"display_name": "D.W.",
"reputation": 44861,
"email_hash": "6dd038614af7e490e8baf53483637999"
},
"creation_date": 1364705643,
"last_activity_date": 1364705643,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 100,
"score": 2,
"community_owned": false,
"title": "NTLMv2 resistance to bruteforcing",
"comments": []
},
{
"answer_id": 33500,
"accepted": false,
"answer_comments_url": "/answers/33500/comments",
"question_id": 33479,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1364733228,
"last_activity_date": 1364733228,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 100,
"score": 2,
"community_owned": false,
"title": "NTLMv2 resistance to bruteforcing",
"comments": []
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/33479/timeline",
"question_comments_url": "/questions/33479/comments",
"question_answers_url": "/questions/33479/answers",
"question_id": 33479,
"owner": {
"user_id": 23817,
"user_type": "unregistered",
"display_name": "w2323",
"reputation": 26,
"email_hash": "515966314f6cad81c72a9c2c980b5636"
},
"creation_date": 1364689237,
"last_edit_date": 1364693269,
"last_activity_date": 1364733228,
"up_vote_count": 5,
"down_vote_count": 0,
"view_count": 100,
"score": 5,
"community_owned": false,
"title": "NTLMv2 resistance to bruteforcing",
"comments": []
},
{
"tags": [
"encryption",
"cryptography",
"aes",
".net",
"rsa"
],
"answer_count": 2,
"answers": [
{
"answer_id": 33373,
"accepted": false,
"answer_comments_url": "/answers/33373/comments",
"question_id": 33365,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"creation_date": 1364561885,
"last_edit_date": 1364773938,
"last_activity_date": 1364773938,
"up_vote_count": 2,
"down_vote_count": 1,
"view_count": 223,
"score": 1,
"community_owned": false,
"title": "Questions to hybrid encryption. RSA with AES",
"comments": [
{
"comment_id": 51916,
"creation_date": 1364562596,
"owner": {
"user_id": 1593,
"user_type": "registered",
"display_name": "jbtule",
"reputation": 140,
"email_hash": "ec2aae51f1bd526a20c04158ba5c7b62"
},
"post_id": 33373,
"post_type": "answer",
"score": 1,
"body": "SignHash signs a precomputed hash, SignData computes the hash and signs it."
},
{
"comment_id": 52144,
"creation_date": 1364773406,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 1593,
"user_type": "registered",
"display_name": "jbtule",
"reputation": 140,
"email_hash": "ec2aae51f1bd526a20c04158ba5c7b62"
},
"post_id": 33373,
"post_type": "answer",
"score": 0,
"body": "@jbtule - thanks for the info. I have updated my answer accordingly."
}
]
},
{
"answer_id": 33379,
"accepted": false,
"answer_comments_url": "/answers/33379/comments",
"question_id": 33365,
"owner": {
"user_id": 1593,
"user_type": "registered",
"display_name": "jbtule",
"reputation": 140,
"email_hash": "ec2aae51f1bd526a20c04158ba5c7b62"
},
"creation_date": 1364567606,
"last_edit_date": 1364573945,
"last_activity_date": 1364573945,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 223,
"score": 1,
"community_owned": false,
"title": "Questions to hybrid encryption. RSA with AES",
"comments": [
{
"comment_id": 51932,
"creation_date": 1364572449,
"owner": {
"user_id": 23761,
"user_type": "registered",
"display_name": "user2104146",
"reputation": 9,
"email_hash": "a22983ccbe772f3fda6feeaa05df7c99"
},
"post_id": 33379,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "Thx for your effort! \n1) "so if I magically get the key, but not the IV, I can decrypt everything except the first block of data." Yes, but everything depends on the first block (IV) so you are not able to decrypt any block. \n2) So I create a Secret HMAC Key saved it encrypted with each RSA key und create a Hash with this Secret HMAC Key and stored it in ContentMAC? \n3) Of course could I choose a highlevel libary, but my intention is to build a own crypto framwork for learning purpose."
},
{
"comment_id": 51935,
"creation_date": 1364572738,
"owner": {
"user_id": 23761,
"user_type": "registered",
"display_name": "user2104146",
"reputation": 9,
"email_hash": "a22983ccbe772f3fda6feeaa05df7c99"
},
"post_id": 33379,
"post_type": "answer",
"score": 0,
"body": "4) I undestand that a hashed plantext could leak data. But what is wrong to derived a Fingerprint (Hash) from a public rsa key?"
},
{
"comment_id": 51949,
"creation_date": 1364573868,
"owner": {
"user_id": 1593,
"user_type": "registered",
"display_name": "jbtule",
"reputation": 140,
"email_hash": "ec2aae51f1bd526a20c04158ba5c7b62"
},
"reply_to_user": {
"user_id": 23761,
"user_type": "registered",
"display_name": "user2104146",
"reputation": 9,
"email_hash": "a22983ccbe772f3fda6feeaa05df7c99"
},
"post_id": 33379,
"post_type": "answer",
"score": 2,
"body": "@user2104146, 1) That is incorrect, each block only depends on the immediate previous block only. 2) Yes 3) your question states "I want to use a hybrid encryption in my application" and if your goal is learning I suggest Cryptography I. 4) It's not about really as much about hashing the plaintext leaking the data, it's about later when verifying before acting on the plaintext, which thanks to padding that's easiest if you sign the ciphertext. There is nothing wrong with a sha1 fingerprint of the public key, plus it's the public key."
}
]
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/33365/timeline",
"question_comments_url": "/questions/33365/comments",
"question_answers_url": "/questions/33365/answers",
"question_id": 33365,
"owner": {
"user_id": 23761,
"user_type": "registered",
"display_name": "user2104146",
"reputation": 9,
"email_hash": "a22983ccbe772f3fda6feeaa05df7c99"
},
"creation_date": 1364554677,
"last_activity_date": 1364773938,
"up_vote_count": 2,
"down_vote_count": 1,
"view_count": 223,
"score": 1,
"community_owned": false,
"title": "Questions to hybrid encryption. RSA with AES",
"comments": [
{
"comment_id": 51904,
"creation_date": 1364556800,
"owner": {
"user_id": 13820,
"user_type": "registered",
"display_name": "Deer Hunter",
"reputation": 751,
"email_hash": "bf43cac729d5848deabbbacbf17e5e41"
},
"post_id": 33365,
"post_type": "question",
"score": 1,
"body": "Question: Is this approach reasonable? No, it isn't. You are putting blind trust into advice from strangers, AND rolling your own encryption scheme. This is doubly fraught with danger."
},
{
"comment_id": 51911,
"creation_date": 1364561933,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 13820,
"user_type": "registered",
"display_name": "Deer Hunter",
"reputation": 751,
"email_hash": "bf43cac729d5848deabbbacbf17e5e41"
},
"post_id": 33365,
"post_type": "question",
"score": 2,
"body": "@DeerHunter - it isn't really roll your own since he's using established algorithms. You don't want to roll your own algorithms. Using your own arrangement of algorithms is a fairly common and healthy practice as long as you understand what each algorithm provides."
},
{
"comment_id": 51914,
"creation_date": 1364562495,
"owner": {
"user_id": 1593,
"user_type": "registered",
"display_name": "jbtule",
"reputation": 140,
"email_hash": "ec2aae51f1bd526a20c04158ba5c7b62"
},
"reply_to_user": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"post_id": 33365,
"post_type": "question",
"score": 0,
"body": "@AJHenderson because of the prevalence of side channel attacks, and the prevalance of usage mistakes, just using established algorithms is still rolling your own, but granted there are only a few high level opensource alternatives. gpgme, nacl, and keyczar."
},
{
"comment_id": 51917,
"creation_date": 1364562722,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 1593,
"user_type": "registered",
"display_name": "jbtule",
"reputation": 140,
"email_hash": "ec2aae51f1bd526a20c04158ba5c7b62"
},
"post_id": 33365,
"post_type": "question",
"score": 0,
"body": "@Jbtule - The reason to not roll your own is because cryptography is hard and relies on large amounts of review to understand limitations. Knowing those limitations and understanding what they mean to a cryptosystem (while still a challenge) is doable and perfectly fine to design your own system to meet your needs. You won't find an out of the box system for every set of needs that comes up in security. The problem is the difficulty in finding weaknesses to the actual encryption mechanisms themselves."
},
{
"comment_id": 51920,
"creation_date": 1364564071,
"owner": {
"user_id": 1593,
"user_type": "registered",
"display_name": "jbtule",
"reputation": 140,
"email_hash": "ec2aae51f1bd526a20c04158ba5c7b62"
},
"post_id": 33365,
"post_type": "question",
"score": 0,
"body": "Like I said granted there are few alternatives, in most cases you have to roll your own usage there's no other option, but the encryption primatives themselves aren't generally exploited these days, it's the usage, padding, verification timing, predictable random numbers, impromper IV uses, improper modes, improper keys, the above code doesn't even include the decryption/verification which is much more perilous for mistakes. The definition for roll your own these days isn't implementing AES or RSA, no one does that, libraries are plentiful, it's implementing the usage of AES or RSA."
},
{
"comment_id": 52145,
"creation_date": 1364773725,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 1593,
"user_type": "registered",
"display_name": "jbtule",
"reputation": 140,
"email_hash": "ec2aae51f1bd526a20c04158ba5c7b62"
},
"post_id": 33365,
"post_type": "question",
"score": 0,
"body": "@Jbtule - most of what you described is properties of usage of an algorithm, not the use of algorithms together. Key generation should be done by a package that is doing the algorithmic work for that algorithm and I agree you don't want to roll your own there. Padding (depending on library) and modes are really the only two things that are not typically done by a particular implementation of a cryptographic library. Modes is easily understandable even if it is a frequent source of error. I would agree you shouldn't do your own keygen or PRNG."
}
]
},
{
"tags": [
"cryptography",
"rsa"
],
"answer_count": 1,
"answers": [
{
"answer_id": 33377,
"accepted": false,
"answer_comments_url": "/answers/33377/comments",
"question_id": 33356,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1364564719,
"last_activity_date": 1364564719,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 114,
"score": 3,
"community_owned": false,
"title": "zero knowledge proof - where do we use it?",
"comments": []
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/33356/timeline",
"question_comments_url": "/questions/33356/comments",
"question_answers_url": "/questions/33356/answers",
"question_id": 33356,
"owner": {
"user_id": 6350,
"user_type": "registered",
"display_name": "0x90",
"reputation": 294,
"email_hash": "e324bec4fb270eecb27edc1ea2c270eb"
},
"creation_date": 1364534768,
"last_activity_date": 1364564719,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 114,
"score": 2,
"community_owned": false,
"title": "zero knowledge proof - where do we use it?",
"comments": []
},
{
"tags": [
"cryptography",
"key-exchange"
],
"answer_count": 1,
"answers": [
{
"answer_id": 33240,
"accepted": true,
"answer_comments_url": "/answers/33240/comments",
"question_id": 33233,
"owner": {
"user_id": 5411,
"user_type": "registered",
"display_name": "Tom Leek",
"reputation": 24996,
"email_hash": "e2e94675a01dd4477eef7750db006817"
},
"creation_date": 1364316453,
"last_activity_date": 1364316453,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 54,
"score": 2,
"community_owned": false,
"title": "ECDH and Forward Secrecy",
"comments": []
}
],
"accepted_answer_id": 33240,
"favorite_count": 0,
"question_timeline_url": "/questions/33233/timeline",
"question_comments_url": "/questions/33233/comments",
"question_answers_url": "/questions/33233/answers",
"question_id": 33233,
"owner": {
"user_id": 16759,
"user_type": "registered",
"display_name": "cooky451",
"reputation": 108,
"email_hash": "3746f9014e2ba9e5f349379709c3e438"
},
"creation_date": 1364310915,
"last_edit_date": 1364311696,
"last_activity_date": 1364316453,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 54,
"score": 1,
"community_owned": false,
"title": "ECDH and Forward Secrecy",
"comments": []
},
{
"tags": [
"encryption",
"cryptography"
],
"answer_count": 1,
"answers": [
{
"answer_id": 33254,
"accepted": false,
"answer_comments_url": "/answers/33254/comments",
"question_id": 33232,
"owner": {
"user_id": 22672,
"user_type": "registered",
"display_name": "Claude",
"reputation": 111,
"email_hash": "66e9fe7a3824e4c55acc74001c5c91e9"
},
"creation_date": 1364333398,
"last_activity_date": 1364333398,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 107,
"score": 1,
"community_owned": false,
"title": "Symmetric or asymmetric encryption for JSON Web Token?",
"comments": []
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/33232/timeline",
"question_comments_url": "/questions/33232/comments",
"question_answers_url": "/questions/33232/answers",
"question_id": 33232,
"owner": {
"user_id": 22657,
"user_type": "registered",
"display_name": "Greg Beech",
"reputation": 106,
"email_hash": "97ce1d8fe9e0abc0e1c5cd3861f0b339"
},
"creation_date": 1364310618,
"last_edit_date": 1364314238,
"last_activity_date": 1364333398,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 107,
"score": 1,
"community_owned": false,
"title": "Symmetric or asymmetric encryption for JSON Web Token?",
"comments": []
},
{
"tags": [
"cryptography",
"brute-force",
"cryptanalysis"
],
"answer_count": 2,
"answers": [
{
"answer_id": 33206,
"accepted": true,
"answer_comments_url": "/answers/33206/comments",
"question_id": 33205,
"owner": {
"user_id": 18535,
"user_type": "registered",
"display_name": "BrianAdkins",
"reputation": 930,
"email_hash": "f4b6745d16374ef69897f03ddebfac8a"
},
"creation_date": 1364261461,
"last_activity_date": 1364261461,
"up_vote_count": 6,
"down_vote_count": 0,
"view_count": 139,
"score": 6,
"community_owned": false,
"title": "How can i calculate the number of possible passwords?",
"comments": [
{
"comment_id": 51607,
"creation_date": 1364264368,
"owner": {
"user_id": 12407,
"user_type": "registered",
"display_name": "Stephen Touset",
"reputation": 1139,
"email_hash": "9ff064364151151cbce108b869e6e62d"
},
"post_id": 33206,
"post_type": "answer",
"score": 1,
"body": "Which, just to clarify, is a pitifully small pool of potential passwords."
},
{
"comment_id": 51608,
"creation_date": 1364264952,
"owner": {
"user_id": 18535,
"user_type": "registered",
"display_name": "BrianAdkins",
"reputation": 930,
"email_hash": "f4b6745d16374ef69897f03ddebfac8a"
},
"reply_to_user": {
"user_id": 12407,
"user_type": "registered",
"display_name": "Stephen Touset",
"reputation": 1139,
"email_hash": "9ff064364151151cbce108b869e6e62d"
},
"post_id": 33206,
"post_type": "answer",
"score": 0,
"body": "Yes... Wasn't trying to convey that this number is sufficient... Only to show how to derive the answer."
},
{
"comment_id": 51609,
"creation_date": 1364265056,
"owner": {
"user_id": 12407,
"user_type": "registered",
"display_name": "Stephen Touset",
"reputation": 1139,
"email_hash": "9ff064364151151cbce108b869e6e62d"
},
"post_id": 33206,
"post_type": "answer",
"score": 0,
"body": "No worries. Just thought it warranted explicit mention."
}
]
},
{
"answer_id": 33228,
"accepted": false,
"answer_comments_url": "/answers/33228/comments",
"question_id": 33205,
"owner": {
"user_id": 11306,
"user_type": "registered",
"display_name": "ponsfonze",
"reputation": 810,
"email_hash": "b5774b7300c55109439646c575eac450"
},
"creation_date": 1364308027,
"last_activity_date": 1364308027,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 139,
"score": 2,
"community_owned": false,
"title": "How can i calculate the number of possible passwords?",
"comments": []
}
],
"accepted_answer_id": 33206,
"favorite_count": 0,
"question_timeline_url": "/questions/33205/timeline",
"question_comments_url": "/questions/33205/comments",
"question_answers_url": "/questions/33205/answers",
"question_id": 33205,
"owner": {
"user_id": 18541,
"user_type": "registered",
"display_name": "D3C4FF",
"reputation": 3127,
"email_hash": "b376fbe6933daa281c17c4eb4720461f"
},
"creation_date": 1364259999,
"last_activity_date": 1364308027,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 139,
"score": 1,
"community_owned": false,
"title": "How can i calculate the number of possible passwords?",
"comments": [
{
"comment_id": 51606,
"creation_date": 1364260495,
"owner": {
"user_id": 18541,
"user_type": "registered",
"display_name": "D3C4FF",
"reputation": 3127,
"email_hash": "b376fbe6933daa281c17c4eb4720461f"
},
"post_id": 33205,
"post_type": "question",
"score": 2,
"body": "I think it turns out being 456,976,000 passwords \nvs 3,521,614,606,208 (for 7 chars)?"
}
]
},
{
"tags": [
"cryptography",
"hash",
"entropy"
],
"answer_count": 3,
"answers": [
{
"answer_id": 33203,
"accepted": true,
"answer_comments_url": "/answers/33203/comments",
"question_id": 33196,
"owner": {
"user_id": 5411,
"user_type": "registered",
"display_name": "Tom Leek",
"reputation": 24996,
"email_hash": "e2e94675a01dd4477eef7750db006817"
},
"creation_date": 1364258438,
"last_activity_date": 1364258438,
"up_vote_count": 9,
"down_vote_count": 0,
"view_count": 284,
"score": 9,
"community_owned": false,
"title": "Is there a length beyond which increasing password length provides no additional security?",
"comments": []
},
{
"answer_id": 33309,
"accepted": false,
"answer_comments_url": "/answers/33309/comments",
"question_id": 33196,
"owner": {
"user_id": 22427,
"user_type": "registered",
"display_name": "Nick",
"reputation": 141,
"email_hash": "d627b3d40e6486c4156e4174908b345e"
},
"creation_date": 1364423275,
"last_activity_date": 1364423275,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 284,
"score": 2,
"community_owned": false,
"title": "Is there a length beyond which increasing password length provides no additional security?",
"comments": []
},
{
"answer_id": 33199,
"accepted": false,
"answer_comments_url": "/answers/33199/comments",
"question_id": 33196,
"owner": {
"user_id": 22632,
"user_type": "registered",
"display_name": "Ryoku",
"reputation": 1,
"email_hash": "750d84a45296a94feaae8d579d1a84db"
},
"creation_date": 1364255879,
"last_edit_date": 1364405616,
"last_activity_date": 1364405616,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 284,
"score": 0,
"community_owned": false,
"title": "Is there a length beyond which increasing password length provides no additional security?",
"comments": [
{
"comment_id": 51602,
"creation_date": 1364256796,
"owner": {
"user_id": 5411,
"user_type": "registered",
"display_name": "Tom Leek",
"reputation": 24996,
"email_hash": "e2e94675a01dd4477eef7750db006817"
},
"post_id": 33199,
"post_type": "answer",
"score": 2,
"body": "Collisions on hash functions have nothing whatsoever to do with password security. When passwords are hashed, they rely on preimage resistance, which is something completely different."
}
]
}
],
"accepted_answer_id": 33203,
"favorite_count": 1,
"question_timeline_url": "/questions/33196/timeline",
"question_comments_url": "/questions/33196/comments",
"question_answers_url": "/questions/33196/answers",
"question_id": 33196,
"owner": {
"user_id": 22630,
"user_type": "registered",
"display_name": "Peter",
"reputation": 33,
"email_hash": "60473f9297141f4438683a35c88475e5"
},
"creation_date": 1364253492,
"last_edit_date": 1364434812,
"last_activity_date": 1364434812,
"up_vote_count": 6,
"down_vote_count": 0,
"view_count": 284,
"score": 6,
"community_owned": false,
"title": "Is there a length beyond which increasing password length provides no additional security?",
"comments": []
},
{
"tags": [
"cryptography",
"passwords",
"hash"
],
"answer_count": 1,
"answers": [
{
"answer_id": 33174,
"accepted": false,
"answer_comments_url": "/answers/33174/comments",
"question_id": 33172,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1364232743,
"last_activity_date": 1364232743,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 39,
"score": 1,
"community_owned": false,
"title": "Parameters in output of password hashing function",
"comments": []
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/33172/timeline",
"question_comments_url": "/questions/33172/comments",
"question_answers_url": "/questions/33172/answers",
"question_id": 33172,
"owner": {
"user_id": 22415,
"user_type": "registered",
"display_name": "anaximander",
"reputation": 180,
"email_hash": "1d8611cad8be99d0bd0b1026667b0f90"
},
"creation_date": 1364231783,
"last_activity_date": 1364232743,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 39,
"score": 1,
"community_owned": false,
"title": "Parameters in output of password hashing function",
"comments": [
{
"comment_id": 51568,
"creation_date": 1364232786,
"owner": {
"user_id": 9377,
"user_type": "registered",
"display_name": "lynks",
"reputation": 4352,
"email_hash": "9a21812b9a1037044c110bc3c8948627"
},
"post_id": 33172,
"post_type": "question",
"score": 0,
"body": "While it might be intuitive that less information is more secure, these parameters have nothing to do with the security of the encryption and hiding them will only serve to give a false sense of protection, or worse divert attention away from hiding the important stuff - the passwords/keys."
},
{
"comment_id": 51579,
"creation_date": 1364239706,
"owner": {
"user_id": 22415,
"user_type": "registered",
"display_name": "anaximander",
"reputation": 180,
"email_hash": "1d8611cad8be99d0bd0b1026667b0f90"
},
"reply_to_user": {
"user_id": 9377,
"user_type": "registered",
"display_name": "lynks",
"reputation": 4352,
"email_hash": "9a21812b9a1037044c110bc3c8948627"
},
"post_id": 33172,
"post_type": "question",
"score": 0,
"edit_count": 1,
"body": "My reasoning is that for a given algorithm the attacker has to hash possible passwords and compare them to the hash. If the attacker doesn't know the settings used to generate the hash, then they have to try each password multiple times to cover the various possible combinations of settings (where they can't be deduced from the hash). If they don't know the algorithm used, then they have to try each password even more times, for each algorithm it might be (assuming the output isn't recognisably from one algorithm). Of course I won't be any less careful with the actual keys; this is just extra."
}
]
},
{
"tags": [
"cryptography",
"passwords",
"hash",
"brute-force",
"cracking"
],
"answer_count": 2,
"answers": [
{
"answer_id": 32818,
"accepted": false,
"answer_comments_url": "/answers/32818/comments",
"question_id": 32816,
"owner": {
"user_id": 10211,
"user_type": "registered",
"display_name": "Terry Chia",
"reputation": 11070,
"email_hash": "b62ccba5dd465e468c77c495dd67b737"
},
"creation_date": 1363659819,
"last_edit_date": 1363681839,
"last_activity_date": 1363681839,
"up_vote_count": 10,
"down_vote_count": 0,
"view_count": 1031,
"score": 10,
"community_owned": false,
"title": "Why are GPUs so good at cracking passwords?",
"comments": [
{
"comment_id": 50985,
"creation_date": 1363679759,
"owner": {
"user_id": 4722,
"user_type": "registered",
"display_name": "Nick",
"reputation": 153,
"email_hash": "a05d3e8999133f4c09b24f7df10bc10e"
},
"post_id": 32818,
"post_type": "answer",
"score": 0,
"body": "Cool; I had no idea GPUs had so many cores!"
},
{
"comment_id": 50990,
"creation_date": 1363681757,
"owner": {
"user_id": 5400,
"user_type": "registered",
"display_name": "Polynomial",
"reputation": 32757,
"email_hash": "6fc641bdddde78a51c0db6b8527c54f7"
},
"post_id": 32818,
"post_type": "answer",
"score": 1,
"body": "A GPU tends not to have thousands of cores, but hundreds is accurate."
},
{
"comment_id": 51014,
"creation_date": 1363697915,
"owner": {
"user_id": 9377,
"user_type": "registered",
"display_name": "lynks",
"reputation": 4352,
"email_hash": "9a21812b9a1037044c110bc3c8948627"
},
"reply_to_user": {
"user_id": 5400,
"user_type": "registered",
"display_name": "Polynomial",
"reputation": 32757,
"email_hash": "6fc641bdddde78a51c0db6b8527c54f7"
},
"post_id": 32818,
"post_type": "answer",
"score": 1,
"body": "@Polynomial so 'stream processors' != 'GPU cores'? Because my card has almost 3,000 of those."
},
{
"comment_id": 51065,
"creation_date": 1363724791,
"owner": {
"user_id": 5400,
"user_type": "registered",
"display_name": "Polynomial",
"reputation": 32757,
"email_hash": "6fc641bdddde78a51c0db6b8527c54f7"
},
"reply_to_user": {
"user_id": 9377,
"user_type": "registered",
"display_name": "lynks",
"reputation": 4352,
"email_hash": "9a21812b9a1037044c110bc3c8948627"
},
"post_id": 32818,
"post_type": "answer",
"score": 0,
"body": "@lynks It's difficult to directly correlate between the idea of GPU internals and traditional cores, but you could describe each stream processor as a core. I'll admit I didn't realise modern GPUs had so many stream processors though. The main difference is that GPU cores tend to operate in blocks in order to perform a particular task, with certain special bus types joining them together, whereas CPU cores are practically independent."
},
{
"comment_id": 51668,
"creation_date": 1364328715,
"owner": {
"user_id": 15577,
"user_type": "registered",
"display_name": "k1DBLITZ",
"reputation": 346,
"email_hash": "d13b38cbdbba62bb89f2938373250245"
},
"post_id": 32818,
"post_type": "answer",
"score": 0,
"body": "They are defined as cores: cdn3.wccftech.com/wp-content/uploads/2013/02/… From a pure processing power perspective, the Titan is 14.2 times faster than the current fastest equivalent costing CPU."
}
]
},
{
"answer_id": 32845,
"accepted": true,
"answer_comments_url": "/answers/32845/comments",
"question_id": 32816,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1363699361,
"last_activity_date": 1363699361,
"up_vote_count": 9,
"down_vote_count": 0,
"view_count": 1031,
"score": 9,
"community_owned": false,
"title": "Why are GPUs so good at cracking passwords?",
"comments": [
{
"comment_id": 51030,
"creation_date": 1363707130,
"owner": {
"user_id": 4722,
"user_type": "registered",
"display_name": "Nick",
"reputation": 153,
"email_hash": "a05d3e8999133f4c09b24f7df10bc10e"
},
"post_id": 32845,
"post_type": "answer",
"score": 0,
"body": ""Like hip-hop dancers" :)"
},
{
"comment_id": 51455,
"creation_date": 1364025830,
"owner": {
"user_id": 6813,
"user_type": "registered",
"display_name": "Tom Marthenal",
"reputation": 853,
"email_hash": "788bee10b9d841b3caf60674e3d65129"
},
"post_id": 32845,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "Some context on the numbers: assuming a set of about 100 possible characters, there are 1 trillion possible 6-digit passwords. At a billion passwords per second, this is a bit under 17 minutes to try every possible 6-digit password. Less if we assume the character set is smaller (most people will never use a good chunk of the printable ASCII character set in passwords). Another reminder to salt your hashes."
}
]
}
],
"accepted_answer_id": 32845,
"favorite_count": 1,
"question_timeline_url": "/questions/32816/timeline",
"question_comments_url": "/questions/32816/comments",
"question_answers_url": "/questions/32816/answers",
"question_id": 32816,
"owner": {
"user_id": 4722,
"user_type": "registered",
"display_name": "Nick",
"reputation": 153,
"email_hash": "a05d3e8999133f4c09b24f7df10bc10e"
},
"creation_date": 1363658589,
"last_activity_date": 1363699361,
"up_vote_count": 10,
"down_vote_count": 0,
"view_count": 1031,
"score": 10,
"community_owned": false,
"title": "Why are GPUs so good at cracking passwords?",
"comments": []
},
{
"tags": [
"encryption",
"cryptography",
"network",
"key-management"
],
"answer_count": 1,
"answers": [
{
"answer_id": 32797,
"accepted": false,
"answer_comments_url": "/answers/32797/comments",
"question_id": 32794,
"owner": {
"user_id": 2213,
"user_type": "registered",
"display_name": "Antony Vennard",
"reputation": 11333,
"email_hash": "93e7e626a9493e05cb0e75dd246461b2"
},
"creation_date": 1363632144,
"last_activity_date": 1363632144,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 138,
"score": 2,
"community_owned": false,
"title": "Exchange of DEK and KEK (encryption keys) between app server and key server",
"comments": []
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/32794/timeline",
"question_comments_url": "/questions/32794/comments",
"question_answers_url": "/questions/32794/answers",
"question_id": 32794,
"owner": {
"user_id": 22190,
"user_type": "registered",
"display_name": "Nalin Gupta",
"reputation": 6,
"email_hash": "1a09a9a4206f3cc4dede08316c4dba97"
},
"creation_date": 1363628611,
"last_activity_date": 1363632144,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 138,
"score": 1,
"community_owned": false,
"title": "Exchange of DEK and KEK (encryption keys) between app server and key server",
"comments": []
},
{
"tags": [
"encryption",
"cryptography",
"hash"
],
"answer_count": 2,
"answers": [
{
"answer_id": 32549,
"accepted": true,
"answer_comments_url": "/answers/32549/comments",
"question_id": 32546,
"owner": {
"user_id": 5411,
"user_type": "registered",
"display_name": "Tom Leek",
"reputation": 24996,
"email_hash": "e2e94675a01dd4477eef7750db006817"
},
"creation_date": 1363178507,
"last_edit_date": 1363187576,
"last_activity_date": 1363187576,
"up_vote_count": 13,
"down_vote_count": 0,
"view_count": 245,
"score": 13,
"community_owned": false,
"title": "Does it make any difference of the order Hashing and Encrypting in terms of security?",
"comments": [
{
"comment_id": 50472,
"creation_date": 1363180191,
"owner": {
"user_id": 21931,
"user_type": "registered",
"display_name": "Ekin",
"reputation": 18,
"email_hash": "1bdc0eb8071d83a08e612c7fad423fa5"
},
"post_id": 32549,
"post_type": "answer",
"score": 0,
"body": "this answer is quite useful, thanks"
}
]
},
{
"answer_id": 32548,
"accepted": false,
"answer_comments_url": "/answers/32548/comments",
"question_id": 32546,
"owner": {
"user_id": 2213,
"user_type": "registered",
"display_name": "Antony Vennard",
"reputation": 11333,
"email_hash": "93e7e626a9493e05cb0e75dd246461b2"
},
"creation_date": 1363178480,
"last_activity_date": 1363178480,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 245,
"score": 3,
"community_owned": false,
"title": "Does it make any difference of the order Hashing and Encrypting in terms of security?",
"comments": [
{
"comment_id": 50470,
"creation_date": 1363178849,
"owner": {
"user_id": 21931,
"user_type": "registered",
"display_name": "Ekin",
"reputation": 18,
"email_hash": "1bdc0eb8071d83a08e612c7fad423fa5"
},
"post_id": 32548,
"post_type": "answer",
"score": 0,
"body": "To be more specific, the password vault will parse the encrypted data from a XML file. Therefore, the XML file will be on the local disk, not on a certain database or online."
}
]
}
],
"accepted_answer_id": 32549,
"favorite_count": 0,
"question_timeline_url": "/questions/32546/timeline",
"question_comments_url": "/questions/32546/comments",
"question_answers_url": "/questions/32546/answers",
"question_id": 32546,
"owner": {
"user_id": 21931,
"user_type": "registered",
"display_name": "Ekin",
"reputation": 18,
"email_hash": "1bdc0eb8071d83a08e612c7fad423fa5"
},
"creation_date": 1363177673,
"last_edit_date": 1363177997,
"last_activity_date": 1363187576,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 245,
"score": 3,
"community_owned": false,
"title": "Does it make any difference of the order Hashing and Encrypting in terms of security?",
"comments": [
{
"comment_id": 50462,
"creation_date": 1363178090,
"owner": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 32546,
"post_type": "question",
"score": 4,
"body": "But doesn't a password vault require the ability to decrypt the password? So how would hashing work?"
},
{
"comment_id": 50463,
"creation_date": 1363178118,
"owner": {
"user_id": 16399,
"user_type": "registered",
"display_name": "Steel City Hacker",
"reputation": 768,
"email_hash": "c78c186a2e70495f0c6619f00e958a1f"
},
"post_id": 32546,
"post_type": "question",
"score": 0,
"edit_count": 2,
"body": "I don't really know for sure, but I would posit that you should encrypt first then hash. This is because your result will be a hash, and you will need to brute force the hash (Hard because of large input), then break the key. Conversely, if you hash first, then encrypt, it will be much easier to break the encryption because the input string is so small."
},
{
"comment_id": 50464,
"creation_date": 1363178197,
"owner": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 32546,
"post_type": "question",
"score": 4,
"body": "You first should figure out and post what your program should do, and what security properties you want. Only then you can tell what crypto you need."
},
{
"comment_id": 50466,
"creation_date": 1363178372,
"owner": {
"user_id": 21931,
"user_type": "registered",
"display_name": "Ekin",
"reputation": 18,
"email_hash": "1bdc0eb8071d83a08e612c7fad423fa5"
},
"post_id": 32546,
"post_type": "question",
"score": 1,
"body": "Well, in the program I was planning to see, has there been any changes with the password by an attacker. That is why I am using a hash"
},
{
"comment_id": 51699,
"creation_date": 1364386845,
"owner": {
"user_id": 15073,
"user_type": "registered",
"display_name": "SparKot ॐ",
"reputation": 106,
"email_hash": "dc51ee28614d0afb42e7c315c5693c34"
},
"post_id": 32546,
"post_type": "question",
"score": 0,
"edit_count": 1,
"body": "Hash is irrecoverable. You can employ a combination of simple encoding/substitution which are reversible before the actual DES encryption. Leaking of sequence of these trivial steps render it useless to do it first place."
}
]
},
{
"tags": [
"encryption",
"cryptography",
"key-exchange"
],
"answer_count": 3,
"answers": [
{
"answer_id": 32491,
"accepted": false,
"answer_comments_url": "/answers/32491/comments",
"question_id": 32489,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1363120946,
"last_activity_date": 1363120946,
"up_vote_count": 5,
"down_vote_count": 0,
"view_count": 112,
"score": 5,
"community_owned": false,
"title": "Cryptography key gathering tool",
"comments": []
},
{
"answer_id": 32490,
"accepted": true,
"answer_comments_url": "/answers/32490/comments",
"question_id": 32489,
"owner": {
"user_id": 414,
"user_type": "registered",
"display_name": "Gilles",
"reputation": 10126,
"email_hash": "a717291747c76567bb0f086e15ae6e43"
},
"creation_date": 1363120913,
"last_activity_date": 1363120913,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 112,
"score": 3,
"community_owned": false,
"title": "Cryptography key gathering tool",
"comments": []
},
{
"answer_id": 32492,
"accepted": false,
"answer_comments_url": "/answers/32492/comments",
"question_id": 32489,
"owner": {
"user_id": 18555,
"user_type": "registered",
"display_name": "mr.spuratic",
"reputation": 1271,
"email_hash": "51f65677a32bd9404865b8c65e79afc7"
},
"creation_date": 1363121251,
"last_edit_date": 1363210241,
"last_activity_date": 1363210241,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 112,
"score": 2,
"community_owned": false,
"title": "Cryptography key gathering tool",
"comments": []
}
],
"accepted_answer_id": 32490,
"favorite_count": 0,
"question_timeline_url": "/questions/32489/timeline",
"question_comments_url": "/questions/32489/comments",
"question_answers_url": "/questions/32489/answers",
"question_id": 32489,
"owner": {
"user_id": 7827,
"user_type": "registered",
"display_name": "Alex",
"reputation": 100,
"email_hash": "f56d01b05c8017abf3389b09865d9b61"
},
"creation_date": 1363118994,
"last_activity_date": 1363210241,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 112,
"score": 1,
"community_owned": false,
"title": "Cryptography key gathering tool",
"comments": [
{
"comment_id": 50411,
"creation_date": 1363121761,
"owner": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 32489,
"post_type": "question",
"score": 0,
"body": "In the case of asymmetric encryption the attacker can trivially produce those plaintext/ciphertext pairs himself."
}
]
},
{
"tags": [
"encryption",
"cryptography",
"public-key-infrastructure",
"pgp"
],
"answer_count": 1,
"answers": [
{
"answer_id": 32388,
"accepted": false,
"answer_comments_url": "/answers/32388/comments",
"question_id": 32386,
"owner": {
"user_id": 5411,
"user_type": "registered",
"display_name": "Tom Leek",
"reputation": 24996,
"email_hash": "e2e94675a01dd4477eef7750db006817"
},
"creation_date": 1362948666,
"last_activity_date": 1362948666,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 131,
"score": 1,
"community_owned": false,
"title": "Why do PGP master keys only have a single subkey, and tie certification with signing by default?",
"comments": [
{
"comment_id": 50196,
"creation_date": 1362949370,
"owner": {
"user_id": 8487,
"user_type": "registered",
"display_name": "Adam Prescott",
"reputation": 16,
"email_hash": "99804651e19d8b0dffbc0da53e39114e"
},
"post_id": 32388,
"post_type": "answer",
"score": 0,
"body": "Don't key signatures go on the uid associated with the public key, as a signature that the claimed owner is genuine? Or are you referring to trust levels for saying how much you trust another person's signature on another key?"
}
]
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/32386/timeline",
"question_comments_url": "/questions/32386/comments",
"question_answers_url": "/questions/32386/answers",
"question_id": 32386,
"owner": {
"user_id": 8487,
"user_type": "registered",
"display_name": "Adam Prescott",
"reputation": 16,
"email_hash": "99804651e19d8b0dffbc0da53e39114e"
},
"creation_date": 1362947929,
"last_activity_date": 1362948666,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 131,
"score": 3,
"community_owned": false,
"title": "Why do PGP master keys only have a single subkey, and tie certification with signing by default?",
"comments": []
},
{
"tags": [
"encryption",
"cryptography"
],
"answer_count": 2,
"answers": [
{
"answer_id": 32351,
"accepted": true,
"answer_comments_url": "/answers/32351/comments",
"question_id": 32324,
"owner": {
"user_id": 2568,
"user_type": "registered",
"display_name": "dr jimbob",
"reputation": 11749,
"email_hash": "2318229ef6310b03ab828bff43d2ad66"
},
"creation_date": 1362906294,
"last_activity_date": 1362906294,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 108,
"score": 3,
"community_owned": false,
"title": "Many-time pad on image data, how to proceed?",
"comments": [
{
"comment_id": 50194,
"creation_date": 1362948308,
"owner": {
"user_id": 15363,
"user_type": "registered",
"display_name": "Khaled Nassar",
"reputation": 113,
"email_hash": "ae7b1f4efcbc92e8e7fe0e2504b37a6b"
},
"post_id": 32351,
"post_type": "answer",
"score": 0,
"body": "The idea of the padding actually solved it. Thanks!"
}
]
},
{
"answer_id": 32333,
"accepted": false,
"answer_comments_url": "/answers/32333/comments",
"question_id": 32324,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1362869441,
"last_activity_date": 1362869441,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 108,
"score": 2,
"community_owned": false,
"title": "Many-time pad on image data, how to proceed?",
"comments": [
{
"comment_id": 50129,
"creation_date": 1362869540,
"owner": {
"user_id": 21272,
"user_type": "registered",
"display_name": "Saladin",
"reputation": 845,
"email_hash": "a5e36ef8cc4416aa199a3a82dcb1deb4"
},
"post_id": 32333,
"post_type": "answer",
"score": 0,
"body": "Is the chances / probability related to use of common dictionary words?"
},
{
"comment_id": 50139,
"creation_date": 1362889440,
"owner": {
"user_id": 15363,
"user_type": "registered",
"display_name": "Khaled Nassar",
"reputation": 113,
"email_hash": "ae7b1f4efcbc92e8e7fe0e2504b37a6b"
},
"post_id": 32333,
"post_type": "answer",
"score": 0,
"body": "I can see how it would work with the assumption that the key is short, and is in plain English. However, that's not the case here, check out the edit."
}
]
}
],
"accepted_answer_id": 32351,
"favorite_count": 0,
"question_timeline_url": "/questions/32324/timeline",
"question_comments_url": "/questions/32324/comments",
"question_answers_url": "/questions/32324/answers",
"question_id": 32324,
"owner": {
"user_id": 15363,
"user_type": "registered",
"display_name": "Khaled Nassar",
"reputation": 113,
"email_hash": "ae7b1f4efcbc92e8e7fe0e2504b37a6b"
},
"creation_date": 1362859010,
"last_edit_date": 1362889275,
"last_activity_date": 1362906294,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 108,
"score": 2,
"community_owned": false,
"title": "Many-time pad on image data, how to proceed?",
"comments": [
{
"comment_id": 50112,
"creation_date": 1362861614,
"owner": {
"user_id": 1472,
"user_type": "registered",
"display_name": "Ladadadada",
"reputation": 2487,
"email_hash": "318a601d968e1f67c5ddcffa691466d7"
},
"post_id": 32324,
"post_type": "question",
"score": 0,
"edit_count": 1,
"body": "Just a terminology nit-pick here, if you have "repeated it over the length of the image" it's not a one-time pad. A one-time pad must be exactly the same size as the image. The relative sizes of the key/stream and the image make a big difference to whether the key can be retrieved or not."
},
{
"comment_id": 50114,
"creation_date": 1362862134,
"owner": {
"user_id": 15363,
"user_type": "registered",
"display_name": "Khaled Nassar",
"reputation": 113,
"email_hash": "ae7b1f4efcbc92e8e7fe0e2504b37a6b"
},
"reply_to_user": {
"user_id": 1472,
"user_type": "registered",
"display_name": "Ladadadada",
"reputation": 2487,
"email_hash": "318a601d968e1f67c5ddcffa691466d7"
},
"post_id": 32324,
"post_type": "question",
"score": 0,
"body": "@Ladadadada Thanks for pointing it out. However, I'm quite aware of that fact (title of the question should be sufficient), but I thought I'd mention it's a one-time pad because that's what the attempt to encrypt the image data seemed to most appropriately resemble."
},
{
"comment_id": 50126,
"creation_date": 1362867356,
"owner": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 32324,
"post_type": "question",
"score": 0,
"body": "This is a variant of the Vigenère cipher"
}
]
},
{
"tags": [
"encryption",
"cryptography",
"authentication",
"certificate-authority",
"custom-scheme"
],
"answer_count": 1,
"answers": [
{
"answer_id": 32280,
"accepted": false,
"answer_comments_url": "/answers/32280/comments",
"question_id": 32277,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1362756440,
"last_activity_date": 1362756440,
"up_vote_count": 4,
"down_vote_count": 0,
"view_count": 95,
"score": 4,
"community_owned": false,
"title": "Security and authentication problem",
"comments": []
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/32277/timeline",
"question_comments_url": "/questions/32277/comments",
"question_answers_url": "/questions/32277/answers",
"question_id": 32277,
"owner": {
"user_id": 8111,
"user_type": "registered",
"display_name": "salamis",
"reputation": 134,
"email_hash": "954a91df71cc14d1b42a5c72bdfed7e8"
},
"creation_date": 1362754546,
"last_activity_date": 1362756440,
"up_vote_count": 5,
"down_vote_count": 0,
"view_count": 95,
"score": 5,
"community_owned": false,
"title": "Security and authentication problem",
"comments": [
{
"comment_id": 50023,
"creation_date": 1362756107,
"owner": {
"user_id": 21272,
"user_type": "registered",
"display_name": "Saladin",
"reputation": 845,
"email_hash": "a5e36ef8cc4416aa199a3a82dcb1deb4"
},
"post_id": 32277,
"post_type": "question",
"score": 0,
"edit_count": 2,
"body": "Why are you not considering authentication prior decryption? Like in case of ssl e.g client certificate"
},
{
"comment_id": 50024,
"creation_date": 1362756281,
"owner": {
"user_id": 16433,
"user_type": "registered",
"display_name": "marcwho",
"reputation": 296,
"email_hash": "8220e1eb82706e189f82c506faf315c6"
},
"post_id": 32277,
"post_type": "question",
"score": 0,
"edit_count": 2,
"body": "I am not a security expert, but I would say there is a design issue here. All keys should not be stored at one location, maybe break keys into multiple parts and store each at a different location. The only solution I can see here, is to re-encrypt everything with a new key, which will take a long time."
},
{
"comment_id": 50026,
"creation_date": 1362757827,
"owner": {
"user_id": 21272,
"user_type": "registered",
"display_name": "Saladin",
"reputation": 845,
"email_hash": "a5e36ef8cc4416aa199a3a82dcb1deb4"
},
"post_id": 32277,
"post_type": "question",
"score": 0,
"edit_count": 1,
"body": "Thats two factor authentication, you can keep two keys for opening the lockers. The other can also be obtained over the network from secure , covert fashion or can be extracted from smart-card."
}
]
},
{
"tags": [
"encryption",
"cryptography",
"theory"
],
"answer_count": 1,
"answers": [
{
"answer_id": 32260,
"accepted": true,
"answer_comments_url": "/answers/32260/comments",
"question_id": 32247,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1362745453,
"last_edit_date": 1362850681,
"last_activity_date": 1362850681,
"up_vote_count": 9,
"down_vote_count": 0,
"view_count": 303,
"score": 9,
"community_owned": false,
"title": "Will double encryption increase the security of cipher vs bruteforce?",
"comments": [
{
"comment_id": 50086,
"creation_date": 1362847317,
"owner": {
"user_id": 11341,
"user_type": "registered",
"display_name": "HeatfanJohn",
"reputation": 245,
"email_hash": "cdbfa8c45506b2f0b1ba57cab3445f0f"
},
"post_id": 32260,
"post_type": "answer",
"score": 0,
"body": "Thank you for explaining how the "meet-in-the-middle" approach works! I quickly read the Wikipedia article, but didn't understand it until I read your excellent explanation."
}
]
}
],
"accepted_answer_id": 32260,
"favorite_count": 1,
"question_timeline_url": "/questions/32247/timeline",
"question_comments_url": "/questions/32247/comments",
"question_answers_url": "/questions/32247/answers",
"question_id": 32247,
"owner": {
"user_id": 8803,
"user_type": "registered",
"display_name": "Tomáš Šíma",
"reputation": 150,
"email_hash": "f96ac892907fb03974a8988db1ca78ec"
},
"creation_date": 1362729754,
"last_activity_date": 1362850681,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 303,
"score": 3,
"community_owned": false,
"title": "Will double encryption increase the security of cipher vs bruteforce?",
"comments": [
{
"comment_id": 49967,
"creation_date": 1362730043,
"owner": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 32247,
"post_type": "question",
"score": 0,
"edit_count": 4,
"body": "Security gain is rather small. Meet-in-the middle. That's the reason 3DES is used instead of 2DES."
},
{
"comment_id": 49969,
"creation_date": 1362730278,
"owner": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 32247,
"post_type": "question",
"score": 0,
"edit_count": 1,
"body": "Related: Why is triple-DES using three different keys vulnerable to a meet-in-the-middle-attack?"
},
{
"comment_id": 49971,
"creation_date": 1362731185,
"owner": {
"user_id": 8803,
"user_type": "registered",
"display_name": "Tomáš Šíma",
"reputation": 150,
"email_hash": "f96ac892907fb03974a8988db1ca78ec"
},
"reply_to_user": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 32247,
"post_type": "question",
"score": 0,
"body": "Exactly what I was searching for, thanks!"
}
]
},
{
"tags": [
"cryptography",
"professional-education"
],
"answer_count": 8,
"answers": [
{
"answer_id": 32233,
"accepted": false,
"answer_comments_url": "/answers/32233/comments",
"question_id": 32230,
"owner": {
"user_id": 975,
"user_type": "registered",
"display_name": "Rook",
"reputation": 21214,
"email_hash": "7cedb843eb2922000eb41b4561ed660d"
},
"creation_date": 1362710162,
"last_edit_date": 1362763027,
"last_activity_date": 1362763027,
"up_vote_count": 15,
"down_vote_count": 0,
"view_count": 618,
"score": 15,
"community_owned": false,
"title": "Is advanced mathematics relevant to security beyond cryptography?",
"comments": [
{
"comment_id": 49998,
"creation_date": 1362745977,
"owner": {
"user_id": 17647,
"user_type": "registered",
"display_name": "us2012",
"reputation": 211,
"email_hash": "2bcc00b98c7d51bd26b73403b2ceafda"
},
"post_id": 32233,
"post_type": "answer",
"score": 5,
"body": "Alan Turing did not get a Nobel prize in math, for the simple reason that there has never been a Nobel prize in math."
},
{
"comment_id": 50014,
"creation_date": 1362753368,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"post_id": 32233,
"post_type": "answer",
"score": 5,
"body": "An fun (and probably fake) anecdote is that there is no Nobel prize for mathematics because Nobel's wife had eloped with a mathematician. The equivalent for mathematicians is the Fields Medal. Alan Turing got nothing (his end of life was rather tragic and very unfair); but a new award for computer scientists was created later on, and named the Turing Award so one can say that Turing got better than a prize; he got a prize named after him."
}
]
},
{
"answer_id": 32231,
"accepted": false,
"answer_comments_url": "/answers/32231/comments",
"question_id": 32230,
"owner": {
"user_id": 485,
"user_type": "moderator",
"display_name": "Rory Alsop",
"reputation": 32567,
"email_hash": "af1ed0816ed5a2164a4e343ad09309ad"
},
"creation_date": 1362708635,
"last_activity_date": 1362708635,
"up_vote_count": 9,
"down_vote_count": 0,
"view_count": 618,
"score": 9,
"community_owned": false,
"title": "Is advanced mathematics relevant to security beyond cryptography?",
"comments": []
},
{
"answer_id": 32254,
"accepted": false,
"answer_comments_url": "/answers/32254/comments",
"question_id": 32230,
"owner": {
"user_id": 3272,
"user_type": "registered",
"display_name": "Tobias Kienzler",
"reputation": 704,
"email_hash": "79175a222a9933b9fc278cd94b228bf7"
},
"creation_date": 1362737858,
"last_activity_date": 1362737858,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 618,
"score": 3,
"community_owned": false,
"title": "Is advanced mathematics relevant to security beyond cryptography?",
"comments": [
{
"comment_id": 50047,
"creation_date": 1362779639,
"owner": {
"user_id": 18525,
"user_type": "registered",
"display_name": "d0rmLife",
"reputation": 174,
"email_hash": "8c53e3ce7fa4c71538aa72ec22ab0e42"
},
"post_id": 32254,
"post_type": "answer",
"score": 0,
"body": "+1 for mentioning hardware considerations."
}
]
},
{
"answer_id": 34558,
"accepted": false,
"answer_comments_url": "/answers/34558/comments",
"question_id": 32230,
"owner": {
"user_id": 3339,
"user_type": "registered",
"display_name": "Lucas Kauffman",
"reputation": 12355,
"email_hash": "7d6ab282108ec8402127fed2498b29a3"
},
"creation_date": 1366313219,
"last_activity_date": 1366313219,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 618,
"score": 3,
"community_owned": false,
"title": "Is advanced mathematics relevant to security beyond cryptography?",
"comments": []
},
{
"answer_id": 32252,
"accepted": false,
"answer_comments_url": "/answers/32252/comments",
"question_id": 32230,
"owner": {
"user_id": 21682,
"user_type": "registered",
"display_name": "nahraf",
"reputation": 21,
"email_hash": "456bd8b8ad625bec92e3954bb85e2f33"
},
"creation_date": 1362736486,
"last_edit_date": 1362741550,
"last_activity_date": 1362741550,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 618,
"score": 2,
"community_owned": false,
"title": "Is advanced mathematics relevant to security beyond cryptography?",
"comments": [
{
"comment_id": 50045,
"creation_date": 1362779472,
"owner": {
"user_id": 18525,
"user_type": "registered",
"display_name": "d0rmLife",
"reputation": 174,
"email_hash": "8c53e3ce7fa4c71538aa72ec22ab0e42"
},
"post_id": 32252,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "Yes, it is a broad term. That is why I asked which branch of mathematics and which branch of security. Please elaborate on possible applications."
}
]
},
{
"answer_id": 32256,
"accepted": false,
"answer_comments_url": "/answers/32256/comments",
"question_id": 32230,
"owner": {
"user_id": 543,
"user_type": "registered",
"display_name": "symcbean",
"reputation": 4752,
"email_hash": "2c69074600f4d1cdb9c6d78370ab3335"
},
"creation_date": 1362737951,
"last_activity_date": 1362737951,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 618,
"score": 2,
"community_owned": false,
"title": "Is advanced mathematics relevant to security beyond cryptography?",
"comments": [
{
"comment_id": 50046,
"creation_date": 1362779580,
"owner": {
"user_id": 18525,
"user_type": "registered",
"display_name": "d0rmLife",
"reputation": 174,
"email_hash": "8c53e3ce7fa4c71538aa72ec22ab0e42"
},
"post_id": 32256,
"post_type": "answer",
"score": 0,
"body": "I added a description of the sequence in my question. Stats is an interesting addition--I am wondering if it is used only to analyze threats/model impacts; or, also to generate actual software/protocols/algorithms?"
}
]
},
{
"answer_id": 34556,
"accepted": false,
"answer_comments_url": "/answers/34556/comments",
"question_id": 32230,
"owner": {
"user_id": 453,
"user_type": "registered",
"display_name": "nealmcb",
"reputation": 10258,
"email_hash": "75330946da121a9e1d905dd3f54042f6"
},
"creation_date": 1366310701,
"last_edit_date": 1366311034,
"last_activity_date": 1366311034,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 618,
"score": 2,
"community_owned": false,
"title": "Is advanced mathematics relevant to security beyond cryptography?",
"comments": []
},
{
"answer_id": 34640,
"accepted": false,
"answer_comments_url": "/answers/34640/comments",
"question_id": 32230,
"owner": {
"user_id": 9778,
"user_type": "registered",
"display_name": "pnp",
"reputation": 808,
"email_hash": "be46a5c5bfe9818e55a16624203bc673"
},
"creation_date": 1366540745,
"last_activity_date": 1366540745,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 618,
"score": 1,
"community_owned": false,
"title": "Is advanced mathematics relevant to security beyond cryptography?",
"comments": []
}
],
"favorite_count": 1,
"question_timeline_url": "/questions/32230/timeline",
"question_comments_url": "/questions/32230/comments",
"question_answers_url": "/questions/32230/answers",
"question_id": 32230,
"owner": {
"user_id": 18525,
"user_type": "registered",
"display_name": "d0rmLife",
"reputation": 174,
"email_hash": "8c53e3ce7fa4c71538aa72ec22ab0e42"
},
"creation_date": 1362707611,
"last_edit_date": 1366544613,
"last_activity_date": 1366544613,
"up_vote_count": 15,
"down_vote_count": 1,
"view_count": 618,
"score": 14,
"community_owned": false,
"title": "Is advanced mathematics relevant to security beyond cryptography?",
"comments": []
},
{
"tags": [
"cryptography",
"asymmetric"
],
"answer_count": 3,
"answers": [
{
"answer_id": 32076,
"accepted": false,
"answer_comments_url": "/answers/32076/comments",
"question_id": 32050,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1362570804,
"last_activity_date": 1362570804,
"up_vote_count": 5,
"down_vote_count": 0,
"view_count": 125,
"score": 5,
"community_owned": false,
"title": "What specific padding weakness does OAEP address in RSA?",
"comments": []
},
{
"answer_id": 32136,
"accepted": false,
"answer_comments_url": "/answers/32136/comments",
"question_id": 32050,
"owner": {
"user_id": 13914,
"user_type": "registered",
"display_name": "Sid",
"reputation": 170,
"email_hash": "dda96c096b7ecfd0f2e00f50e1a9a1ea"
},
"creation_date": 1362597615,
"last_edit_date": 1362637495,
"last_activity_date": 1362637495,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 125,
"score": 1,
"community_owned": false,
"title": "What specific padding weakness does OAEP address in RSA?",
"comments": []
},
{
"answer_id": 32057,
"accepted": false,
"answer_comments_url": "/answers/32057/comments",
"question_id": 32050,
"owner": {
"user_id": 17479,
"user_type": "registered",
"display_name": "Watson Ladd",
"reputation": 26,
"email_hash": "15d60fd68af1e58f342e1055f523a436"
},
"creation_date": 1362546906,
"last_activity_date": 1362546906,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 125,
"score": 0,
"community_owned": false,
"title": "What specific padding weakness does OAEP address in RSA?",
"comments": []
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/32050/timeline",
"question_comments_url": "/questions/32050/comments",
"question_answers_url": "/questions/32050/answers",
"question_id": 32050,
"owner": {
"user_id": 13914,
"user_type": "registered",
"display_name": "Sid",
"reputation": 170,
"email_hash": "dda96c096b7ecfd0f2e00f50e1a9a1ea"
},
"creation_date": 1362536221,
"last_edit_date": 1362552744,
"last_activity_date": 1362637495,
"up_vote_count": 5,
"down_vote_count": 0,
"view_count": 125,
"score": 5,
"community_owned": false,
"title": "What specific padding weakness does OAEP address in RSA?",
"comments": []
},
{
"tags": [
"encryption",
"cryptography"
],
"answer_count": 3,
"answers": [
{
"answer_id": 31761,
"accepted": false,
"answer_comments_url": "/answers/31761/comments",
"question_id": 31739,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1362141302,
"last_activity_date": 1362141302,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 177,
"score": 3,
"community_owned": false,
"title": "Can encryption twice with two keys in different sequences lead to the same result?",
"comments": [
{
"comment_id": 49069,
"creation_date": 1362147820,
"owner": {
"user_id": 21336,
"user_type": "registered",
"display_name": "kevin123",
"reputation": 21,
"email_hash": "1a1afa5ff9a316bfbfd5f90e93357201"
},
"post_id": 31761,
"post_type": "answer",
"score": 0,
"body": "Thanks Thomas! My scenario is, suppose two nodes have attributes: a, b, c, and associated values. Two nodes want to compare the values of their attributes but do not want the other to know its values. Then, my design is, each node send below to the other, E(a,k_i)+10, E(b,k_i)+5...., where k_i is the key adopted by node_i, and 10 and 5 are values of the two attributes. After receiving it, each node further encrypt with its key. Then, one node has E(E(a,k_i), k_j)+10... and the other has E(E(a,k_j), k_i)+7... As E(E(a,k_i), k_j) = E(E(a,k_j), k_i), they can compare and do not disclose values."
}
]
},
{
"answer_id": 31740,
"accepted": false,
"answer_comments_url": "/answers/31740/comments",
"question_id": 31739,
"owner": {
"user_id": 6939,
"user_type": "registered",
"display_name": "mgibsonbr",
"reputation": 956,
"email_hash": "414aae1257ee9e58014bd81bf438a662"
},
"creation_date": 1362109419,
"last_edit_date": 1362170370,
"last_activity_date": 1362170370,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 177,
"score": 1,
"community_owned": false,
"title": "Can encryption twice with two keys in different sequences lead to the same result?",
"comments": [
{
"comment_id": 49064,
"creation_date": 1362140195,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"post_id": 31740,
"post_type": "answer",
"score": 1,
"body": "If both RSA key pairs use the same modulus, they cannot really be called distinct keys. Knowledge of the modulus, public exponent and private exponent is sufficient to factor the modulus."
},
{
"comment_id": 49070,
"creation_date": 1362147978,
"owner": {
"user_id": 21336,
"user_type": "registered",
"display_name": "kevin123",
"reputation": 21,
"email_hash": "1a1afa5ff9a316bfbfd5f90e93357201"
},
"post_id": 31740,
"post_type": "answer",
"score": 0,
"body": "Thanks mgibsonbr! I do need symmetric cipher. I have looked at the One-Time-Pad. It satisfied the requirement. But I may need to use the key to encrypt more than one items....otherwise the cost would be too huge since I have a lot of items to encrypt. Then how would that degrade its security level? And in this case, can the unpadded RSA still be used?"
},
{
"comment_id": 49098,
"creation_date": 1362166062,
"owner": {
"user_id": 6939,
"user_type": "registered",
"display_name": "mgibsonbr",
"reputation": 956,
"email_hash": "414aae1257ee9e58014bd81bf438a662"
},
"reply_to_user": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"post_id": 31740,
"post_type": "answer",
"score": 0,
"body": "@ThomasPornin that's right! It's been 12 years since I studied the internals of RSA, and my memory totally failed me. I thought the public exponent was equal to p*q, and the modulus was unimportant (just had to be coprime to something I didn't remember). Now I see that it's the opposite, which makes the first part of my answer void..."
},
{
"comment_id": 49109,
"creation_date": 1362169367,
"owner": {
"user_id": 6939,
"user_type": "registered",
"display_name": "mgibsonbr",
"reputation": 956,
"email_hash": "414aae1257ee9e58014bd81bf438a662"
},
"reply_to_user": {
"user_id": 21336,
"user_type": "registered",
"display_name": "kevin123",
"reputation": 21,
"email_hash": "1a1afa5ff9a316bfbfd5f90e93357201"
},
"post_id": 31740,
"post_type": "answer",
"score": 0,
"body": "@kevin123 Unfortunatly, as commented above, RSA can not be used. However, see my updated answer, it might be what you're looking for. Generating new keys for OTP is easy, since they're just random numbers... Exchanging them if you don't have a secure channel, that is the hard part, but it seems it doesn't apply to your case (you don't need to exchange them, you do have a secure channel, or both)."
}
]
},
{
"answer_id": 31793,
"accepted": false,
"answer_comments_url": "/answers/31793/comments",
"question_id": 31739,
"owner": {
"user_id": 12217,
"user_type": "registered",
"display_name": "Sean Madden",
"reputation": 267,
"email_hash": "2fccd244dd888650399c9fcc05129fcb"
},
"creation_date": 1362173670,
"last_activity_date": 1362173670,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 177,
"score": 0,
"community_owned": false,
"title": "Can encryption twice with two keys in different sequences lead to the same result?",
"comments": []
}
],
"favorite_count": 1,
"question_timeline_url": "/questions/31739/timeline",
"question_comments_url": "/questions/31739/comments",
"question_answers_url": "/questions/31739/answers",
"question_id": 31739,
"owner": {
"user_id": 21336,
"user_type": "registered",
"display_name": "kevin123",
"reputation": 21,
"email_hash": "1a1afa5ff9a316bfbfd5f90e93357201"
},
"creation_date": 1362107766,
"last_edit_date": 1362110097,
"last_activity_date": 1362173670,
"up_vote_count": 4,
"down_vote_count": 0,
"view_count": 177,
"score": 4,
"community_owned": false,
"title": "Can encryption twice with two keys in different sequences lead to the same result?",
"comments": [
{
"comment_id": 49043,
"creation_date": 1362109611,
"owner": {
"user_id": 6939,
"user_type": "registered",
"display_name": "mgibsonbr",
"reputation": 956,
"email_hash": "414aae1257ee9e58014bd81bf438a662"
},
"post_id": 31739,
"post_type": "question",
"score": 1,
"body": "Is this just a hypothetical scenario, or is there a specific use case for that? If the former, this question would be more on topic at crypto.SE, otherwise more context is needed."
},
{
"comment_id": 49071,
"creation_date": 1362148796,
"owner": {
"user_id": 21336,
"user_type": "registered",
"display_name": "kevin123",
"reputation": 21,
"email_hash": "1a1afa5ff9a316bfbfd5f90e93357201"
},
"reply_to_user": {
"user_id": 6939,
"user_type": "registered",
"display_name": "mgibsonbr",
"reputation": 956,
"email_hash": "414aae1257ee9e58014bd81bf438a662"
},
"post_id": 31739,
"post_type": "question",
"score": 0,
"body": "It is a research paper in ad hoc networks to keep information privacy. The general usage case is that two nodes want to compare the values of some attributes but do not want the other node to know too much of the information, i.e., do not want the other to know which attribute match which value."
},
{
"comment_id": 49096,
"creation_date": 1362164205,
"owner": {
"user_id": 6939,
"user_type": "registered",
"display_name": "mgibsonbr",
"reputation": 956,
"email_hash": "414aae1257ee9e58014bd81bf438a662"
},
"post_id": 31739,
"post_type": "question",
"score": 1,
"body": "Are you familiar with the Socialist millionaire problem? (a variant of Yao's Millionaires' problem) That seems exactly what you want to do - determine if two values are equal or not, without disclosing them to each other."
}
]
},
{
"tags": [
"cryptography",
"authentication",
"hash",
"php",
"salt"
],
"answer_count": 2,
"answers": [
{
"answer_id": 31633,
"accepted": true,
"answer_comments_url": "/answers/31633/comments",
"question_id": 31631,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1361986977,
"last_activity_date": 1361986977,
"up_vote_count": 5,
"down_vote_count": 0,
"view_count": 116,
"score": 5,
"community_owned": false,
"title": "How high is the entropy of this salt-generating code? (No code-reading actually necessary)",
"comments": []
},
{
"answer_id": 31632,
"accepted": false,
"answer_comments_url": "/answers/31632/comments",
"question_id": 31631,
"owner": {
"user_id": 9377,
"user_type": "registered",
"display_name": "lynks",
"reputation": 4352,
"email_hash": "9a21812b9a1037044c110bc3c8948627"
},
"creation_date": 1361986433,
"last_activity_date": 1361986433,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 116,
"score": 2,
"community_owned": false,
"title": "How high is the entropy of this salt-generating code? (No code-reading actually necessary)",
"comments": []
}
],
"accepted_answer_id": 31633,
"favorite_count": 0,
"question_timeline_url": "/questions/31631/timeline",
"question_comments_url": "/questions/31631/comments",
"question_answers_url": "/questions/31631/answers",
"question_id": 31631,
"owner": {
"user_id": 20321,
"user_type": "registered",
"display_name": "Andrew",
"reputation": 160,
"email_hash": "b976964c1658fdcf3737d5b9cb0fb575"
},
"creation_date": 1361985396,
"last_activity_date": 1361986977,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 116,
"score": 1,
"community_owned": false,
"title": "How high is the entropy of this salt-generating code? (No code-reading actually necessary)",
"comments": [
{
"comment_id": 48911,
"creation_date": 1361995529,
"owner": {
"user_id": 5400,
"user_type": "registered",
"display_name": "Polynomial",
"reputation": 32757,
"email_hash": "6fc641bdddde78a51c0db6b8527c54f7"
},
"post_id": 31631,
"post_type": "question",
"score": 0,
"edit_count": 1,
"body": "The answers here are good, but I'd like to just make the solution 100% clear - you don't need a strong random number generator, you just need to generate a unique value for a salt. A 32-bit integer that increments per-user, e.g. an auto-increment ID, is completely valid as a salt."
},
{
"comment_id": 48924,
"creation_date": 1361999795,
"owner": {
"user_id": 20321,
"user_type": "registered",
"display_name": "Andrew",
"reputation": 160,
"email_hash": "b976964c1658fdcf3737d5b9cb0fb575"
},
"reply_to_user": {
"user_id": 5400,
"user_type": "registered",
"display_name": "Polynomial",
"reputation": 32757,
"email_hash": "6fc641bdddde78a51c0db6b8527c54f7"
},
"post_id": 31631,
"post_type": "question",
"score": 0,
"body": "Ah, thank you very much - a SQL database is involved, so I believe a 4-byte integer that increments automatically is very, very feasible/easy to implement."
}
]
},
{
"tags": [
"cryptography",
"email",
"javascript",
"pgp",
"asymmetric"
],
"answer_count": 1,
"answers": [
{
"answer_id": 31570,
"accepted": false,
"answer_comments_url": "/answers/31570/comments",
"question_id": 31569,
"owner": {
"user_id": 5411,
"user_type": "registered",
"display_name": "Tom Leek",
"reputation": 24996,
"email_hash": "e2e94675a01dd4477eef7750db006817"
},
"creation_date": 1361913678,
"last_activity_date": 1361913678,
"up_vote_count": 4,
"down_vote_count": 0,
"view_count": 175,
"score": 4,
"community_owned": false,
"title": "Potential issues with Kim Dotcom's new proposed \"encrypted webmail service\"",
"comments": [
{
"comment_id": 48811,
"creation_date": 1361918097,
"owner": {
"user_id": 13820,
"user_type": "registered",
"display_name": "Deer Hunter",
"reputation": 751,
"email_hash": "bf43cac729d5848deabbbacbf17e5e41"
},
"post_id": 31570,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "A competent Evil Overlord, huh? But see this item about G00gle's two-factor auth: blog.duosecurity.com/2013/02/…"
}
]
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/31569/timeline",
"question_comments_url": "/questions/31569/comments",
"question_answers_url": "/questions/31569/answers",
"question_id": 31569,
"owner": {
"user_id": 5400,
"user_type": "registered",
"display_name": "Polynomial",
"reputation": 32757,
"email_hash": "6fc641bdddde78a51c0db6b8527c54f7"
},
"creation_date": 1361912736,
"last_activity_date": 1361913678,
"up_vote_count": 4,
"down_vote_count": 0,
"view_count": 175,
"score": 4,
"community_owned": false,
"title": "Potential issues with Kim Dotcom's new proposed \"encrypted webmail service\"",
"comments": []
},
{
"tags": [
"encryption",
"cryptography",
"software",
"cisco",
"cracking"
],
"answer_count": 5,
"answers": [
{
"answer_id": 31519,
"accepted": false,
"answer_comments_url": "/answers/31519/comments",
"question_id": 31518,
"owner": {
"user_id": 20945,
"user_type": "registered",
"display_name": "Peleus",
"reputation": 1061,
"email_hash": "25271152b0a44b52df593ed99ac839f9"
},
"creation_date": 1361843595,
"last_activity_date": 1361843595,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 1981,
"score": 1,
"community_owned": false,
"title": "Cracking CISCO ASA Passwords",
"comments": [
{
"comment_id": 48721,
"creation_date": 1361844078,
"owner": {
"user_id": 18541,
"user_type": "registered",
"display_name": "D3C4FF",
"reputation": 3127,
"email_hash": "b376fbe6933daa281c17c4eb4720461f"
},
"post_id": 31519,
"post_type": "answer",
"score": 0,
"body": "I think that appears to be correct with the usernames (in the webvpn setup) but there is no username for enable mode??"
},
{
"comment_id": 48738,
"creation_date": 1361862941,
"owner": {
"user_id": 33,
"user_type": "moderator",
"display_name": "AviD",
"reputation": 20366,
"email_hash": "a88248f632c039340efa02505be355e5"
},
"post_id": 31519,
"post_type": "answer",
"score": 2,
"body": "Please do repeat, see the FAQ and How to Answer - link only answers tend to degrade over time and are not of much value. Please quote the key points (assuming they allow such use)."
}
]
},
{
"answer_id": 31673,
"accepted": true,
"answer_comments_url": "/answers/31673/comments",
"question_id": 31518,
"owner": {
"user_id": 21290,
"user_type": "registered",
"display_name": "D4M",
"reputation": 69,
"email_hash": "f01f34b52d200d36fba90b6b55627178"
},
"creation_date": 1362007035,
"last_activity_date": 1362007035,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 1981,
"score": 1,
"community_owned": false,
"title": "Cracking CISCO ASA Passwords",
"comments": [
{
"comment_id": 48939,
"creation_date": 1362007736,
"owner": {
"user_id": 18541,
"user_type": "registered",
"display_name": "D3C4FF",
"reputation": 3127,
"email_hash": "b376fbe6933daa281c17c4eb4720461f"
},
"post_id": 31673,
"post_type": "answer",
"score": 0,
"body": "Perfect! Thanks.\nI already had the Crackstation list but it didn't play well with cain... Hashcat's awesome. I just ran it and it found about 65% of the passwords. Do you know exactly how the PIX-MD5 hashes work/are created?"
},
{
"comment_id": 51111,
"creation_date": 1363739484,
"owner": {
"user_id": 18541,
"user_type": "registered",
"display_name": "D3C4FF",
"reputation": 3127,
"email_hash": "b376fbe6933daa281c17c4eb4720461f"
},
"post_id": 31673,
"post_type": "answer",
"score": 0,
"body": "arstechnica.com/security/2013/03/… Just FYI anyone reading this."
}
]
},
{
"answer_id": 31520,
"accepted": false,
"answer_comments_url": "/answers/31520/comments",
"question_id": 31518,
"owner": {
"user_id": 4895,
"user_type": "registered",
"display_name": "Eric G",
"reputation": 3031,
"email_hash": "e0fa10de11b7e78147fe2a17e5165b6d"
},
"creation_date": 1361844852,
"last_activity_date": 1361844852,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 1981,
"score": 0,
"community_owned": false,
"title": "Cracking CISCO ASA Passwords",
"comments": [
{
"comment_id": 48722,
"creation_date": 1361845163,
"owner": {
"user_id": 18541,
"user_type": "registered",
"display_name": "D3C4FF",
"reputation": 3127,
"email_hash": "b376fbe6933daa281c17c4eb4720461f"
},
"post_id": 31520,
"post_type": "answer",
"score": 0,
"body": "Unfortunately i don't have access to the device to run more system:running-config... :( There is no mention however of "type 6" passwords in the config that i can find. Please note there are two (potentially different) places i've sourced passwords from in the above question, one form the beginning of the config file and one from the VPN setup section. The VPN would be handy but i'm more concerned about the Enable password. Cheers,"
},
{
"comment_id": 48723,
"creation_date": 1361845334,
"owner": {
"user_id": 4895,
"user_type": "registered",
"display_name": "Eric G",
"reputation": 3031,
"email_hash": "e0fa10de11b7e78147fe2a17e5165b6d"
},
"reply_to_user": {
"user_id": 18541,
"user_type": "registered",
"display_name": "D3C4FF",
"reputation": 3127,
"email_hash": "b376fbe6933daa281c17c4eb4720461f"
},
"post_id": 31520,
"post_type": "answer",
"score": 0,
"body": "Check out the link above titled "Reversing the preshared key" the exact enabled line from the top of your config is on that page. Type-6 passwords cannot be easily reversed because they depend upon the per device local key. I cannot recall which link it was know, but "8Ry2YjIyt7RRXU24" is the default for when a password is not set and "2KFQnbNIdI.2KYOU" is default indicating "cisco""
},
{
"comment_id": 48724,
"creation_date": 1361845944,
"owner": {
"user_id": 18541,
"user_type": "registered",
"display_name": "D3C4FF",
"reputation": 3127,
"email_hash": "b376fbe6933daa281c17c4eb4720461f"
},
"post_id": 31520,
"post_type": "answer",
"score": 0,
"edit_count": 2,
"body": "For the sake of this question, i don't care about the PSK. You are correct, the enable password in the above example is 'blank'. I want to crack the passwords for the vpn USER accounts, not the VPN itself. And i want to crack the Cisco-PIX encrypted enable password, it appears that Cain does not do this as it appears to no longer be MD5"
},
{
"comment_id": 48726,
"creation_date": 1361846114,
"owner": {
"user_id": 4895,
"user_type": "registered",
"display_name": "Eric G",
"reputation": 3031,
"email_hash": "e0fa10de11b7e78147fe2a17e5165b6d"
},
"reply_to_user": {
"user_id": 18541,
"user_type": "registered",
"display_name": "D3C4FF",
"reputation": 3127,
"email_hash": "b376fbe6933daa281c17c4eb4720461f"
},
"post_id": 31520,
"post_type": "answer",
"score": 0,
"body": "for the "test" account? It looks like its also the type-6"
},
{
"comment_id": 48727,
"creation_date": 1361846491,
"owner": {
"user_id": 18541,
"user_type": "registered",
"display_name": "D3C4FF",
"reputation": 3127,
"email_hash": "b376fbe6933daa281c17c4eb4720461f"
},
"post_id": 31520,
"post_type": "answer",
"score": 0,
"body": "Are you saying i need the VPN PSK to decrypt VPN user passwords? :/"
}
]
},
{
"answer_id": 31532,
"accepted": false,
"answer_comments_url": "/answers/31532/comments",
"question_id": 31518,
"owner": {
"user_id": 11306,
"user_type": "registered",
"display_name": "ponsfonze",
"reputation": 810,
"email_hash": "b5774b7300c55109439646c575eac450"
},
"creation_date": 1361861885,
"last_edit_date": 1361942672,
"last_activity_date": 1361942672,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 1981,
"score": 0,
"community_owned": false,
"title": "Cracking CISCO ASA Passwords",
"comments": [
{
"comment_id": 48751,
"creation_date": 1361874880,
"owner": {
"user_id": 18541,
"user_type": "registered",
"display_name": "D3C4FF",
"reputation": 3127,
"email_hash": "b376fbe6933daa281c17c4eb4720461f"
},
"post_id": 31532,
"post_type": "answer",
"score": 0,
"body": "As mentioned in the question, i am NOT after a tool to reverse a type 7 password! Feel free to try and add "2KFQnbNIdI.2KYOU" into cain and see if it works anywhere. I've tried under two different machines and IOS-MD5 is the wrong length and PIX-MD5 does not crack to 'cisco'"
},
{
"comment_id": 48824,
"creation_date": 1361942812,
"owner": {
"user_id": 11306,
"user_type": "registered",
"display_name": "ponsfonze",
"reputation": 810,
"email_hash": "b5774b7300c55109439646c575eac450"
},
"reply_to_user": {
"user_id": 18541,
"user_type": "registered",
"display_name": "D3C4FF",
"reputation": 3127,
"email_hash": "b376fbe6933daa281c17c4eb4720461f"
},
"post_id": 31532,
"post_type": "answer",
"score": 0,
"body": "@D3C4FF I have added a tutorial on how to crack the password with Cain. I am not sure what problem your having. Maybe it's a typo or an ancient version of Cain."
},
{
"comment_id": 48929,
"creation_date": 1362003154,
"owner": {
"user_id": 18541,
"user_type": "registered",
"display_name": "D3C4FF",
"reputation": 3127,
"email_hash": "b376fbe6933daa281c17c4eb4720461f"
},
"post_id": 31532,
"post_type": "answer",
"score": 0,
"body": "Turns out it was just the dictionary attack that had issues with Cain. When I tried with the above method it worked as well. Thanks."
}
]
},
{
"answer_id": 31597,
"accepted": false,
"answer_comments_url": "/answers/31597/comments",
"question_id": 31518,
"owner": {
"user_id": 37,
"user_type": "registered",
"display_name": "Rory McCune",
"reputation": 14435,
"email_hash": "040408df933f894cf97230cb65fcbf85"
},
"creation_date": 1361958277,
"last_activity_date": 1361958277,
"up_vote_count": 0,
"down_vote_count": 1,
"view_count": 1981,
"score": -1,
"community_owned": false,
"title": "Cracking CISCO ASA Passwords",
"comments": [
{
"comment_id": 48839,
"creation_date": 1361971164,
"owner": {
"user_id": 18541,
"user_type": "registered",
"display_name": "D3C4FF",
"reputation": 3127,
"email_hash": "b376fbe6933daa281c17c4eb4720461f"
},
"post_id": 31597,
"post_type": "answer",
"score": 0,
"body": "I know its a blank password, and that the secondary password is Cisco. I pulled those values off other configs because of that. I've found the solution to my issues myself. It seems that cain doesn't like using the dictionary i supplied and that's why it didn't crack, when i tried using brute-force it worked fine. Additionally OCL-Hashcat-Plus works with GPU accel and cracks both the VM Passwords and enable/passwd passwords."
}
]
}
],
"accepted_answer_id": 31673,
"favorite_count": 4,
"question_timeline_url": "/questions/31518/timeline",
"question_comments_url": "/questions/31518/comments",
"question_answers_url": "/questions/31518/answers",
"question_id": 31518,
"owner": {
"user_id": 18541,
"user_type": "registered",
"display_name": "D3C4FF",
"reputation": 3127,
"email_hash": "b376fbe6933daa281c17c4eb4720461f"
},
"creation_date": 1361837972,
"last_edit_date": 1361875237,
"last_activity_date": 1362007035,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 1981,
"score": 1,
"community_owned": false,
"title": "Cracking CISCO ASA Passwords",
"comments": []
},
{
"tags": [
"cryptography"
],
"answer_count": 3,
"answers": [
{
"answer_id": 31267,
"accepted": true,
"answer_comments_url": "/answers/31267/comments",
"question_id": 31219,
"owner": {
"user_id": 5411,
"user_type": "registered",
"display_name": "Tom Leek",
"reputation": 24996,
"email_hash": "e2e94675a01dd4477eef7750db006817"
},
"creation_date": 1361450280,
"last_activity_date": 1361450280,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 183,
"score": 3,
"community_owned": false,
"title": "An OS that does not trust its RAM?",
"comments": [
{
"comment_id": 48360,
"creation_date": 1361452157,
"owner": {
"user_id": 15648,
"user_type": "registered",
"display_name": "d33tah",
"reputation": 277,
"email_hash": "15098b2b940cacd8b4d07026e01e3102"
},
"post_id": 31267,
"post_type": "answer",
"score": 0,
"body": "How about allocating as much RAM as possible and putting an encrypted swapfile then?"
},
{
"comment_id": 48374,
"creation_date": 1361460051,
"owner": {
"user_id": 5411,
"user_type": "registered",
"display_name": "Tom Leek",
"reputation": 24996,
"email_hash": "e2e94675a01dd4477eef7750db006817"
},
"reply_to_user": {
"user_id": 15648,
"user_type": "registered",
"display_name": "d33tah",
"reputation": 277,
"email_hash": "15098b2b940cacd8b4d07026e01e3102"
},
"post_id": 31267,
"post_type": "answer",
"score": 0,
"body": "Question is about not letting clear content make it to the RAM itself, not to the swapfile. Cold boot attacks plunder the contents of the RAM chips directly."
}
]
},
{
"answer_id": 31220,
"accepted": false,
"answer_comments_url": "/answers/31220/comments",
"question_id": 31219,
"owner": {
"user_id": 15648,
"user_type": "registered",
"display_name": "d33tah",
"reputation": 277,
"email_hash": "15098b2b940cacd8b4d07026e01e3102"
},
"creation_date": 1361403346,
"last_activity_date": 1361403346,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 183,
"score": 1,
"community_owned": false,
"title": "An OS that does not trust its RAM?",
"comments": []
},
{
"answer_id": 31244,
"accepted": false,
"answer_comments_url": "/answers/31244/comments",
"question_id": 31219,
"owner": {
"user_id": 836,
"user_type": "moderator",
"display_name": "Jeff Ferland",
"reputation": 21466,
"email_hash": "34e5e0b41202f3c375552750c0d6f309"
},
"creation_date": 1361436628,
"last_edit_date": 1361437048,
"last_activity_date": 1361437048,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 183,
"score": 1,
"community_owned": false,
"title": "An OS that does not trust its RAM?",
"comments": []
}
],
"accepted_answer_id": 31267,
"favorite_count": 0,
"question_timeline_url": "/questions/31219/timeline",
"question_comments_url": "/questions/31219/comments",
"question_answers_url": "/questions/31219/answers",
"question_id": 31219,
"owner": {
"user_id": 15648,
"user_type": "registered",
"display_name": "d33tah",
"reputation": 277,
"email_hash": "15098b2b940cacd8b4d07026e01e3102"
},
"creation_date": 1361402530,
"last_activity_date": 1361450280,
"up_vote_count": 5,
"down_vote_count": 3,
"view_count": 183,
"score": 2,
"community_owned": false,
"title": "An OS that does not trust its RAM?",
"comments": [
{
"comment_id": 48314,
"creation_date": 1361402915,
"owner": {
"user_id": 12,
"user_type": "registered",
"display_name": "Xander",
"reputation": 2464,
"email_hash": "e8b50a4728b3393a9a16ddecb0d82abb"
},
"post_id": 31219,
"post_type": "question",
"score": 2,
"body": "Possible duplicate of this question: security.stackexchange.com/questions/8278/os-with-encrypted-ram"
},
{
"comment_id": 48315,
"creation_date": 1361403165,
"owner": {
"user_id": 15648,
"user_type": "registered",
"display_name": "d33tah",
"reputation": 277,
"email_hash": "15098b2b940cacd8b4d07026e01e3102"
},
"reply_to_user": {
"user_id": 12,
"user_type": "registered",
"display_name": "Xander",
"reputation": 2464,
"email_hash": "e8b50a4728b3393a9a16ddecb0d82abb"
},
"post_id": 31219,
"post_type": "question",
"score": 0,
"body": "Not really, I think."
}
]
},
{
"tags": [
"cryptography",
"ethernet"
],
"answer_count": 2,
"answers": [
{
"answer_id": 31218,
"accepted": false,
"answer_comments_url": "/answers/31218/comments",
"question_id": 31216,
"owner": {
"user_id": 8857,
"user_type": "registered",
"display_name": "B-Con",
"reputation": 1102,
"email_hash": "abfc3c69a8e326fa8ea1b4acad286ebf"
},
"creation_date": 1361402348,
"last_edit_date": 1361403053,
"last_activity_date": 1361403053,
"up_vote_count": 5,
"down_vote_count": 0,
"view_count": 133,
"score": 5,
"community_owned": false,
"title": "Ethernet security",
"comments": [
{
"comment_id": 48317,
"creation_date": 1361404052,
"owner": {
"user_id": 20987,
"user_type": "registered",
"display_name": "eli",
"reputation": 21,
"email_hash": "5fcc64bb29eae7b142c8d50bef9a7d81"
},
"post_id": 31218,
"post_type": "answer",
"score": 0,
"body": "Thanks a lot; this information is very useful! I have to go over the first part again! Website login passwords are in particular a great concern. If they get your passwords, they do not need further interception anymore!"
}
]
},
{
"answer_id": 31221,
"accepted": false,
"answer_comments_url": "/answers/31221/comments",
"question_id": 31216,
"owner": {
"user_id": 20945,
"user_type": "registered",
"display_name": "Peleus",
"reputation": 1061,
"email_hash": "25271152b0a44b52df593ed99ac839f9"
},
"creation_date": 1361404232,
"last_activity_date": 1361404232,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 133,
"score": 3,
"community_owned": false,
"title": "Ethernet security",
"comments": [
{
"comment_id": 48318,
"creation_date": 1361404854,
"owner": {
"user_id": 20987,
"user_type": "registered",
"display_name": "eli",
"reputation": 21,
"email_hash": "5fcc64bb29eae7b142c8d50bef9a7d81"
},
"post_id": 31221,
"post_type": "answer",
"score": 0,
"body": "Great simple answers to simple questions! Wish I had enough privileges to vote up! How much does VPN slow down the traffic? Like you may watch youtube during your 1 week conference, video chat with wife, etc; not sure if VPN gets annoying in such traffic."
},
{
"comment_id": 48319,
"creation_date": 1361405055,
"owner": {
"user_id": 20945,
"user_type": "registered",
"display_name": "Peleus",
"reputation": 1061,
"email_hash": "25271152b0a44b52df593ed99ac839f9"
},
"reply_to_user": {
"user_id": 20987,
"user_type": "registered",
"display_name": "eli",
"reputation": 21,
"email_hash": "5fcc64bb29eae7b142c8d50bef9a7d81"
},
"post_id": 31221,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "For what you're referring to you have speed as in latency, and speed as in bandwidth. It terms of latency your ping times will typically increase a little, because instead of going directly to a requested IP you go via your VPN provider, wherever their gateway is located. This could be the other side of the country, or the other side of the world (useful for bypassing geo IP restrictions).\n\nIn terms of bandwidth it depends on your provider. They typically you'll still be able to watch youtube etc fine, chat with the wife, but you might not get as fast downloads."
},
{
"comment_id": 48324,
"creation_date": 1361410614,
"owner": {
"user_id": 953,
"user_type": "registered",
"display_name": "Iszi",
"reputation": 9238,
"email_hash": "8f8571493d71202986f2a6ab0dbd7c23"
},
"post_id": 31221,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "Arguably, the mobile modem (these days more likely to be a 4G mobile Wi-Fi hotspot) is actually more convenient - no cable to run, no need to worry about re-configuring you system to work with their network, and (most importantly here, and of course presuming you're using strong security on the Wi-Fi side plus a VPN) effectively zero chance of the competitor having access to your traffic any easier than they would if you were in your own office."
},
{
"comment_id": 48325,
"creation_date": 1361419563,
"owner": {
"user_id": 20945,
"user_type": "registered",
"display_name": "Peleus",
"reputation": 1061,
"email_hash": "25271152b0a44b52df593ed99ac839f9"
},
"post_id": 31221,
"post_type": "answer",
"score": 0,
"body": "Highly recommend against the Wifi component if you're after security but yes, you're right in that it's convinent for light use - the type the OP describes. Only downside is a little added expense, but if you're looking for a decent VPN anyway...."
},
{
"comment_id": 48327,
"creation_date": 1361422029,
"owner": {
"user_id": 10211,
"user_type": "registered",
"display_name": "Terry Chia",
"reputation": 11070,
"email_hash": "b62ccba5dd465e468c77c495dd67b737"
},
"post_id": 31221,
"post_type": "answer",
"score": 0,
"body": "@Peleus A properly secured mobile modem belonging to you is certainly more secure than connecting to an unknown network..."
},
{
"comment_id": 48331,
"creation_date": 1361430906,
"owner": {
"user_id": 20945,
"user_type": "registered",
"display_name": "Peleus",
"reputation": 1061,
"email_hash": "25271152b0a44b52df593ed99ac839f9"
},
"reply_to_user": {
"user_id": 10211,
"user_type": "registered",
"display_name": "Terry Chia",
"reputation": 11070,
"email_hash": "b62ccba5dd465e468c77c495dd67b737"
},
"post_id": 31221,
"post_type": "answer",
"score": 0,
"body": "@Terry True, however adding a Wifi hotspot component is a horrible idea if security is your primary goal. Plug it in via usb!"
}
]
}
],
"favorite_count": 1,
"question_timeline_url": "/questions/31216/timeline",
"question_comments_url": "/questions/31216/comments",
"question_answers_url": "/questions/31216/answers",
"question_id": 31216,
"owner": {
"user_id": 20987,
"user_type": "registered",
"display_name": "eli",
"reputation": 21,
"email_hash": "5fcc64bb29eae7b142c8d50bef9a7d81"
},
"creation_date": 1361400063,
"last_activity_date": 1361404232,
"up_vote_count": 4,
"down_vote_count": 0,
"view_count": 133,
"score": 4,
"community_owned": false,
"title": "Ethernet security",
"comments": [
{
"comment_id": 48311,
"creation_date": 1361400684,
"owner": {
"user_id": 5248,
"user_type": "registered",
"display_name": "David Stratton",
"reputation": 1209,
"email_hash": "fb2c6622e14993de52d47c77b2b872a1"
},
"post_id": 31216,
"post_type": "question",
"score": 0,
"body": "I don't know the answers to your questions, but have you considered getting a Air Card for your laptop that allows you to use your cell phone plan and bypass the competitor's Ethernet altogether? I'm not sure how secure they are, but I'd feel safer than plugging into a competitor's network. Alternatively, I'd get a laptop with no sensitive data and just not risk it. More info on air cards here: news.cnet.com/8300-5_3-0.html?keyword=aircard"
},
{
"comment_id": 48312,
"creation_date": 1361401168,
"owner": {
"user_id": 20987,
"user_type": "registered",
"display_name": "eli",
"reputation": 21,
"email_hash": "5fcc64bb29eae7b142c8d50bef9a7d81"
},
"reply_to_user": {
"user_id": 5248,
"user_type": "registered",
"display_name": "David Stratton",
"reputation": 1209,
"email_hash": "fb2c6622e14993de52d47c77b2b872a1"
},
"post_id": 31216,
"post_type": "question",
"score": 0,
"body": "Thanks a lot. Roaming charges get a lot if you travel often. Also nothing matches Ethernet in speed. But thanks for pointing out this; I check it out."
},
{
"comment_id": 48313,
"creation_date": 1361401317,
"owner": {
"user_id": 5248,
"user_type": "registered",
"display_name": "David Stratton",
"reputation": 1209,
"email_hash": "fb2c6622e14993de52d47c77b2b872a1"
},
"post_id": 31216,
"post_type": "question",
"score": 0,
"body": "LOL I'm sure someone smarter than me will answer your questions in detail. I just posted what I'd do if I really didn't trust the company not to steal my secrets."
}
]
},
{
"tags": [
"cryptography",
"aes",
"asymmetric"
],
"answer_count": 2,
"answers": [
{
"answer_id": 31142,
"accepted": true,
"answer_comments_url": "/answers/31142/comments",
"question_id": 31139,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1361281408,
"last_activity_date": 1361281408,
"up_vote_count": 6,
"down_vote_count": 0,
"view_count": 365,
"score": 6,
"community_owned": false,
"title": "How X509 Certificates are used for Encryption",
"comments": []
},
{
"answer_id": 31147,
"accepted": false,
"answer_comments_url": "/answers/31147/comments",
"question_id": 31139,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"creation_date": 1361286022,
"last_activity_date": 1361286022,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 365,
"score": 1,
"community_owned": false,
"title": "How X509 Certificates are used for Encryption",
"comments": []
}
],
"accepted_answer_id": 31142,
"favorite_count": 0,
"question_timeline_url": "/questions/31139/timeline",
"question_comments_url": "/questions/31139/comments",
"question_answers_url": "/questions/31139/answers",
"question_id": 31139,
"owner": {
"user_id": 20192,
"user_type": "registered",
"display_name": "Nitin Gurram",
"reputation": 118,
"email_hash": "ab0ec3942060f24505cea7580953ebf2"
},
"creation_date": 1361280152,
"last_edit_date": 1361285542,
"last_activity_date": 1361361567,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 365,
"score": 3,
"community_owned": false,
"title": "How X509 Certificates are used for Encryption",
"comments": [
{
"comment_id": 48198,
"creation_date": 1361284341,
"owner": {
"user_id": 9377,
"user_type": "registered",
"display_name": "lynks",
"reputation": 4352,
"email_hash": "9a21812b9a1037044c110bc3c8948627"
},
"post_id": 31139,
"post_type": "question",
"score": 1,
"body": "A minor note, but AES is a symmetric algorithm, because the same key is used for encryption and decryption. Public key algorithms such as RSA are asymmetric because two different keys are used."
}
]
},
{
"tags": [
"cryptography",
"hash"
],
"answer_count": 5,
"answers": [
{
"answer_id": 31082,
"accepted": false,
"answer_comments_url": "/answers/31082/comments",
"question_id": 31072,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1361190300,
"last_activity_date": 1361190300,
"up_vote_count": 6,
"down_vote_count": 0,
"view_count": 332,
"score": 6,
"community_owned": false,
"title": "The security level in hash function",
"comments": [
{
"comment_id": 48094,
"creation_date": 1361190989,
"owner": {
"user_id": 20896,
"user_type": "registered",
"display_name": "Mustafa basil",
"reputation": 16,
"email_hash": "d56dcf72d6767dbbcfe4e8c34d7b0b6a"
},
"post_id": 31082,
"post_type": "answer",
"score": 0,
"body": "thanks for the answer"
},
{
"comment_id": 48117,
"creation_date": 1361204206,
"owner": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 31082,
"post_type": "answer",
"score": 2,
"edit_count": 1,
"body": "A quick calculation shows that the bitcoin network currently needs ~45 days for 2^64 SHA-256 compressions. Since ASIC will roll out in the coming months) it will be even faster soon."
}
]
},
{
"answer_id": 31077,
"accepted": false,
"answer_comments_url": "/answers/31077/comments",
"question_id": 31072,
"owner": {
"user_id": 9377,
"user_type": "registered",
"display_name": "lynks",
"reputation": 4352,
"email_hash": "9a21812b9a1037044c110bc3c8948627"
},
"creation_date": 1361186633,
"last_activity_date": 1361186633,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 332,
"score": 1,
"community_owned": false,
"title": "The security level in hash function",
"comments": [
{
"comment_id": 48088,
"creation_date": 1361186869,
"owner": {
"user_id": 20896,
"user_type": "registered",
"display_name": "Mustafa basil",
"reputation": 16,
"email_hash": "d56dcf72d6767dbbcfe4e8c34d7b0b6a"
},
"post_id": 31077,
"post_type": "answer",
"score": 0,
"body": "thanks, is there any equation show the relation between increase or decrease security and increase or decrease message digest length?"
}
]
},
{
"answer_id": 31079,
"accepted": false,
"answer_comments_url": "/answers/31079/comments",
"question_id": 31072,
"owner": {
"user_id": 5400,
"user_type": "registered",
"display_name": "Polynomial",
"reputation": 32757,
"email_hash": "6fc641bdddde78a51c0db6b8527c54f7"
},
"creation_date": 1361187766,
"last_edit_date": 1361192462,
"last_activity_date": 1361192462,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 332,
"score": 1,
"community_owned": false,
"title": "The security level in hash function",
"comments": [
{
"comment_id": 48091,
"creation_date": 1361188772,
"owner": {
"user_id": 20896,
"user_type": "registered",
"display_name": "Mustafa basil",
"reputation": 16,
"email_hash": "d56dcf72d6767dbbcfe4e8c34d7b0b6a"
},
"post_id": 31079,
"post_type": "answer",
"score": 0,
"body": "thank you , Great answer, but i want to ask what is the bound for brute-force collision finding. i mean, i have md5 with 128 bits (16bytes), and i will use only 80bits (10 bytes) it means that am near from realms of feasibility in terms of brute-force collision finding. and how to know mathematically am near or not?"
},
{
"comment_id": 48092,
"creation_date": 1361190404,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"reply_to_user": {
"user_id": 20896,
"user_type": "registered",
"display_name": "Mustafa basil",
"reputation": 16,
"email_hash": "d56dcf72d6767dbbcfe4e8c34d7b0b6a"
},
"post_id": 31079,
"post_type": "answer",
"score": 0,
"body": "@Mustafabasil: collisions on an 80-bit hash function imply an effort of about 2^40 hash function invocations, thus feasible on a simple PC (it may take a few days)."
},
{
"comment_id": 48093,
"creation_date": 1361190495,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"post_id": 31079,
"post_type": "answer",
"score": 0,
"body": "@Polynomial: since collisions are in effort sqrt(N) for a space of size N, 80-bit output is very weak, and even 128-bit output is too short for comfort. You might have been thinking of preimages, which do not have this "square root" effect."
},
{
"comment_id": 48099,
"creation_date": 1361192240,
"owner": {
"user_id": 5400,
"user_type": "registered",
"display_name": "Polynomial",
"reputation": 32757,
"email_hash": "6fc641bdddde78a51c0db6b8527c54f7"
},
"post_id": 31079,
"post_type": "answer",
"score": 0,
"body": "Ah yes, I forgot it was sqrt. I was thinking of cracking keys for some reason."
}
]
},
{
"answer_id": 31117,
"accepted": false,
"answer_comments_url": "/answers/31117/comments",
"question_id": 31072,
"owner": {
"user_id": 8281,
"user_type": "registered",
"display_name": "KeithS",
"reputation": 2684,
"email_hash": "8f455043e5d839da0c6695407b318ad5"
},
"creation_date": 1361218358,
"last_edit_date": 1367342233,
"last_activity_date": 1367342233,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 332,
"score": 1,
"community_owned": false,
"title": "The security level in hash function",
"comments": []
},
{
"answer_id": 31073,
"accepted": false,
"answer_comments_url": "/answers/31073/comments",
"question_id": 31072,
"owner": {
"user_id": 10877,
"user_type": "registered",
"display_name": "m1ke",
"reputation": 88,
"email_hash": "f79ef1e32a93dfc9e65b807d80b1a14a"
},
"creation_date": 1361181989,
"last_activity_date": 1361181989,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 332,
"score": 0,
"community_owned": false,
"title": "The security level in hash function",
"comments": [
{
"comment_id": 48086,
"creation_date": 1361182625,
"owner": {
"user_id": 20896,
"user_type": "registered",
"display_name": "Mustafa basil",
"reputation": 16,
"email_hash": "d56dcf72d6767dbbcfe4e8c34d7b0b6a"
},
"post_id": 31073,
"post_type": "answer",
"score": 0,
"body": "thanks for the answer, ya i mean the first one, if it's secure to check part of digest?\n\nOk , is there any equation that show you how much security you loss when you use a part of message digest not all?"
}
]
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/31072/timeline",
"question_comments_url": "/questions/31072/comments",
"question_answers_url": "/questions/31072/answers",
"question_id": 31072,
"owner": {
"user_id": 20896,
"user_type": "registered",
"display_name": "Mustafa basil",
"reputation": 16,
"email_hash": "d56dcf72d6767dbbcfe4e8c34d7b0b6a"
},
"creation_date": 1361179818,
"last_edit_date": 1361184720,
"last_activity_date": 1367342233,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 332,
"score": 3,
"community_owned": false,
"title": "The security level in hash function",
"comments": []
},
{
"tags": [
"encryption",
"cryptography",
"pgp",
"oracle",
"timing-attack"
],
"answer_count": 2,
"answers": [
{
"answer_id": 30785,
"accepted": false,
"answer_comments_url": "/answers/30785/comments",
"question_id": 30782,
"owner": {
"user_id": 5411,
"user_type": "registered",
"display_name": "Tom Leek",
"reputation": 24996,
"email_hash": "e2e94675a01dd4477eef7750db006817"
},
"creation_date": 1360686593,
"last_activity_date": 1360686593,
"up_vote_count": 6,
"down_vote_count": 0,
"view_count": 172,
"score": 6,
"community_owned": false,
"title": "Is it reasonable to prevent timing attacks by using fixed processing time",
"comments": [
{
"comment_id": 47633,
"creation_date": 1360686907,
"owner": {
"user_id": 396,
"user_type": "registered",
"display_name": "makerofthings7",
"reputation": 12638,
"email_hash": "9cc3e3bb2ff2ef30810be80ca741de70"
},
"post_id": 30785,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "I just rediscovered this answer (see comments) that talks about when to use fixed duration for encryption. I'm trying to mentally synthesize all answers now..."
},
{
"comment_id": 47755,
"creation_date": 1360762774,
"owner": {
"user_id": 18452,
"user_type": "registered",
"display_name": "Michael",
"reputation": 272,
"email_hash": "a0cda7900b386e459fa6452a468144bd"
},
"post_id": 30785,
"post_type": "answer",
"score": 0,
"body": "Addition of a random delay will increase the complexity of the analysis (and the number of samples needed), but ultimately I think that any underlying variance in timing that is dependent on secrets will still leak - the random delay will 'average out', but the leakage won't."
}
]
},
{
"answer_id": 30793,
"accepted": false,
"answer_comments_url": "/answers/30793/comments",
"question_id": 30782,
"owner": {
"user_id": 8857,
"user_type": "registered",
"display_name": "B-Con",
"reputation": 1102,
"email_hash": "abfc3c69a8e326fa8ea1b4acad286ebf"
},
"creation_date": 1360689507,
"last_activity_date": 1360689507,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 172,
"score": 1,
"community_owned": false,
"title": "Is it reasonable to prevent timing attacks by using fixed processing time",
"comments": []
}
],
"favorite_count": 1,
"question_timeline_url": "/questions/30782/timeline",
"question_comments_url": "/questions/30782/comments",
"question_answers_url": "/questions/30782/answers",
"question_id": 30782,
"owner": {
"user_id": 396,
"user_type": "registered",
"display_name": "makerofthings7",
"reputation": 12638,
"email_hash": "9cc3e3bb2ff2ef30810be80ca741de70"
},
"creation_date": 1360685619,
"last_edit_date": 1360690838,
"last_activity_date": 1360690838,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 172,
"score": 3,
"community_owned": false,
"title": "Is it reasonable to prevent timing attacks by using fixed processing time",
"comments": [
{
"comment_id": 47636,
"creation_date": 1360687753,
"owner": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 30782,
"post_type": "question",
"score": 1,
"edit_count": 1,
"body": "Good crypto libraries are immune to this by not using any branches, secret dependent lookups etc. But if you have badly designed protocols(such as MAC then encrypt with CBC) it's hard to write a good implementation."
}
]
},
{
"tags": [
"encryption",
"cryptography"
],
"answer_count": 2,
"answers": [
{
"answer_id": 30615,
"accepted": true,
"answer_comments_url": "/answers/30615/comments",
"question_id": 30613,
"owner": {
"user_id": 5411,
"user_type": "registered",
"display_name": "Tom Leek",
"reputation": 24996,
"email_hash": "e2e94675a01dd4477eef7750db006817"
},
"creation_date": 1360468743,
"last_activity_date": 1360468743,
"up_vote_count": 4,
"down_vote_count": 0,
"view_count": 87,
"score": 4,
"community_owned": false,
"title": "Securing Time Sensitive Data",
"comments": [
{
"comment_id": 47441,
"creation_date": 1360469785,
"owner": {
"user_id": 20443,
"user_type": "registered",
"display_name": "Bob Watson",
"reputation": 1909,
"email_hash": "7bd248e2ee4ca54659a21c0d8f794e44"
},
"post_id": 30615,
"post_type": "answer",
"score": 0,
"body": "VaultIC looks like the sort of thing I'm after; SMS is tricky because reliably sending SMS internationally (which is where a lot of the out of contact people are) is a tricky issue. I hadn't heard of VaultIC before today, but it looks very promising."
}
]
},
{
"answer_id": 30614,
"accepted": false,
"answer_comments_url": "/answers/30614/comments",
"question_id": 30613,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"creation_date": 1360463600,
"last_activity_date": 1360463600,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 87,
"score": 0,
"community_owned": false,
"title": "Securing Time Sensitive Data",
"comments": [
{
"comment_id": 47437,
"creation_date": 1360463905,
"owner": {
"user_id": 20443,
"user_type": "registered",
"display_name": "Bob Watson",
"reputation": 1909,
"email_hash": "7bd248e2ee4ca54659a21c0d8f794e44"
},
"post_id": 30614,
"post_type": "answer",
"score": 0,
"body": "SecurID tokens aren't out of the question - the tricky part is how to arrange the files/crypto to only work with keys generated after a certain time."
},
{
"comment_id": 47547,
"creation_date": 1360590590,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 20443,
"user_type": "registered",
"display_name": "Bob Watson",
"reputation": 1909,
"email_hash": "7bd248e2ee4ca54659a21c0d8f794e44"
},
"post_id": 30614,
"post_type": "answer",
"score": 0,
"body": "SecurID wouldn't be all that secure because while you could require them to enter the current code, it lacks the faculties to time protect the key release. You could write a program that required a code after a given point to be entered, but that program would only really be able to obscure the key. Alternativly, I guess you could forward generate a number of codes and encrypt the key with each of those codes as a password, which would give a limited time to access the key, but it would also simplify offline attacks significantly as there would only be 100,000,000 possible keys."
}
]
}
],
"accepted_answer_id": 30615,
"favorite_count": 0,
"question_timeline_url": "/questions/30613/timeline",
"question_comments_url": "/questions/30613/comments",
"question_answers_url": "/questions/30613/answers",
"question_id": 30613,
"owner": {
"user_id": 20443,
"user_type": "registered",
"display_name": "Bob Watson",
"reputation": 1909,
"email_hash": "7bd248e2ee4ca54659a21c0d8f794e44"
},
"creation_date": 1360461418,
"last_activity_date": 1360468743,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 87,
"score": 3,
"community_owned": false,
"title": "Securing Time Sensitive Data",
"comments": []
},
{
"tags": [
"cryptography",
"hash"
],
"answer_count": 1,
"answers": [
{
"answer_id": 30602,
"accepted": false,
"answer_comments_url": "/answers/30602/comments",
"question_id": 30596,
"owner": {
"user_id": 20443,
"user_type": "registered",
"display_name": "Bob Watson",
"reputation": 1909,
"email_hash": "7bd248e2ee4ca54659a21c0d8f794e44"
},
"creation_date": 1360446141,
"last_activity_date": 1360446141,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 179,
"score": 1,
"community_owned": false,
"title": "sha-512 vs sha-3?",
"comments": []
}
],
"favorite_count": 0,
"closed_date": 1360446718,
"closed_reason": "exact duplicate",
"question_timeline_url": "/questions/30596/timeline",
"question_comments_url": "/questions/30596/comments",
"question_answers_url": "/questions/30596/answers",
"question_id": 30596,
"owner": {
"user_id": 19949,
"user_type": "registered",
"display_name": "user16986",
"reputation": 13,
"email_hash": "57d0445313ddb20b8b37eb2cf7ac85ae"
},
"creation_date": 1360439946,
"last_edit_date": 1360483823,
"last_activity_date": 1360483823,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 179,
"score": 2,
"community_owned": false,
"title": "sha-512 vs sha-3?",
"comments": [
{
"comment_id": 47420,
"creation_date": 1360441515,
"owner": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 30596,
"post_type": "question",
"score": 0,
"body": "At least higher security margin and no length extensions."
},
{
"comment_id": 47422,
"creation_date": 1360441732,
"owner": {
"user_id": 19949,
"user_type": "registered",
"display_name": "user16986",
"reputation": 13,
"email_hash": "57d0445313ddb20b8b37eb2cf7ac85ae"
},
"reply_to_user": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 30596,
"post_type": "question",
"score": 0,
"edit_count": 1,
"body": ""higher security margin" - And that means?"
},
{
"comment_id": 47423,
"creation_date": 1360442098,
"owner": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 30596,
"post_type": "question",
"score": 0,
"body": "that it's probably harder to break."
},
{
"comment_id": 47427,
"creation_date": 1360444778,
"owner": {
"user_id": 19949,
"user_type": "registered",
"display_name": "user16986",
"reputation": 13,
"email_hash": "57d0445313ddb20b8b37eb2cf7ac85ae"
},
"reply_to_user": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 30596,
"post_type": "question",
"score": 0,
"body": "with an emphasis on "probably" - no one actually knows which one is harder to break..."
},
{
"comment_id": 47429,
"creation_date": 1360446793,
"owner": {
"user_id": 485,
"user_type": "moderator",
"display_name": "Rory Alsop",
"reputation": 32567,
"email_hash": "af1ed0816ed5a2164a4e343ad09309ad"
},
"post_id": 30596,
"post_type": "question",
"score": 0,
"body": "@nealmcb's answer on the linked question details the reasons for Keccak very well."
}
]
},
{
"tags": [
"cryptography",
"aes",
"openssl",
"ruby"
],
"answer_count": 2,
"answers": [
{
"answer_id": 30345,
"accepted": true,
"answer_comments_url": "/answers/30345/comments",
"question_id": 30344,
"owner": {
"user_id": 12407,
"user_type": "registered",
"display_name": "Stephen Touset",
"reputation": 1139,
"email_hash": "9ff064364151151cbce108b869e6e62d"
},
"creation_date": 1360094305,
"last_edit_date": 1360094945,
"last_activity_date": 1360094945,
"up_vote_count": 8,
"down_vote_count": 0,
"view_count": 537,
"score": 8,
"community_owned": false,
"title": "Why does OpenSSL not include AES-256-GCM?",
"comments": [
{
"comment_id": 47419,
"creation_date": 1360441098,
"owner": {
"user_id": 20423,
"user_type": "registered",
"display_name": "Sai",
"reputation": 109,
"email_hash": "7c8bd7823026cdf4dcb00e890ea8ab98"
},
"post_id": 30345,
"post_type": "answer",
"score": 0,
"body": "Buried in your answer was a hint at what my real problem was: namely, the rvm I had installed linked against OpenSSL 0.9.8."
}
]
},
{
"answer_id": 30348,
"accepted": false,
"answer_comments_url": "/answers/30348/comments",
"question_id": 30344,
"owner": {
"user_id": 5411,
"user_type": "registered",
"display_name": "Tom Leek",
"reputation": 24996,
"email_hash": "e2e94675a01dd4477eef7750db006817"
},
"creation_date": 1360094490,
"last_activity_date": 1360094490,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 537,
"score": 2,
"community_owned": false,
"title": "Why does OpenSSL not include AES-256-GCM?",
"comments": [
{
"comment_id": 47421,
"creation_date": 1360441526,
"owner": {
"user_id": 20423,
"user_type": "registered",
"display_name": "Sai",
"reputation": 109,
"email_hash": "7c8bd7823026cdf4dcb00e890ea8ab98"
},
"post_id": 30348,
"post_type": "answer",
"score": 0,
"body": "I wasn't talking about SSL/TLS, FWIW. I didn't want the SHA384 part of it (we're using ec-dsa for signing)."
}
]
}
],
"accepted_answer_id": 30345,
"favorite_count": 1,
"closed_date": 1360105212,
"closed_reason": "not a real question",
"question_timeline_url": "/questions/30344/timeline",
"question_comments_url": "/questions/30344/comments",
"question_answers_url": "/questions/30344/answers",
"question_id": 30344,
"owner": {
"user_id": 20423,
"user_type": "registered",
"display_name": "Sai",
"reputation": 109,
"email_hash": "7c8bd7823026cdf4dcb00e890ea8ab98"
},
"creation_date": 1360093736,
"last_edit_date": 1360441401,
"last_activity_date": 1360441401,
"up_vote_count": 2,
"down_vote_count": 2,
"view_count": 537,
"score": 0,
"community_owned": false,
"title": "Why does OpenSSL not include AES-256-GCM?",
"comments": []
},
{
"tags": [
"cryptography",
"web-application",
"hash",
"http",
"md5"
],
"answer_count": 4,
"answers": [
{
"answer_id": 30294,
"accepted": false,
"answer_comments_url": "/answers/30294/comments",
"question_id": 30289,
"owner": {
"user_id": 5400,
"user_type": "registered",
"display_name": "Polynomial",
"reputation": 32757,
"email_hash": "6fc641bdddde78a51c0db6b8527c54f7"
},
"creation_date": 1360059967,
"last_edit_date": 1360067279,
"last_activity_date": 1360067279,
"up_vote_count": 4,
"down_vote_count": 0,
"view_count": 221,
"score": 4,
"community_owned": false,
"title": "Is using the md5 hashing algorithm as method for authorization in an HTTP POST request unsafe?",
"comments": [
{
"comment_id": 46946,
"creation_date": 1360065298,
"owner": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 30294,
"post_type": "answer",
"score": 1,
"edit_count": 1,
"body": "md5(a + b) == md5(a + c) The attacker won't be able to find such a collision, unless he knows all of a, b and c, and he chose part of both b and c himself. He won't be able to find such message pairs at all for SHA-2. Your claim is even stronger, since you say the attacker doesn't need to know b, so he doesn't just need to find a collision, he needs to find a second pre-image. We don't know how to do that for md5."
},
{
"comment_id": 46947,
"creation_date": 1360065414,
"owner": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 30294,
"post_type": "answer",
"score": 0,
"edit_count": 2,
"body": "I suspect you were talking about length extensions, but those don't allow you to find collisions. They only allow you to figure out a message extension m1 for which you know hash(k+m0+m1) if you know hash(k+m0). But that hash differers from the original hash. Length extension is dangerous if you use hash(k+m0) as MAC."
},
{
"comment_id": 46948,
"creation_date": 1360065462,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"post_id": 30294,
"post_type": "answer",
"score": 1,
"body": "@Polynomial: if you can do your point 1, then you know how to break preimage resistance of MD5, and you should publish an article. Alternatively, change that to the following: given md5(a), it is possible to compute md5(a+b+c) where b depends only on the length of a, and c can be chosen arbitrarily -- and this can be done without knowing a itself (only its length)."
},
{
"comment_id": 46950,
"creation_date": 1360067204,
"owner": {
"user_id": 5400,
"user_type": "registered",
"display_name": "Polynomial",
"reputation": 32757,
"email_hash": "6fc641bdddde78a51c0db6b8527c54f7"
},
"post_id": 30294,
"post_type": "answer",
"score": 0,
"body": "Whoops, my bad!"
},
{
"comment_id": 47256,
"creation_date": 1360299219,
"owner": {
"user_id": 20392,
"user_type": "registered",
"display_name": "michaelrbock",
"reputation": 1,
"email_hash": "10e24ed6ef2d6e98ab60ddc00057607c"
},
"post_id": 30294,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "Thanks for the info. I was mistaken, the POST request I believe goes over HTTPS...or at least the url the POST request is made to begins https://"
}
]
},
{
"answer_id": 30298,
"accepted": false,
"answer_comments_url": "/answers/30298/comments",
"question_id": 30289,
"owner": {
"user_id": 20398,
"user_type": "registered",
"display_name": "ruief",
"reputation": 572,
"email_hash": "0c14780ce54866b39833694208f167cb"
},
"creation_date": 1360061084,
"last_activity_date": 1360061084,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 221,
"score": 3,
"community_owned": false,
"title": "Is using the md5 hashing algorithm as method for authorization in an HTTP POST request unsafe?",
"comments": []
},
{
"answer_id": 30293,
"accepted": false,
"answer_comments_url": "/answers/30293/comments",
"question_id": 30289,
"owner": {
"user_id": 4295,
"user_type": "registered",
"display_name": "David Schwartz",
"reputation": 2121,
"email_hash": "346ca03edfbde2a468adc289867ab975"
},
"creation_date": 1360059641,
"last_activity_date": 1360059641,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 221,
"score": 2,
"community_owned": false,
"title": "Is using the md5 hashing algorithm as method for authorization in an HTTP POST request unsafe?",
"comments": []
},
{
"answer_id": 30302,
"accepted": false,
"answer_comments_url": "/answers/30302/comments",
"question_id": 30289,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1360066240,
"last_activity_date": 1360066240,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 221,
"score": 2,
"community_owned": false,
"title": "Is using the md5 hashing algorithm as method for authorization in an HTTP POST request unsafe?",
"comments": [
{
"comment_id": 47257,
"creation_date": 1360299398,
"owner": {
"user_id": 20392,
"user_type": "registered",
"display_name": "michaelrbock",
"reputation": 1,
"email_hash": "10e24ed6ef2d6e98ab60ddc00057607c"
},
"post_id": 30302,
"post_type": "answer",
"score": 0,
"body": "So if the POST request is made over HTTPS, then it's safe?"
}
]
}
],
"favorite_count": 1,
"question_timeline_url": "/questions/30289/timeline",
"question_comments_url": "/questions/30289/comments",
"question_answers_url": "/questions/30289/answers",
"question_id": 30289,
"owner": {
"user_id": 20392,
"user_type": "registered",
"display_name": "michaelrbock",
"reputation": 1,
"email_hash": "10e24ed6ef2d6e98ab60ddc00057607c"
},
"creation_date": 1360054679,
"last_edit_date": 1360299051,
"last_activity_date": 1360299051,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 221,
"score": 0,
"community_owned": false,
"title": "Is using the md5 hashing algorithm as method for authorization in an HTTP POST request unsafe?",
"comments": [
{
"comment_id": 46925,
"creation_date": 1360057771,
"owner": {
"user_id": 11801,
"user_type": "registered",
"display_name": "Ali Ahmad",
"reputation": 1453,
"email_hash": "213640d2094df6d75b4c9344846aaef1"
},
"post_id": 30289,
"post_type": "question",
"score": 0,
"edit_count": 2,
"body": "What i recommend "Don't Reinvent the Wheel" go for single sign on services such as Shibboleth"
},
{
"comment_id": 46927,
"creation_date": 1360058787,
"owner": {
"user_id": 18541,
"user_type": "registered",
"display_name": "D3C4FF",
"reputation": 3127,
"email_hash": "b376fbe6933daa281c17c4eb4720461f"
},
"post_id": 30289,
"post_type": "question",
"score": 1,
"body": "MD5 is weak compared to other hashing algorithms. If you're going to transfer any sensitive data, i'd reccomend doing it over SSL/TLS to reduce the chances of anyone capturing and attacking the MD5"
},
{
"comment_id": 47094,
"creation_date": 1360156414,
"owner": {
"user_id": 4200,
"user_type": "registered",
"display_name": "Ramhound",
"reputation": 441,
"email_hash": "f96b8099bc4e94d6a5a82debb21e0479"
},
"post_id": 30289,
"post_type": "question",
"score": 0,
"body": "MD5 should not be used authenticate a user and should not be connected to any user data."
},
{
"comment_id": 47258,
"creation_date": 1360305017,
"owner": {
"user_id": 13905,
"user_type": "registered",
"display_name": "Henning Klevjer",
"reputation": 1344,
"email_hash": "ef0a0962ba481196b1702ae255e71e98"
},
"post_id": 30289,
"post_type": "question",
"score": 0,
"edit_count": 2,
"body": "If the password is of >128 bits entropy, you're fine. Also, this might be of interest: klevjers.com/projects/master/digest%20attack/digattack.pdf"
}
]
},
{
"tags": [
"cryptography",
"aes",
"web-service"
],
"answer_count": 1,
"answers": [
{
"answer_id": 30226,
"accepted": false,
"answer_comments_url": "/answers/30226/comments",
"question_id": 30225,
"owner": {
"user_id": 16502,
"user_type": "registered",
"display_name": "Callum Wilson",
"reputation": 1285,
"email_hash": "5b71c36bad02b411d657e96418036541"
},
"creation_date": 1359972438,
"last_activity_date": 1359972438,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 73,
"score": 1,
"community_owned": false,
"title": "Securing the SOAP Messages",
"comments": [
{
"comment_id": 46848,
"creation_date": 1359973865,
"owner": {
"user_id": 20192,
"user_type": "registered",
"display_name": "Nitin Gurram",
"reputation": 118,
"email_hash": "ab0ec3942060f24505cea7580953ebf2"
},
"post_id": 30226,
"post_type": "answer",
"score": 0,
"body": "Because we don't want them in each one of the services. We want to implement for particular/specific data which they want it to be done from Java side"
}
]
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/30225/timeline",
"question_comments_url": "/questions/30225/comments",
"question_answers_url": "/questions/30225/answers",
"question_id": 30225,
"owner": {
"user_id": 20192,
"user_type": "registered",
"display_name": "Nitin Gurram",
"reputation": 118,
"email_hash": "ab0ec3942060f24505cea7580953ebf2"
},
"creation_date": 1359971995,
"last_edit_date": 1359977897,
"last_activity_date": 1359977897,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 73,
"score": 0,
"community_owned": false,
"title": "Securing the SOAP Messages",
"comments": []
},
{
"tags": [
"cryptography",
"php",
"aes"
],
"answer_count": 1,
"answers": [
{
"answer_id": 30169,
"accepted": true,
"answer_comments_url": "/answers/30169/comments",
"question_id": 30168,
"owner": {
"user_id": 5411,
"user_type": "registered",
"display_name": "Tom Leek",
"reputation": 24996,
"email_hash": "e2e94675a01dd4477eef7750db006817"
},
"creation_date": 1359832583,
"last_edit_date": 1359834321,
"last_activity_date": 1359834321,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 399,
"score": 1,
"community_owned": false,
"title": "aes cfb 128 decryption /encryption problem between Erlang and PHP",
"comments": [
{
"comment_id": 46766,
"creation_date": 1359833136,
"owner": {
"user_id": 20324,
"user_type": "registered",
"display_name": "Gordon Guthrie",
"reputation": 108,
"email_hash": "df140e5ac5c948da6c88911886857b49"
},
"post_id": 30169,
"post_type": "answer",
"score": 0,
"body": "Apologies I realised that I had it a bit wrong - I have added an extra bit..."
},
{
"comment_id": 46767,
"creation_date": 1359833321,
"owner": {
"user_id": 20324,
"user_type": "registered",
"display_name": "Gordon Guthrie",
"reputation": 108,
"email_hash": "df140e5ac5c948da6c88911886857b49"
},
"post_id": 30169,
"post_type": "answer",
"score": 0,
"body": "ie I have updated the question with a section on CFB mode."
},
{
"comment_id": 46772,
"creation_date": 1359835544,
"owner": {
"user_id": 20324,
"user_type": "registered",
"display_name": "Gordon Guthrie",
"reputation": 108,
"email_hash": "df140e5ac5c948da6c88911886857b49"
},
"post_id": 30169,
"post_type": "answer",
"score": 0,
"body": "Yay, works - see update..."
},
{
"comment_id": 46775,
"creation_date": 1359836404,
"owner": {
"user_id": 20324,
"user_type": "registered",
"display_name": "Gordon Guthrie",
"reputation": 108,
"email_hash": "df140e5ac5c948da6c88911886857b49"
},
"post_id": 30169,
"post_type": "answer",
"score": 0,
"body": "I have posted a link to this question on PHP documentation so hopefully the next person using Erlang (and others) won't get caught by this..."
}
]
}
],
"accepted_answer_id": 30169,
"favorite_count": 0,
"question_timeline_url": "/questions/30168/timeline",
"question_comments_url": "/questions/30168/comments",
"question_answers_url": "/questions/30168/answers",
"question_id": 30168,
"owner": {
"user_id": 20324,
"user_type": "registered",
"display_name": "Gordon Guthrie",
"reputation": 108,
"email_hash": "df140e5ac5c948da6c88911886857b49"
},
"creation_date": 1359832215,
"last_edit_date": 1359836359,
"last_activity_date": 1359836359,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 399,
"score": 1,
"community_owned": false,
"title": "aes cfb 128 decryption /encryption problem between Erlang and PHP",
"comments": []
},
{
"tags": [
"cryptography",
"passwords",
"hash",
"password-policy"
],
"answer_count": 3,
"answers": [
{
"answer_id": 30060,
"accepted": false,
"answer_comments_url": "/answers/30060/comments",
"question_id": 30058,
"owner": {
"user_id": 6939,
"user_type": "registered",
"display_name": "mgibsonbr",
"reputation": 956,
"email_hash": "414aae1257ee9e58014bd81bf438a662"
},
"creation_date": 1359704041,
"last_edit_date": 1359721775,
"last_activity_date": 1359721775,
"up_vote_count": 4,
"down_vote_count": 0,
"view_count": 228,
"score": 4,
"community_owned": false,
"title": "Use of rainbow tables with the NY Times hack?",
"comments": [
{
"comment_id": 46651,
"creation_date": 1359720549,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"post_id": 30060,
"post_type": "answer",
"score": 2,
"body": "You can amend your "generally greater" into "always greater". Building a table which can recover X passwords has cost 1.7*X, while brute force with the same set of X passwords has average cost X/2 and worst cost X, always lower than the rainbow table cost."
}
]
},
{
"answer_id": 30114,
"accepted": false,
"answer_comments_url": "/answers/30114/comments",
"question_id": 30058,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1359742950,
"last_activity_date": 1359742950,
"up_vote_count": 4,
"down_vote_count": 0,
"view_count": 228,
"score": 4,
"community_owned": false,
"title": "Use of rainbow tables with the NY Times hack?",
"comments": []
},
{
"answer_id": 30084,
"accepted": true,
"answer_comments_url": "/answers/30084/comments",
"question_id": 30058,
"owner": {
"user_id": 7886,
"user_type": "registered",
"display_name": "pgolen",
"reputation": 344,
"email_hash": "41b35730a47054ea6324aec9b89c8b39"
},
"creation_date": 1359732050,
"last_activity_date": 1359732050,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 228,
"score": 2,
"community_owned": false,
"title": "Use of rainbow tables with the NY Times hack?",
"comments": [
{
"comment_id": 46674,
"creation_date": 1359739416,
"owner": {
"user_id": 20257,
"user_type": "registered",
"display_name": "Gabriel",
"reputation": 128,
"email_hash": "1ab80f21f95e8925c23e9a847157c20b"
},
"post_id": 30084,
"post_type": "answer",
"score": 0,
"body": "That's interesting that Windows does not salt passwords, I had assumed they would. It seems like a poor security choice that should be fixed by now."
},
{
"comment_id": 46706,
"creation_date": 1359754573,
"owner": {
"user_id": 7886,
"user_type": "registered",
"display_name": "pgolen",
"reputation": 344,
"email_hash": "41b35730a47054ea6324aec9b89c8b39"
},
"reply_to_user": {
"user_id": 20257,
"user_type": "registered",
"display_name": "Gabriel",
"reputation": 128,
"email_hash": "1ab80f21f95e8925c23e9a847157c20b"
},
"post_id": 30084,
"post_type": "answer",
"score": 0,
"body": "@Gabriel: Well, password hashes in Windows could be better, but fixing it is not as easy at it might look. Main problem - backward compatibility."
},
{
"comment_id": 46708,
"creation_date": 1359754982,
"owner": {
"user_id": 7886,
"user_type": "registered",
"display_name": "pgolen",
"reputation": 344,
"email_hash": "41b35730a47054ea6324aec9b89c8b39"
},
"reply_to_user": {
"user_id": 20257,
"user_type": "registered",
"display_name": "Gabriel",
"reputation": 128,
"email_hash": "1ab80f21f95e8925c23e9a847157c20b"
},
"post_id": 30084,
"post_type": "answer",
"score": 1,
"body": "@Gabriel: But on the other hand if an attacker is able to dump password hashes he or she most likely had already gained administrator rights. It is also important to note that attacker doesn't need to crack password hash, there is an interesting attack called "pass the hash" (en.wikipedia.org/wiki/Pass_the_hash). Check also this: blogs.technet.com/b/trustworthycomputing/archive/2012/12/11/…"
}
]
}
],
"accepted_answer_id": 30084,
"favorite_count": 0,
"question_timeline_url": "/questions/30058/timeline",
"question_comments_url": "/questions/30058/comments",
"question_answers_url": "/questions/30058/answers",
"question_id": 30058,
"owner": {
"user_id": 20257,
"user_type": "registered",
"display_name": "Gabriel",
"reputation": 128,
"email_hash": "1ab80f21f95e8925c23e9a847157c20b"
},
"creation_date": 1359698057,
"last_edit_date": 1359743082,
"last_activity_date": 1359743082,
"up_vote_count": 5,
"down_vote_count": 0,
"view_count": 228,
"score": 5,
"community_owned": false,
"title": "Use of rainbow tables with the NY Times hack?",
"comments": []
},
{
"tags": [
"cryptography",
"authentication",
"hash",
"sha"
],
"answer_count": 2,
"answers": [
{
"answer_id": 30039,
"accepted": true,
"answer_comments_url": "/answers/30039/comments",
"question_id": 30037,
"owner": {
"user_id": 5411,
"user_type": "registered",
"display_name": "Tom Leek",
"reputation": 24996,
"email_hash": "e2e94675a01dd4477eef7750db006817"
},
"creation_date": 1359662326,
"last_activity_date": 1359662326,
"up_vote_count": 6,
"down_vote_count": 0,
"view_count": 115,
"score": 6,
"community_owned": false,
"title": "Easy protocol for email authentication",
"comments": [
{
"comment_id": 46613,
"creation_date": 1359665581,
"owner": {
"user_id": 20243,
"user_type": "registered",
"display_name": "Alejandro Piad",
"reputation": 113,
"email_hash": "3107f581caff4908475a5c278bb093bf"
},
"post_id": 30039,
"post_type": "answer",
"score": 0,
"body": "Thanks a lot. Yes I forgot to mention the fact that hashes are stored to prevent replay attacks (although I didn't know that was the name). I've read through the articles and I think I'll give a try to HMAC. Despite the practical issues regarding software reuse and so, which I totally agree, I also have a kind of "academic" interest in implementing the thing by myself and seen how it works. What hash would you suggest for HMAC?"
},
{
"comment_id": 46615,
"creation_date": 1359666165,
"owner": {
"user_id": 5411,
"user_type": "registered",
"display_name": "Tom Leek",
"reputation": 24996,
"email_hash": "e2e94675a01dd4477eef7750db006817"
},
"reply_to_user": {
"user_id": 20243,
"user_type": "registered",
"display_name": "Alejandro Piad",
"reputation": 113,
"email_hash": "3107f581caff4908475a5c278bb093bf"
},
"post_id": 30039,
"post_type": "answer",
"score": 1,
"body": "The default answer for "which hash function" is SHA-256, and it will be fine for HMAC."
}
]
},
{
"answer_id": 30040,
"accepted": false,
"answer_comments_url": "/answers/30040/comments",
"question_id": 30037,
"owner": {
"user_id": 1080,
"user_type": "registered",
"display_name": "bethlakshmi",
"reputation": 6289,
"email_hash": "a4dceca566159e483cb8748012eb3ab2"
},
"creation_date": 1359663919,
"last_activity_date": 1359663919,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 115,
"score": 3,
"community_owned": false,
"title": "Easy protocol for email authentication",
"comments": [
{
"comment_id": 46614,
"creation_date": 1359665939,
"owner": {
"user_id": 20243,
"user_type": "registered",
"display_name": "Alejandro Piad",
"reputation": 113,
"email_hash": "3107f581caff4908475a5c278bb093bf"
},
"post_id": 30040,
"post_type": "answer",
"score": 0,
"body": "Thanks too for the useful comments. I really have not so important stuff to protect, and most of all, very few users which I know personally, so for now I will not deal with rekeying (if I have to, I can just do it manually). The point about the simplicity of using the signing mechanisms in mail clients is very solid, I will consider it more deeply. Anyway I was planning no to make users write the emails in the first place, but instead give them a custom application that generates emails on the background. In any case you make very good points. +1."
},
{
"comment_id": 46616,
"creation_date": 1359666916,
"owner": {
"user_id": 1080,
"user_type": "registered",
"display_name": "bethlakshmi",
"reputation": 6289,
"email_hash": "a4dceca566159e483cb8748012eb3ab2"
},
"reply_to_user": {
"user_id": 20243,
"user_type": "registered",
"display_name": "Alejandro Piad",
"reputation": 113,
"email_hash": "3107f581caff4908475a5c278bb093bf"
},
"post_id": 30040,
"post_type": "answer",
"score": 0,
"body": "Neat! A background client-that-just-does-what-they-want, may have a very different set of factors - at that point, email is just the conduit, it's all about the user telling it what to do. In many basic programming tool kits, PKI is NOT the easiest thing in the world, there's a lot of assumptions that get made and it can be non-intuitive... so mileage varies. :)"
}
]
}
],
"accepted_answer_id": 30039,
"favorite_count": 0,
"question_timeline_url": "/questions/30037/timeline",
"question_comments_url": "/questions/30037/comments",
"question_answers_url": "/questions/30037/answers",
"question_id": 30037,
"owner": {
"user_id": 20243,
"user_type": "registered",
"display_name": "Alejandro Piad",
"reputation": 113,
"email_hash": "3107f581caff4908475a5c278bb093bf"
},
"creation_date": 1359661368,
"last_activity_date": 1359663919,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 115,
"score": 2,
"community_owned": false,
"title": "Easy protocol for email authentication",
"comments": []
},
{
"tags": [
"encryption",
"cryptography",
"ssl"
],
"answer_count": 4,
"answers": [
{
"answer_id": 30000,
"accepted": true,
"answer_comments_url": "/answers/30000/comments",
"question_id": 29986,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1359635166,
"last_activity_date": 1359635166,
"up_vote_count": 6,
"down_vote_count": 0,
"view_count": 268,
"score": 6,
"community_owned": false,
"title": "Can an attacker reuse stolen SSL private key to recreate that domain on his server",
"comments": []
},
{
"answer_id": 30003,
"accepted": false,
"answer_comments_url": "/answers/30003/comments",
"question_id": 29986,
"owner": {
"user_id": 18315,
"user_type": "registered",
"display_name": "Dinu S",
"reputation": 1481,
"email_hash": "dca05ac1ce0a49b33357f50901f7a467"
},
"creation_date": 1359636349,
"last_activity_date": 1359636349,
"up_vote_count": 5,
"down_vote_count": 0,
"view_count": 268,
"score": 5,
"community_owned": false,
"title": "Can an attacker reuse stolen SSL private key to recreate that domain on his server",
"comments": [
{
"comment_id": 46585,
"creation_date": 1359646482,
"owner": {
"user_id": 17035,
"user_type": "registered",
"display_name": "mricon",
"reputation": 755,
"email_hash": "fcd791a56792e612a8ed1ddbbfa73535"
},
"post_id": 30003,
"post_type": "answer",
"score": 1,
"body": "That being said, some browsers treat inability to verify revocation status as a "soft fail" and will trust the certificate. So, if the attacker that has your site's private key is able to fully MITM your traffic (e.g. via a rogue AP), they can refuse access to the OCSP server and pass the revoked certificate as still valid. Chrome has repeatedly threatened to not even bother with OCSP, famously calling it "seat belts that snap when you crash" (arstechnica.com/business/2012/02/…)."
},
{
"comment_id": 46609,
"creation_date": 1359661405,
"owner": {
"user_id": 18315,
"user_type": "registered",
"display_name": "Dinu S",
"reputation": 1481,
"email_hash": "dca05ac1ce0a49b33357f50901f7a467"
},
"reply_to_user": {
"user_id": 17035,
"user_type": "registered",
"display_name": "mricon",
"reputation": 755,
"email_hash": "fcd791a56792e612a8ed1ddbbfa73535"
},
"post_id": 30003,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "It is true, but the problem was that the server certificate is compromised and not every user's network. I checked today and Chrome is performing Ocsp checks."
}
]
},
{
"answer_id": 30001,
"accepted": false,
"answer_comments_url": "/answers/30001/comments",
"question_id": 29986,
"owner": {
"user_id": 1615,
"user_type": "registered",
"display_name": "Zed",
"reputation": 121,
"email_hash": "cb42e51a731985567d66447186ebd6c0"
},
"creation_date": 1359635418,
"last_activity_date": 1359635418,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 268,
"score": 2,
"community_owned": false,
"title": "Can an attacker reuse stolen SSL private key to recreate that domain on his server",
"comments": []
},
{
"answer_id": 29987,
"accepted": false,
"answer_comments_url": "/answers/29987/comments",
"question_id": 29986,
"owner": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"creation_date": 1359611955,
"last_edit_date": 1359682608,
"last_activity_date": 1359682608,
"up_vote_count": 2,
"down_vote_count": 1,
"view_count": 268,
"score": 1,
"community_owned": false,
"title": "Can an attacker reuse stolen SSL private key to recreate that domain on his server",
"comments": [
{
"comment_id": 46574,
"creation_date": 1359634676,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"post_id": 29987,
"post_type": "answer",
"score": 5,
"body": "I have yet to see a certificate in the wild with an IP address in it, and, more to the point, a browser which checks that IP address."
},
{
"comment_id": 46576,
"creation_date": 1359635788,
"owner": {
"user_id": 1615,
"user_type": "registered",
"display_name": "Zed",
"reputation": 121,
"email_hash": "cb42e51a731985567d66447186ebd6c0"
},
"post_id": 29987,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "You often need an IP address per domain not because any specific address is embedded in the certificate but because the SSL handshake takes place before the browser gets a chance to send the HTTP Host header. The server has to know which certificate to send and it's easiest if every domain uses a separate IP. You can also use different port per domain, but then your address will be https://example.com:12345/ instead https://example.com/ for every port other than 443. There is now Server Name Indication to solve that issue but it doesn't work on Windows XP which stops its adoption."
},
{
"comment_id": 46632,
"creation_date": 1359682469,
"owner": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"reply_to_user": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"post_id": 29987,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "@Thomas Pornin - To my knowledge the common name header in the SSL certificate (the one it's verified against with CA) can contain an IP address. Or a wildcard, for example for sub-domains *.example.com. I'm not sure what number of web browsers support such certificates, but according to the link I now added to my post, they quote 99.99% browser support."
},
{
"comment_id": 46649,
"creation_date": 1359719991,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"post_id": 29987,
"post_type": "answer",
"score": 0,
"body": "@TildalWave: it is true that the Subject Alt Name extension can contain IP addresses; but it is equally true that no client checks them. Clients follow RFC 2818 and check names of type dNSName, i.e. server names. As for wildcards, they are supported but they are still about names, not IP addresses; and they are quite the opposite of "locking"."
},
{
"comment_id": 46661,
"creation_date": 1359732751,
"owner": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"reply_to_user": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"post_id": 29987,
"post_type": "answer",
"score": 0,
"body": "@Thomas Pornin - But couldn't technically speaking that header simply contain an IP address? Saying it otherwise, if the DNS look-up doesn't resolve, wouldn't it default to the IP then? I'm not saying this is how it works, don't get me wrong, I'm just assuming based on my own understanding of things and it's also what value I return for non-resolvable DNS look-ups with my own socks libraries (default behavior, which can be changed of course). How can that business I link to in my post then offer 'SSL Certificates that are specially issued to secure an IP-address'? Thanks & cheers!"
},
{
"comment_id": 46663,
"creation_date": 1359735376,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"post_id": 29987,
"post_type": "answer",
"score": 0,
"body": "@TildalWave: that name-checking business is totally disjoint from DNS. This is a certificate business and is described by RFC 2818 and it will certainly not look at the names of iPAddress because 1) it is not defined that way, and 2) it would break the security model: the idea is to verify that the name which the user sees in the URL is found in the certificate. The user does not see the IP address. The IP address was obtained from the DNS in a non-secure way."
},
{
"comment_id": 46669,
"creation_date": 1359737516,
"owner": {
"user_id": 20074,
"user_type": "registered",
"display_name": "TildalWave",
"reputation": 3876,
"email_hash": "fe9695ecf5357e79060712ad77ce7c4d"
},
"reply_to_user": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"post_id": 29987,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "@Thomas Pornin - OK, so if I get this right what you're saying is, if I make some website accessible through an IP only (say https://1.1.1.1/) for SSL encrypted connections, and the certificate is also pointing to this IP address instead of a domain name, then the certificate would not report any errors and there is indeed a way to 'protect an IP address with a certificate' like that business is promising? Did I get this right? TA"
},
{
"comment_id": 46670,
"creation_date": 1359737726,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"post_id": 29987,
"post_type": "answer",
"score": 0,
"body": "@TildalWave: no, it is the opposite. You can put an IP address in a certificate, but no browser will look at it. Browsers insist on using names (and the standards say that they must do so)."
}
]
}
],
"accepted_answer_id": 30000,
"favorite_count": 0,
"question_timeline_url": "/questions/29986/timeline",
"question_comments_url": "/questions/29986/comments",
"question_answers_url": "/questions/29986/answers",
"question_id": 29986,
"owner": {
"user_id": 16822,
"user_type": "registered",
"display_name": "Kevin Parker",
"reputation": 30,
"email_hash": "f746d26770ad36c01d2e9cd848b69ed9"
},
"creation_date": 1359609564,
"last_edit_date": 1359617205,
"last_activity_date": 1359682608,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 268,
"score": 3,
"community_owned": false,
"title": "Can an attacker reuse stolen SSL private key to recreate that domain on his server",
"comments": []
},
{
"tags": [
"encryption",
"cryptography",
"ssh",
"openssl"
],
"answer_count": 2,
"answers": [
{
"answer_id": 29880,
"accepted": true,
"answer_comments_url": "/answers/29880/comments",
"question_id": 29876,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1359473957,
"last_activity_date": 1359473957,
"up_vote_count": 5,
"down_vote_count": 0,
"view_count": 151,
"score": 5,
"community_owned": false,
"title": "What are the differences between ssh generated keys(ssh-keygen) and OpenSSL keys (PEM)and what is more secure for ssh remote login?",
"comments": []
},
{
"answer_id": 29879,
"accepted": false,
"answer_comments_url": "/answers/29879/comments",
"question_id": 29876,
"owner": {
"user_id": 17035,
"user_type": "registered",
"display_name": "mricon",
"reputation": 755,
"email_hash": "fcd791a56792e612a8ed1ddbbfa73535"
},
"creation_date": 1359471857,
"last_activity_date": 1359471857,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 151,
"score": 1,
"community_owned": false,
"title": "What are the differences between ssh generated keys(ssh-keygen) and OpenSSL keys (PEM)and what is more secure for ssh remote login?",
"comments": []
}
],
"accepted_answer_id": 29880,
"favorite_count": 0,
"question_timeline_url": "/questions/29876/timeline",
"question_comments_url": "/questions/29876/comments",
"question_answers_url": "/questions/29876/answers",
"question_id": 29876,
"owner": {
"user_id": 20155,
"user_type": "registered",
"display_name": "tlarevo",
"reputation": 18,
"email_hash": "f2aa68d7d3962447e469d5275cfe1608"
},
"creation_date": 1359469282,
"last_activity_date": 1359473957,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 151,
"score": 3,
"community_owned": false,
"title": "What are the differences between ssh generated keys(ssh-keygen) and OpenSSL keys (PEM)and what is more secure for ssh remote login?",
"comments": [
{
"comment_id": 46464,
"creation_date": 1359510240,
"owner": {
"user_id": 919,
"user_type": "registered",
"display_name": "Zoredache",
"reputation": 228,
"email_hash": "7776063fafb29c1d896ec1e239eddd11"
},
"post_id": 29876,
"post_type": "question",
"score": 0,
"body": "Generate your SSH keys with openssl if you like. The only part that is special is the public key."
}
]
},
{
"tags": [
"cryptography",
"php"
],
"answer_count": 2,
"answers": [
{
"answer_id": 29830,
"accepted": true,
"answer_comments_url": "/answers/29830/comments",
"question_id": 29826,
"creation_date": 1359401193,
"last_edit_date": 1359469024,
"last_activity_date": 1359469024,
"up_vote_count": 2,
"down_vote_count": 1,
"view_count": 80,
"score": 1,
"community_owned": false,
"title": "What is the best way to generate keys in phpseclib?",
"comments": [
{
"comment_id": 46340,
"creation_date": 1359413911,
"owner": {
"user_id": 18434,
"user_type": "registered",
"display_name": "bobbyaldol",
"reputation": 33,
"email_hash": "4b6fb476a65f8ffa8332017c36f60e4b"
},
"post_id": 29830,
"post_type": "answer",
"score": 1,
"body": "As it seems there are many php sec libraries. The one that I am talking about is phpseclib.sourceforge.net."
},
{
"comment_id": 46405,
"creation_date": 1359475134,
"owner": {
"user_id": 15922,
"user_type": "registered",
"display_name": "neubert",
"reputation": 200,
"email_hash": "7872694d27b3b6fd8d71297a4799a82b"
},
"post_id": 29830,
"post_type": "answer",
"score": 0,
"body": "First, when people talk about phpseclib they're probably talking about the "sourceforge" version. First ten sites on Google are for that version anyway. Second, the "sourceforge" version has been hosted on github since last year: github.com/phpseclib . Check out ohloh.net/p/phpseclib vs. ohloh.net/p/phpsec"
},
{
"comment_id": 46483,
"creation_date": 1359541348,
"owner": {
"user_id": 18434,
"user_type": "registered",
"display_name": "bobbyaldol",
"reputation": 33,
"email_hash": "4b6fb476a65f8ffa8332017c36f60e4b"
},
"post_id": 29830,
"post_type": "answer",
"score": 0,
"body": "ohh! thank you."
}
]
},
{
"answer_id": 29882,
"accepted": false,
"answer_comments_url": "/answers/29882/comments",
"question_id": 29826,
"owner": {
"user_id": 15922,
"user_type": "registered",
"display_name": "neubert",
"reputation": 200,
"email_hash": "7872694d27b3b6fd8d71297a4799a82b"
},
"creation_date": 1359474888,
"last_activity_date": 1359474888,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 80,
"score": 1,
"community_owned": false,
"title": "What is the best way to generate keys in phpseclib?",
"comments": []
}
],
"accepted_answer_id": 29830,
"favorite_count": 0,
"question_timeline_url": "/questions/29826/timeline",
"question_comments_url": "/questions/29826/comments",
"question_answers_url": "/questions/29826/answers",
"question_id": 29826,
"owner": {
"user_id": 18434,
"user_type": "registered",
"display_name": "bobbyaldol",
"reputation": 33,
"email_hash": "4b6fb476a65f8ffa8332017c36f60e4b"
},
"creation_date": 1359400161,
"last_activity_date": 1359474888,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 80,
"score": 0,
"community_owned": false,
"title": "What is the best way to generate keys in phpseclib?",
"comments": []
},
{
"tags": [
"cryptography"
],
"answer_count": 2,
"answers": [
{
"answer_id": 29727,
"accepted": false,
"answer_comments_url": "/answers/29727/comments",
"question_id": 29723,
"owner": {
"user_id": 15701,
"user_type": "registered",
"display_name": "F. Hauri",
"reputation": 899,
"email_hash": "f2dcfe3194de7a9e1a1cdaa81933b307"
},
"creation_date": 1359189510,
"last_edit_date": 1359190691,
"last_activity_date": 1359190691,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 189,
"score": 1,
"community_owned": false,
"title": "What is the difference between protocols and algorithms?",
"comments": []
},
{
"answer_id": 29724,
"accepted": false,
"answer_comments_url": "/answers/29724/comments",
"question_id": 29723,
"owner": {
"user_id": 19805,
"user_type": "registered",
"display_name": "aRun",
"reputation": 413,
"email_hash": "6b05c1650cd02b9849341401094e3b49"
},
"creation_date": 1359174033,
"last_activity_date": 1359174033,
"up_vote_count": 0,
"down_vote_count": 1,
"view_count": 189,
"score": -1,
"community_owned": false,
"title": "What is the difference between protocols and algorithms?",
"comments": []
}
],
"favorite_count": 0,
"closed_date": 1359193862,
"closed_reason": "off topic",
"question_timeline_url": "/questions/29723/timeline",
"question_comments_url": "/questions/29723/comments",
"question_answers_url": "/questions/29723/answers",
"question_id": 29723,
"owner": {
"user_id": 20054,
"user_type": "registered",
"display_name": "aishuishou",
"reputation": 4,
"email_hash": "b760be4f8d0ac172a89beae287e56b76"
},
"creation_date": 1359172339,
"last_edit_date": 1359191036,
"last_activity_date": 1359191036,
"up_vote_count": 1,
"down_vote_count": 1,
"view_count": 189,
"score": 0,
"community_owned": false,
"title": "What is the difference between protocols and algorithms?",
"comments": [
{
"comment_id": 46152,
"creation_date": 1359193859,
"owner": {
"user_id": 485,
"user_type": "moderator",
"display_name": "Rory Alsop",
"reputation": 32567,
"email_hash": "af1ed0816ed5a2164a4e343ad09309ad"
},
"post_id": 29723,
"post_type": "question",
"score": 0,
"body": "Welcome to the site - this isn't on topic here, unfortunately, as it is simply a terminology question, and not a security question (have a look at the faq for definitions)"
}
]
},
{
"tags": [
"encryption",
"cryptography",
"hash",
"sha"
],
"answer_count": 5,
"answers": [
{
"answer_id": 29486,
"accepted": true,
"answer_comments_url": "/answers/29486/comments",
"question_id": 29482,
"owner": {
"user_id": 13905,
"user_type": "registered",
"display_name": "Henning Klevjer",
"reputation": 1344,
"email_hash": "ef0a0962ba481196b1702ae255e71e98"
},
"creation_date": 1358839987,
"last_edit_date": 1358841171,
"last_activity_date": 1358841171,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 290,
"score": 3,
"community_owned": false,
"title": "Is SHA-1 encryption?",
"comments": []
},
{
"answer_id": 29488,
"accepted": false,
"answer_comments_url": "/answers/29488/comments",
"question_id": 29482,
"owner": {
"user_id": 18192,
"user_type": "registered",
"display_name": "Cristian Dobre",
"reputation": 3890,
"email_hash": "bdf704acd5eb21225c99c83c3995016f"
},
"creation_date": 1358840709,
"last_edit_date": 1358866620,
"last_activity_date": 1358866620,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 290,
"score": 3,
"community_owned": false,
"title": "Is SHA-1 encryption?",
"comments": []
},
{
"answer_id": 29513,
"accepted": false,
"answer_comments_url": "/answers/29513/comments",
"question_id": 29482,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1358868583,
"last_activity_date": 1358868583,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 290,
"score": 2,
"community_owned": false,
"title": "Is SHA-1 encryption?",
"comments": []
},
{
"answer_id": 29487,
"accepted": false,
"answer_comments_url": "/answers/29487/comments",
"question_id": 29482,
"owner": {
"user_id": 19778,
"user_type": "registered",
"display_name": "sujeesh",
"reputation": 166,
"email_hash": "82b76e427d3ff973c7f10263e58d4e13"
},
"creation_date": 1358840049,
"last_activity_date": 1358840049,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 290,
"score": 0,
"community_owned": false,
"title": "Is SHA-1 encryption?",
"comments": []
},
{
"answer_id": 29534,
"accepted": false,
"answer_comments_url": "/answers/29534/comments",
"question_id": 29482,
"owner": {
"user_id": 8281,
"user_type": "registered",
"display_name": "KeithS",
"reputation": 2684,
"email_hash": "8f455043e5d839da0c6695407b318ad5"
},
"creation_date": 1358883732,
"last_activity_date": 1358883732,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 290,
"score": 0,
"community_owned": false,
"title": "Is SHA-1 encryption?",
"comments": []
}
],
"accepted_answer_id": 29486,
"favorite_count": 0,
"question_timeline_url": "/questions/29482/timeline",
"question_comments_url": "/questions/29482/comments",
"question_answers_url": "/questions/29482/answers",
"question_id": 29482,
"owner": {
"user_id": 2053,
"user_type": "registered",
"display_name": "T. Webster",
"reputation": 435,
"email_hash": "c637581e3ac1604e93c492bb8dc5b312"
},
"creation_date": 1358835062,
"last_edit_date": 1358868704,
"last_activity_date": 1358883732,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 290,
"score": 1,
"community_owned": false,
"title": "Is SHA-1 encryption?",
"comments": []
},
{
"tags": [
"cryptography",
"authentication",
"key-management",
"ssh",
"key-generation"
],
"answer_count": 4,
"answers": [
{
"answer_id": 29446,
"accepted": false,
"answer_comments_url": "/answers/29446/comments",
"question_id": 29440,
"owner": {
"user_id": 414,
"user_type": "registered",
"display_name": "Gilles",
"reputation": 10126,
"email_hash": "a717291747c76567bb0f086e15ae6e43"
},
"creation_date": 1358789039,
"last_activity_date": 1358789039,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 303,
"score": 2,
"community_owned": false,
"title": "SSH: reusing public keys and known-man-in-the-middle",
"comments": [
{
"comment_id": 45716,
"creation_date": 1358807018,
"owner": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29446,
"post_type": "answer",
"score": 0,
"edit_count": 2,
"body": "1)\n>Note that there are two key pairs involved in an SSH connection\nThere might be a slight confusion in the naming scheme: I've just named 'Server2\\etc\\ssh\\ssh_host_rsa_key.pub' "S2_id_rsa.pub", and "S1_id_rsa.pub" is defined in the same manner.\n2) \n>If PC1 has connected to S2 before, then PC1 (or more precisely the account of the user on PC1) has memorized S2's host public key in its known_hosts file\n\nEm... The thing is, in my algorithm , Server1 provides PC1 with S1_id_rsa.pub, not S2<..>.pub"
}
]
},
{
"answer_id": 29445,
"accepted": false,
"answer_comments_url": "/answers/29445/comments",
"question_id": 29440,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"creation_date": 1358788476,
"last_edit_date": 1358904374,
"last_activity_date": 1358904374,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 303,
"score": 1,
"community_owned": false,
"title": "SSH: reusing public keys and known-man-in-the-middle",
"comments": [
{
"comment_id": 45717,
"creation_date": 1358807372,
"owner": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"body": ">the client would know they are talking to server 1 \n\nThe thing is, client intentionally wants to connect to Server1, that's why I've named the question "known-man-in-the-middle"
},
{
"comment_id": 45841,
"creation_date": 1358904424,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"body": "@Igor ah, OK. Updated my answer to address your question better."
},
{
"comment_id": 45889,
"creation_date": 1358959210,
"owner": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "Em.... As far as I understood, you're still saying that P1 wants to connect to S2. But it wants to connect to S1 instead. The thing is, as far as I understood, only ssh server needs to sign his part of DH key with his private key for server to get authenticated (maybe this is required for keyboard-interactive authentication to be possible). So, S1 doesn't need to "fake" any private key. He may use his own key. It's known and trusted. Client authenthication works a bit different. And again, S1 can fool S2 by allowing P1 to solve the "challenge"."
},
{
"comment_id": 45912,
"creation_date": 1358965537,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"body": "@Igor - S2 knows it is talking to S1 though because the challenge should be formulated so that only P1 can read it. If P1 gets a challenge from S2 while talking to S1, it shouldn't answer it in a way that S1 can read. P1 should always know reliably which server they are talking to and if S1 should not be able to impersonate a tunnel to P2 without actually tunneling so long as either P1 knows S2 or vice versa."
},
{
"comment_id": 45934,
"creation_date": 1358982945,
"owner": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "as far as I understood, the challenge could only be SOLVED by P1, because he's the only one with P1's private key. Anyone could receive the challenge, but only the one with an appropriate private key can solve it. That's the idea of the challenge,isn't it? The thing is, after receiving the challenge from S2, S1 may just pass it to P1 , for P1 to solve it. At least, I don't understand, why he's unable to do so. This is the main idea of the whole question..."
},
{
"comment_id": 45965,
"creation_date": 1359036048,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"body": "@Igor There should be two parts to a challenge. The message should be encrypted with the user (the one being challenged)'s public key, thus nobody else can read the challenge. It should also require a signed response, thus only the user can respond. Additionally, the client should encrypt the response so that only the original challenger can read the result of the challenge. For a challenge to be effective, it must be impossible for anyone in between the challenger and challengee to impersonate either party."
},
{
"comment_id": 46103,
"creation_date": 1359131817,
"owner": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "Yes, only PC1 is able to solve (or read, what's the difference?)the challenge. But why S1 is unable to tunnel the challenge received from S2 to S1 ? S1 don't have to read it, just tunnel it. \n\nI can't find any statement like "challenge is signed with S2_id_rsa and THEN encrypted with P1_id_rsa.pub" (in this case, S1 won't be able to modify the signature) anywhere.\nIn fact, I haven't found anything at all about the challenge being signed and/or encrypted.... \n\nThey all say,server is authenticated on DH key exchange step, why do double authentication?"
},
{
"comment_id": 46110,
"creation_date": 1359137411,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"body": "@Igor - if S1 did that, then it could not read the response from PC1 because PC1 would respond in such a way that only S2 could read the handshake. Part of the handshake is a key exchange that would make it so that S1 did not know the session key and therefore could not tell what was being said between S2 and PC1."
},
{
"comment_id": 46111,
"creation_date": 1359137640,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "@Igor - I guess I should ask, are you specifically asking about the legacy protocol SSH or the much more commonly used today SSH2? A lot of my comments have been about the Diffie Hellman key exchange and the use of MACs in SSH v2."
},
{
"comment_id": 46112,
"creation_date": 1359137798,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"body": "@Igor - the difference between solving and reading is that if someone can read, but not solve, then they can read the problem and pass the same problem along in such a way that they can read the solution. For example, if I ask you to solve 2+3 (and only you can solve 2+3), then if the man in the middle can read the question and you trust the man in the middle, they can ask you for 2+3 to prove who you are to them. They can then simply pass along your answer. Thus, it is important that only the one being challenged can read or respond to the challenge."
},
{
"comment_id": 46141,
"creation_date": 1359162681,
"owner": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"edit_count": 2,
"body": "(IN response to:1/3) If S1 would just tunnel DH key exchange data - it won't be able to encrypt/decrypt any data in this session. But that's a separate data packet, not the same as the packet with challenge. So, S1 works differently with them. There are two different "DH channels", with symmetric encryption which S1 is able to encrypt/decrypt, but there's only one client authentication process - S1 just tunnels it."
},
{
"comment_id": 46142,
"creation_date": 1359162796,
"owner": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"body": "(In response to:2/3) Yep, I believe, we're talking about ssh2..."
},
{
"comment_id": 46143,
"creation_date": 1359162894,
"owner": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"body": "(In response to 3/3) As far as I understood, the "challenge" packet to be sent to client is described here, around page 8, but I can't see any info about additional encryption for challenge, so, I assume that it's only encrypted with the same symmetric encryption, based on DH key exchange,that all data is encrypted with. But S1 is able to read the data encrypted with it, since it had established two separate channels with P1 and S2 before.\nHow exactly is the challenge encrypted?"
},
{
"comment_id": 46183,
"creation_date": 1359246571,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "@igor The key exchange occurs prior to authentication. The rfc you mentioned references one for ssh transport. If the user has connected to s2 previously or a certificate is expected, then s1 will not be able to convince p1 to establish a key exchange with s2 without having s2s private key."
},
{
"comment_id": 46203,
"creation_date": 1359297649,
"owner": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"edit_count": 2,
"body": "Em...But S1 is going to convince P1 to establish a DH key exchange with itself, S1. So, for DH key exchange P1<->S1 and S1<->S2."
},
{
"comment_id": 46294,
"creation_date": 1359381039,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"body": "@Igor - but P1 would know it was talking to S1 as a result of that exchange because DH will attest to the identity of the server. This would be unexpected behavior for P1 trying to talk to S2 as in that case, the SSH Tunnel should be established between P1 and S2 with S1 only serving to relay the packets. Thus, P1 would never respond to a challenge from S2 on an SSH tunnel that was negotiated with S1."
},
{
"comment_id": 46455,
"creation_date": 1359502360,
"owner": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"edit_count": 4,
"body": ">>"but P1 would know it was talking to S1" Indeed, P1 knows that he is talking to S1, and the thing is - this is what P1 wants.... P1 WANTS to connect to S1, and, it doesn't want to connect to S2 (this time).\n\nAs far as I understood, the rest of your message seem to be based on the same idea..."
},
{
"comment_id": 46456,
"creation_date": 1359502912,
"owner": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"body": "I'm very sorry I failed to describe the whole situation in question in a manner that no misunderstanding would be possible... I've tried my best... Sorry...."
},
{
"comment_id": 46497,
"creation_date": 1359553131,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"body": "@Igor - If P1 is providing authentication for S2, then it should only provide that on a connection with S2 (even if being intentionally tunneled through S1). If P1 is giving S1 the authentication credentials to make a connection from S1 to S2 as P1, then yes a MITM is possible, but that is why P1 should tunnel a connection THRU S1 to get to S2 instead of giving S1 the connection. There isn't a meaningful difference as S1 is still the relay, just the connection and credentials are protected."
},
{
"comment_id": 46650,
"creation_date": 1359720047,
"owner": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"body": "Em... P1 thinks that there's a usual ssh server running on S1, and it tries to connect to it. But instead of normal ssh server, there's a specific "hack tool". P1 doesn't know that he's request would be tunneled."
},
{
"comment_id": 46662,
"creation_date": 1359734105,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"body": "@Igor - in this case, P1 would know they are talking to S1 and not provide credentials for S2."
},
{
"comment_id": 46712,
"creation_date": 1359762989,
"owner": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"body": "P1 knows that he is talking to S1. But it looks like P1 is unable to determine, whether challenge (received from S1) was generated by S1 or someone else."
},
{
"comment_id": 46866,
"creation_date": 1359985535,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"edit_count": 2,
"body": "@Igor - P1 knows the transport that is asking. If P1 tunnels to S1 and then uses a client on S1 to talk to S2, then yes, a bad S1 could easily just record the input of P1, no breaking of the authentication is necessary. For P1 to talk to S2 while going through S1, P1 should establish a tunnel THRU S1 to S2 at which point the transport is validated as going to S2 prior to authentication messages being sent. S1 then has no access to the actual information on the tunnel, nor can it modify it meaningfully."
},
{
"comment_id": 46952,
"creation_date": 1360068242,
"owner": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": ">>"P1 tunnels to S1 and then uses a client on S1 to talk to S2"\nnope, P1 is just trying to connect to S1, it doesn't want to connect to S2 either directly or through someone. Connecting to S2 is a result of the attack. \n>>"For P1 to talk to S2 while going through S1 <...> S1 then has no access to the actual information on the tunnel, nor can it modify it meaningfully"\nIn this case, you treat S1 as just a regular router, somewhere between P1 and S2. This is not the case I'm ..."
},
{
"comment_id": 46953,
"creation_date": 1360068848,
"owner": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"body": "...talking about. In my case, I'm playing on the authorization sequence features, not on the general concept of ssh. And the thing is - symmetric encryption is established firstly. Server would establish symmetrically encrypted channel with anyone who asks. And the identity of user is not yet verified. It would be verified during the second step.\nThe symmetrically encrypted channel is secure, but you still don't know who you've got channel with. Only server signs his DH key part with his signature. So, on the first step 2 independent DH tunnels is established. P1**<->**S1 and"
},
{
"comment_id": 46954,
"creation_date": 1360069265,
"owner": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"body": "S1**<->**S2. Now, P1 is sure that he is connected to the server he intended to connect - to S1. And he is waiting for the challenge from S1, that he would solve to get authorized. On the other hand, S1 is not authorized as ssh client on S2, and S2 will send S1 a challenge,that only P1 is able to solve. The message structure is described in rfc I've mentioned above. I can't see any info that it's additionally encrypted or something. As far as I can tell, it is sent in quite plain format. It's only encrypted with general symmetric encryption, to make"
},
{
"comment_id": 46955,
"creation_date": 1360069481,
"owner": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"body": "sure only the one S2 has a symmetrically encrypted connection with would be able to read it, that is - only S1. So, S1 receives the challenge, and re-sends it to P1, now, P1 is unable to determine, whether this challenge was generated by S1 or someone else. So, it solves the challenge, and sends the answer to S1."
},
{
"comment_id": 46961,
"creation_date": 1360072914,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"edit_count": 2,
"body": ""P1 is just trying to connect to S1, it doesn't want to connect to S2 either directly or through someone." - Then why is P1 entering credentials for S2? If P1 is using the same credentials for both, then yes, there is a problem, but that's why credentials should be unique to a server. It's also worth noting that this would only be necessary if cryptographic authentication (like a client cert) is being used. If it was a password, then a bad server could simply save the password and reuse it when the password is initially set."
},
{
"comment_id": 47098,
"creation_date": 1360157842,
"owner": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"edit_count": 3,
"body": "Sure, P1 is not "entering the credentials" for S2 (at least, he thinks so). P1 only solves the challenge, received from S1, because he thinks, that this is required to authorize on S1.\n\n\n\nThe whole attack would not be possible, if P1 would use different key pairs for S1 and S2... But, the thing is (and I've started the question with it): "Usually, people recommend to use a single private-public key pair everywhere"... That's why, in "preconditions" section, both S1 and S2 have the same "P1_id_rsa.pub"."
},
{
"comment_id": 47099,
"creation_date": 1360158130,
"owner": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"body": "PS... I'm not sure, what do you mean under "credentials".."
},
{
"comment_id": 47103,
"creation_date": 1360159618,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29445,
"post_type": "answer",
"score": 0,
"body": "@Igor - ah, ok, I see now, it was not clear to me that you were talking about client certificate based SSL with a single private key being used. Now that I see that, yes, I agree that such an attack would bypass the transport protection. I'm not well read enough on the authentication itself, but I would hazard from my quick read that it seems like you are correct."
}
]
},
{
"answer_id": 29444,
"accepted": false,
"answer_comments_url": "/answers/29444/comments",
"question_id": 29440,
"owner": {
"user_id": 5220,
"user_type": "registered",
"display_name": "ratchet freak",
"reputation": 181,
"email_hash": "6e2168c4647a4f096a14c254bd3d3f68"
},
"creation_date": 1358786883,
"last_activity_date": 1358786883,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 303,
"score": 0,
"community_owned": false,
"title": "SSH: reusing public keys and known-man-in-the-middle",
"comments": [
{
"comment_id": 45719,
"creation_date": 1358807727,
"owner": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"post_id": 29444,
"post_type": "answer",
"score": 0,
"body": ">>1\nBut what if PC1 intentionally wants to connect to Server1? (and S1_id_rsa.pub is trusted in this situation, yes)"
}
]
},
{
"answer_id": 30703,
"accepted": true,
"answer_comments_url": "/answers/30703/comments",
"question_id": 29440,
"owner": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"creation_date": 1360590282,
"last_activity_date": 1360590282,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 303,
"score": 0,
"community_owned": false,
"title": "SSH: reusing public keys and known-man-in-the-middle",
"comments": []
}
],
"accepted_answer_id": 30703,
"favorite_count": 0,
"question_timeline_url": "/questions/29440/timeline",
"question_comments_url": "/questions/29440/comments",
"question_answers_url": "/questions/29440/answers",
"question_id": 29440,
"owner": {
"user_id": 19848,
"user_type": "registered",
"display_name": "Igor",
"reputation": 6,
"email_hash": "8c5abff11139e6bc9a54e50fdc4e0579"
},
"creation_date": 1358785006,
"last_edit_date": 1360159748,
"last_activity_date": 1360590282,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 303,
"score": 1,
"community_owned": false,
"title": "SSH: reusing public keys and known-man-in-the-middle",
"comments": []
},
{
"tags": [
"cryptography",
"php",
"session-management",
"pbkdf2"
],
"answer_count": 3,
"answers": [
{
"answer_id": 29439,
"accepted": false,
"answer_comments_url": "/answers/29439/comments",
"question_id": 29432,
"owner": {
"user_id": 8281,
"user_type": "registered",
"display_name": "KeithS",
"reputation": 2684,
"email_hash": "8f455043e5d839da0c6695407b318ad5"
},
"creation_date": 1358784567,
"last_edit_date": 1358785743,
"last_activity_date": 1358785743,
"up_vote_count": 5,
"down_vote_count": 0,
"view_count": 110,
"score": 5,
"community_owned": false,
"title": "Maintain sensitive key between requests",
"comments": [
{
"comment_id": 45635,
"creation_date": 1358785089,
"owner": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29439,
"post_type": "answer",
"score": 0,
"body": "Oops, I've made a terrible typo.. I meant "Store the IV in a cookie" instead of "in a key"! Anyway all the encr/decryption process happens serverside and the result is sent over ssl to the client. Should I decrypt client-side?"
},
{
"comment_id": 45637,
"creation_date": 1358785187,
"owner": {
"user_id": 8281,
"user_type": "registered",
"display_name": "KeithS",
"reputation": 2684,
"email_hash": "8f455043e5d839da0c6695407b318ad5"
},
"reply_to_user": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29439,
"post_type": "answer",
"score": 0,
"edit_count": 2,
"body": "You say you're using SSL for client transport. Basically that means that the scheme you're proposing is solely for encrypting the data stored on the server, so if it were ever "dumped" by an attacker it's still protected, provided the key isn't readily accessible to the attacker. That leads to the next important question; how is the user's password used to produce the key?"
},
{
"comment_id": 45638,
"creation_date": 1358785432,
"owner": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29439,
"post_type": "answer",
"score": 0,
"body": "I haven't understood: all the user area is protected with SSL. Isn't this enough? Added details in the question! Thanks again!"
},
{
"comment_id": 45641,
"creation_date": 1358786087,
"owner": {
"user_id": 8281,
"user_type": "registered",
"display_name": "KeithS",
"reputation": 2684,
"email_hash": "8f455043e5d839da0c6695407b318ad5"
},
"reply_to_user": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29439,
"post_type": "answer",
"score": 1,
"body": "If SSL were enough you wouldn't be asking about server-side encryption; SSL, properly implemented, is a secure mode of data transportation, but it doesn't help you with the security of stored data. Anyway, you mention "password-based key derivation". I want more detail on that, since you don't seem to actually use a PBKDF in your scheme. Key generation, and association of that key with a user account, are critical areas of potential strength or weakness."
},
{
"comment_id": 45643,
"creation_date": 1358786760,
"owner": {
"user_id": 8281,
"user_type": "registered",
"display_name": "KeithS",
"reputation": 2684,
"email_hash": "8f455043e5d839da0c6695407b318ad5"
},
"reply_to_user": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29439,
"post_type": "answer",
"score": 1,
"edit_count": 1,
"body": "For instance, a PBKDF based on a user-specified password is only as strong as the user's actual password. The more rules you require (capital letters, numbers, symbols), the less unpredictable the password becomes (because the more rules you put in, the more normalized the resulting passwords become). That's still stronger than a hash of the password stored alongside the key for that user account, which is still stronger than plaintext passwords in the database."
},
{
"comment_id": 45647,
"creation_date": 1358789126,
"owner": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29439,
"post_type": "answer",
"score": 0,
"body": "I'm sorry, I've reworked my own question. Is it better? Thanks again"
},
{
"comment_id": 45668,
"creation_date": 1358793073,
"owner": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29439,
"post_type": "answer",
"score": 0,
"body": "It seems that GCM and CCM modes aren't available php.net/manual/en/function.openssl-get-cipher-methods.php .. what do you advise me? Thanks for your very helpful support!"
},
{
"comment_id": 45689,
"creation_date": 1358797793,
"owner": {
"user_id": 8281,
"user_type": "registered",
"display_name": "KeithS",
"reputation": 2684,
"email_hash": "8f455043e5d839da0c6695407b318ad5"
},
"reply_to_user": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29439,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "OK, what you are trying to do overall is now a little more clear. In short, if you are using SSL/TLS over HTTP (HTTPS) for all information passed during the entire browser session, from the moment that the unauthenticated user first requested your site's front page, then the session can be considered secure. Everything sent between client and server, including session identifiers, will be encrypted, and so session hijacking will be a practical impossibility."
},
{
"comment_id": 45692,
"creation_date": 1358798118,
"owner": {
"user_id": 8281,
"user_type": "registered",
"display_name": "KeithS",
"reputation": 2684,
"email_hash": "8f455043e5d839da0c6695407b318ad5"
},
"reply_to_user": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29439,
"post_type": "answer",
"score": 0,
"body": "Given this fact, the PHP session store is as secure as you physically make it. PHP can use an off-server session store, such as a SQL DBMS, to store session data, which will slow you down, but the webserver itself will only hold the data in memory for as long as it takes to process a single page request from the client. The webserver can additionally be protected from intrusion, though by its public-facing nature it will be more vulnerable than the data servers in a secured internal network."
},
{
"comment_id": 45694,
"creation_date": 1358798228,
"owner": {
"user_id": 8281,
"user_type": "registered",
"display_name": "KeithS",
"reputation": 2684,
"email_hash": "8f455043e5d839da0c6695407b318ad5"
},
"reply_to_user": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29439,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "The upshot is that you can store the PBKDF2-derived key in the user's session store securely, without having to worry too much about PHP session vulnerabilities. Given adequate separation of concerns and a secure client/server channel, if an attacker has sufficient access to compromise the user session he can do far worse."
},
{
"comment_id": 45695,
"creation_date": 1358798336,
"owner": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29439,
"post_type": "answer",
"score": 0,
"body": "No, the first pages are public so only http. When the user wants to login, I redirect him over https to a login form and the logged session is entirely over ssl. Can the session be considered secure?"
},
{
"comment_id": 45701,
"creation_date": 1358799147,
"owner": {
"user_id": 8281,
"user_type": "registered",
"display_name": "KeithS",
"reputation": 2684,
"email_hash": "8f455043e5d839da0c6695407b318ad5"
},
"reply_to_user": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29439,
"post_type": "answer",
"score": 0,
"body": "Provided that the transmission of the user's actual credentials, establishing a "user session" for the current "browser session", happens over SSL, and that a new "browser session" was created for that browser's connection to the SSL-secured portion of the site, then the PHP session for that SSL connection should still be secure. Just don't retain any information about the user or their browser in session between the non-SSL and SSL portions of the site."
},
{
"comment_id": 45702,
"creation_date": 1358799312,
"owner": {
"user_id": 8281,
"user_type": "registered",
"display_name": "KeithS",
"reputation": 2684,
"email_hash": "8f455043e5d839da0c6695407b318ad5"
},
"reply_to_user": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29439,
"post_type": "answer",
"score": 0,
"body": "The use of HTTPS from start to finish is more for the client's benefit, by identifying your landing page as being uniquely yours (if you have an EV-SSL certificate, verifying that the served pages are from the server they purport to be from, and that server is owned by the business entity that you purport to be). Getting this up front is generally preferable to having to click a login link (which may trigger the entry of a remembered password) before getting a gold lock or a green address bar."
}
]
},
{
"answer_id": 29437,
"accepted": false,
"answer_comments_url": "/answers/29437/comments",
"question_id": 29432,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"creation_date": 1358784455,
"last_edit_date": 1358788195,
"last_activity_date": 1358788195,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 110,
"score": 3,
"community_owned": false,
"title": "Maintain sensitive key between requests",
"comments": [
{
"comment_id": 45640,
"creation_date": 1358785708,
"owner": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29437,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "1) I haven't understood "It is fine for the IV to be known, it just prevents attacks"... did you mean **un**known? \n\n2) I want to make the IV secret just because I'm worry that the key could be stolen."
},
{
"comment_id": 45642,
"creation_date": 1358786568,
"owner": {
"user_id": 8281,
"user_type": "registered",
"display_name": "KeithS",
"reputation": 2684,
"email_hash": "8f455043e5d839da0c6695407b318ad5"
},
"post_id": 29437,
"post_type": "answer",
"score": 2,
"edit_count": 1,
"body": "If the key being stolen is a significant risk, you should really rethink the scheme from square one. The IV is not a key; it is not required to be a secret, and if it is the only secret (because the key is known), most IV-based modes of operation become extremely weak. Some of the most secure authenticated block modes, like GCM, don't even use an IV. CCM uses it only for the CBC-MAC authentication step, and it can be present in the decrypted message right alongside the hashcode if you wish."
},
{
"comment_id": 45645,
"creation_date": 1358788030,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29437,
"post_type": "answer",
"score": 1,
"body": "@Surferonthefall - I also have to echo what KeithS is saying. If you are asking about if AES can be cracked when you know the key but only don't know the IV, then yes, many modes of operation are extremely easy to crack and it might also be possible to look for patterns based on the key that would allow the IV to be determined if the key is known. If your key is compromised, you need to consider anything protected by the key to be compromised as well. The IV just prevents attacks against related plain texts by changing the start conditions."
},
{
"comment_id": 45649,
"creation_date": 1358789156,
"owner": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29437,
"post_type": "answer",
"score": 0,
"body": "I'm sorry, I've reworked my own question. Is it better? Thanks again"
},
{
"comment_id": 45650,
"creation_date": 1358789589,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29437,
"post_type": "answer",
"score": 1,
"body": "@Surferonthefall - yes, I think that is much more clear what you are asking. Since this answer was talking about IV's specifically, I have made another response that addresses the wider question of how to securely do what you are looking to do. Hope it helps."
}
]
},
{
"answer_id": 29447,
"accepted": false,
"answer_comments_url": "/answers/29447/comments",
"question_id": 29432,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"creation_date": 1358789397,
"last_edit_date": 1358797934,
"last_activity_date": 1358797934,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 110,
"score": 1,
"community_owned": false,
"title": "Maintain sensitive key between requests",
"comments": [
{
"comment_id": 45651,
"creation_date": 1358790100,
"owner": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29447,
"post_type": "answer",
"score": 0,
"body": "Sorry for the poor question and thanks for your exhaustive answer ! What exactly do you mean by "generate multiple tokens that can be stored by different means"? It's just what I thought about... could you give me some links or some hints about this multiple-token generation process?"
},
{
"comment_id": 45665,
"creation_date": 1358792637,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29447,
"post_type": "answer",
"score": 0,
"body": "You were talking about breaking up information across the APC cache, the session and a cookie. The key of this is to require that the user (or attacker) has all of these pieces of information to move forward with decryption. Using pieces of information about the cipher are unnecessary however. You can instead store tokens in the DB that associate a given session, APC cache and cookie. The server could look up the record for the three pieces of information provided and if any of them don't match, then no information would be disclosed by the server."
},
{
"comment_id": 45670,
"creation_date": 1358793292,
"owner": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29447,
"post_type": "answer",
"score": 0,
"edit_count": 2,
"body": "So, I should save the encryption key, under which I encrypted uk, in the DB with the tree pieces. Later, if there is a record with the three pieces, then I should return the key field, so that the script can recover the uk and go on with the decr/encryption process. Am I right?"
},
{
"comment_id": 45677,
"creation_date": 1358796767,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29447,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "@Surferonthefall - actually, as I'm thinking about it some more over lunch, I am going to update my answer I think to be a little bit better. Is the key normally going to be stored server side and protected with a user password? If so, then the trick is to maintain the ability to access the key while not disclosing meaningful information if the client connection or client itself is compromised."
},
{
"comment_id": 45680,
"creation_date": 1358797165,
"owner": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29447,
"post_type": "answer",
"score": 0,
"body": "No, the key must be available only when the user is logged. I don't want to permanently store it server side, because it's riskful and fully unuseful in my scheme. Thanks a lot for your time!"
},
{
"comment_id": 45684,
"creation_date": 1358797365,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29447,
"post_type": "answer",
"score": 0,
"body": "@Surferonthefall - where does the key normally get persisted? It can either be persisted on the client or persisted in the db. Generally when persisted in either location, it is protected by the user's password. To have the user not need to enter their password every time, you would need to store the data key encrypted with a session key on the server and then have the session composed of only the session key pieces. This means that the client and server would both have to be compromised for an attacker to get the data key since the server lacks the information to decrypt and the client..."
},
{
"comment_id": 45685,
"creation_date": 1358797384,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29447,
"post_type": "answer",
"score": 0,
"body": "...lacks the ciphertext that needs decryption."
},
{
"comment_id": 45688,
"creation_date": 1358797770,
"owner": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29447,
"post_type": "answer",
"score": 0,
"body": "Exactly what I was thinking about. The cipher of the session key is stored in PHP standard session.. I'll adopt the alternate approach with multiple encryption with different factors (sessionkey_1 in cookie, sessionkey_2 in apc_cache, useragent) as keys.. thanks a lot!"
},
{
"comment_id": 45691,
"creation_date": 1358798041,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29447,
"post_type": "answer",
"score": 0,
"body": "@Surferonthefall - yeah, NP, sorry it took a bit for me to think things through all the way. Running on far too little sleep today so my brains a bit laggy."
},
{
"comment_id": 45693,
"creation_date": 1358798209,
"owner": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29447,
"post_type": "answer",
"score": 0,
"body": "Just a thing: Will I use the same algo (aes) or it's better if every level has a different algo(aes,blowfish, etc)?"
},
{
"comment_id": 45697,
"creation_date": 1358798482,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29447,
"post_type": "answer",
"score": 0,
"body": "@Surferonthefall - algorithm changes shouldn't matter since the session key should be temporary and discarded by server when the session is invalidated. Thus, the data key becomes unrecoverable. The only benefit to different algorithms would be if the attacker managed to compromise the server, cache the session encrypted data key and then a weakness was found in the algorithm used. This would also have to assume that the server was not so thoroughly compromised that the data key was captured in memory while being re-encrypted. All in all, there is a very small benefit, but it is unlikely.."
},
{
"comment_id": 45698,
"creation_date": 1358798523,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29447,
"post_type": "answer",
"score": 0,
"body": "to be meaningfully helpful in most cases. Then again, I guess I can't think of any particular reasons not to use various algorithms either."
},
{
"comment_id": 45708,
"creation_date": 1358800485,
"owner": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29447,
"post_type": "answer",
"score": 0,
"body": "What do you mean for "session is invalidated"? Log out? expired time?"
},
{
"comment_id": 45712,
"creation_date": 1358804443,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"post_id": 29447,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "@Surferonthefall - the record in the DB that stores the uk encrypted with the 3 session keys should be destroyed whenever the session becomes invalid. This is to prevent an offline attack from being able to be done on an outdated session unless the server was compromised at the time of the session. This can be any ruleset you want as to when it becomes invalid."
}
]
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/29432/timeline",
"question_comments_url": "/questions/29432/comments",
"question_answers_url": "/questions/29432/answers",
"question_id": 29432,
"owner": {
"user_id": 11892,
"user_type": "registered",
"display_name": "Surfer on the fall",
"reputation": 122,
"email_hash": "a2ebea44a213468b12de6f7dc69dc7ef"
},
"creation_date": 1358781654,
"last_edit_date": 1358789332,
"last_activity_date": 1358797934,
"up_vote_count": 1,
"down_vote_count": 1,
"view_count": 110,
"score": 0,
"community_owned": false,
"title": "Maintain sensitive key between requests",
"comments": []
},
{
"tags": [
"encryption",
"cryptography",
"monitoring"
],
"answer_count": 1,
"answers": [
{
"answer_id": 29421,
"accepted": false,
"answer_comments_url": "/answers/29421/comments",
"question_id": 29420,
"owner": {
"user_id": 485,
"user_type": "moderator",
"display_name": "Rory Alsop",
"reputation": 32567,
"email_hash": "af1ed0816ed5a2164a4e343ad09309ad"
},
"creation_date": 1358754182,
"last_activity_date": 1358754182,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 104,
"score": 1,
"community_owned": false,
"title": "Tracking information on HTTPS connection",
"comments": [
{
"comment_id": 45604,
"creation_date": 1358757126,
"owner": {
"user_id": 19778,
"user_type": "registered",
"display_name": "sujeesh",
"reputation": 166,
"email_hash": "82b76e427d3ff973c7f10263e58d4e13"
},
"post_id": 29421,
"post_type": "answer",
"score": 0,
"body": "How do I know they are having proxy? And if there is, then how to hide these contents?"
},
{
"comment_id": 45605,
"creation_date": 1358757385,
"owner": {
"user_id": 485,
"user_type": "moderator",
"display_name": "Rory Alsop",
"reputation": 32567,
"email_hash": "af1ed0816ed5a2164a4e343ad09309ad"
},
"reply_to_user": {
"user_id": 19778,
"user_type": "registered",
"display_name": "sujeesh",
"reputation": 166,
"email_hash": "82b76e427d3ff973c7f10263e58d4e13"
},
"post_id": 29421,
"post_type": "answer",
"score": 0,
"body": "You can check by comparing SSL certificates in your browser, but realistically - if they enforce a proxy, and enforce which applications you can have on your desktop, you cannot easily hide these contents."
},
{
"comment_id": 45606,
"creation_date": 1358757651,
"owner": {
"user_id": 19778,
"user_type": "registered",
"display_name": "sujeesh",
"reputation": 166,
"email_hash": "82b76e427d3ff973c7f10263e58d4e13"
},
"post_id": 29421,
"post_type": "answer",
"score": 0,
"body": "Do you mean my browser encrypts contents with public key of proxy server and proxy server verifies contents and it encrypts with receiver public key then sends to the receiver?"
},
{
"comment_id": 45607,
"creation_date": 1358757875,
"owner": {
"user_id": 485,
"user_type": "moderator",
"display_name": "Rory Alsop",
"reputation": 32567,
"email_hash": "af1ed0816ed5a2164a4e343ad09309ad"
},
"reply_to_user": {
"user_id": 19778,
"user_type": "registered",
"display_name": "sujeesh",
"reputation": 166,
"email_hash": "82b76e427d3ff973c7f10263e58d4e13"
},
"post_id": 29421,
"post_type": "answer",
"score": 0,
"body": "yep - have a read of security.stackexchange.com/q/16293/485"
},
{
"comment_id": 45609,
"creation_date": 1358760183,
"owner": {
"user_id": 19778,
"user_type": "registered",
"display_name": "sujeesh",
"reputation": 166,
"email_hash": "82b76e427d3ff973c7f10263e58d4e13"
},
"post_id": 29421,
"post_type": "answer",
"score": 0,
"body": "when i am browsing en.wikipedia.org i have checked the certificate from the address bar in Firefox. It says this certificate is issued to *.wikipedia.org. So can i make sure that there is no proxy server in between Wikipedia and my browser?"
},
{
"comment_id": 45618,
"creation_date": 1358767586,
"owner": {
"user_id": 19778,
"user_type": "registered",
"display_name": "sujeesh",
"reputation": 166,
"email_hash": "82b76e427d3ff973c7f10263e58d4e13"
},
"post_id": 29421,
"post_type": "answer",
"score": 0,
"body": "@Rosy Aslop please comment me about the above doubt."
}
]
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/29420/timeline",
"question_comments_url": "/questions/29420/comments",
"question_answers_url": "/questions/29420/answers",
"question_id": 29420,
"owner": {
"user_id": 19778,
"user_type": "registered",
"display_name": "sujeesh",
"reputation": 166,
"email_hash": "82b76e427d3ff973c7f10263e58d4e13"
},
"creation_date": 1358752802,
"last_edit_date": 1358753436,
"last_activity_date": 1358754182,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 104,
"score": 0,
"community_owned": false,
"title": "Tracking information on HTTPS connection",
"comments": []
},
{
"tags": [
"encryption",
"cryptography",
"ssl"
],
"answer_count": 1,
"answers": [
{
"answer_id": 29419,
"accepted": true,
"answer_comments_url": "/answers/29419/comments",
"question_id": 29410,
"owner": {
"user_id": 19778,
"user_type": "registered",
"display_name": "sujeesh",
"reputation": 166,
"email_hash": "82b76e427d3ff973c7f10263e58d4e13"
},
"creation_date": 1358745366,
"last_activity_date": 1358745366,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 119,
"score": 1,
"community_owned": false,
"title": "Is TLS secure when full eavesdropping on the network occurs?",
"comments": [
{
"comment_id": 45718,
"creation_date": 1358807469,
"owner": {
"user_id": 19883,
"user_type": "registered",
"display_name": "Brett",
"reputation": 106,
"email_hash": "9997e266c45ce3162119a94fc727aa0c"
},
"post_id": 29419,
"post_type": "answer",
"score": 0,
"body": "Thanks for the useful details, @sujeesh. Makes a lot more sense than the linked question/answer."
},
{
"comment_id": 45729,
"creation_date": 1358831688,
"owner": {
"user_id": 19778,
"user_type": "registered",
"display_name": "sujeesh",
"reputation": 166,
"email_hash": "82b76e427d3ff973c7f10263e58d4e13"
},
"reply_to_user": {
"user_id": 19883,
"user_type": "registered",
"display_name": "Brett",
"reputation": 106,
"email_hash": "9997e266c45ce3162119a94fc727aa0c"
},
"post_id": 29419,
"post_type": "answer",
"score": 0,
"body": "@Brett if you want far more details please Google using following keyword. Public Key Cryptography then search what is SSL and TLS, then go for what is HTTPS. HTTPS is nothing but http with its contents are encrypted using SSL or Public and Private keys."
}
]
}
],
"accepted_answer_id": 29419,
"favorite_count": 0,
"closed_date": 1358748277,
"closed_reason": "exact duplicate",
"question_timeline_url": "/questions/29410/timeline",
"question_comments_url": "/questions/29410/comments",
"question_answers_url": "/questions/29410/answers",
"question_id": 29410,
"owner": {
"user_id": 19883,
"user_type": "registered",
"display_name": "Brett",
"reputation": 106,
"email_hash": "9997e266c45ce3162119a94fc727aa0c"
},
"creation_date": 1358726619,
"last_edit_date": 1358753796,
"last_activity_date": 1358753796,
"up_vote_count": 1,
"down_vote_count": 1,
"view_count": 119,
"score": 0,
"community_owned": false,
"title": "Is TLS secure when full eavesdropping on the network occurs?",
"comments": [
{
"comment_id": 45588,
"creation_date": 1358731858,
"owner": {
"user_id": 975,
"user_type": "registered",
"display_name": "Rook",
"reputation": 21214,
"email_hash": "7cedb843eb2922000eb41b4561ed660d"
},
"post_id": 29410,
"post_type": "question",
"score": 2,
"body": "SSL/TLS would be pretty useless if it didn't prevent this attack."
},
{
"comment_id": 45596,
"creation_date": 1358737540,
"owner": {
"user_id": 19883,
"user_type": "registered",
"display_name": "Brett",
"reputation": 106,
"email_hash": "9997e266c45ce3162119a94fc727aa0c"
},
"reply_to_user": {
"user_id": 975,
"user_type": "registered",
"display_name": "Rook",
"reputation": 21214,
"email_hash": "7cedb843eb2922000eb41b4561ed660d"
},
"post_id": 29410,
"post_type": "question",
"score": 0,
"body": "@Rook: absolutely, but that doesn't explain how."
},
{
"comment_id": 45598,
"creation_date": 1358744403,
"owner": {
"user_id": 6813,
"user_type": "registered",
"display_name": "Tom Marthenal",
"reputation": 853,
"email_hash": "788bee10b9d841b3caf60674e3d65129"
},
"post_id": 29410,
"post_type": "question",
"score": 0,
"body": "@Brett see the question Giles linked."
}
]
},
{
"tags": [
"encryption",
"cryptography",
"hash"
],
"answer_count": 3,
"answers": [
{
"answer_id": 29214,
"accepted": false,
"answer_comments_url": "/answers/29214/comments",
"question_id": 29213,
"owner": {
"user_id": 18192,
"user_type": "registered",
"display_name": "Cristian Dobre",
"reputation": 3890,
"email_hash": "bdf704acd5eb21225c99c83c3995016f"
},
"creation_date": 1358419463,
"last_edit_date": 1358443338,
"last_activity_date": 1358443338,
"up_vote_count": 6,
"down_vote_count": 0,
"view_count": 271,
"score": 6,
"community_owned": false,
"title": "Hash Function Xor",
"comments": []
},
{
"answer_id": 29245,
"accepted": false,
"answer_comments_url": "/answers/29245/comments",
"question_id": 29213,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1358446104,
"last_activity_date": 1358446104,
"up_vote_count": 6,
"down_vote_count": 0,
"view_count": 271,
"score": 6,
"community_owned": false,
"title": "Hash Function Xor",
"comments": [
{
"comment_id": 45342,
"creation_date": 1358453705,
"owner": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 29245,
"post_type": "answer",
"score": 1,
"edit_count": 2,
"body": "I sometimes use xor to calculate hashes of unordered data for use in a hashtable since sorting is relatively expensive. For example as part when implementing value equality on sets. Clearly it's not such a great idea for most security purposes. | It might be possible to use xor in some keyed hashing scenarios. But that certainly requires careful design."
}
]
},
{
"answer_id": 29215,
"accepted": false,
"answer_comments_url": "/answers/29215/comments",
"question_id": 29213,
"owner": {
"user_id": 13905,
"user_type": "registered",
"display_name": "Henning Klevjer",
"reputation": 1344,
"email_hash": "ef0a0962ba481196b1702ae255e71e98"
},
"creation_date": 1358419540,
"last_edit_date": 1358453779,
"last_activity_date": 1358453779,
"up_vote_count": 4,
"down_vote_count": 0,
"view_count": 271,
"score": 4,
"community_owned": false,
"title": "Hash Function Xor",
"comments": [
{
"comment_id": 45337,
"creation_date": 1358453010,
"owner": {
"user_id": 12407,
"user_type": "registered",
"display_name": "Stephen Touset",
"reputation": 1139,
"email_hash": "9ff064364151151cbce108b869e6e62d"
},
"post_id": 29215,
"post_type": "answer",
"score": 2,
"body": "However, both are probably bad. Without fixed-width field length specifiers, the resulting hashes don't uniquely identify their components. Consider H("Bob Dole" || "bobdole@example.com") versus H("Bob Dol" || "ebobdole@example.com")."
},
{
"comment_id": 45341,
"creation_date": 1358453691,
"owner": {
"user_id": 13905,
"user_type": "registered",
"display_name": "Henning Klevjer",
"reputation": 1344,
"email_hash": "ef0a0962ba481196b1702ae255e71e98"
},
"reply_to_user": {
"user_id": 12407,
"user_type": "registered",
"display_name": "Stephen Touset",
"reputation": 1139,
"email_hash": "9ff064364151151cbce108b869e6e62d"
},
"post_id": 29215,
"post_type": "answer",
"score": 0,
"body": "@StephenTouset fair point!"
}
]
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/29213/timeline",
"question_comments_url": "/questions/29213/comments",
"question_answers_url": "/questions/29213/answers",
"question_id": 29213,
"creation_date": 1358419157,
"last_activity_date": 1358453779,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 271,
"score": 3,
"community_owned": false,
"title": "Hash Function Xor",
"comments": [
{
"comment_id": 45281,
"creation_date": 1358419646,
"owner": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 29213,
"post_type": "question",
"score": 4,
"body": "What do you want to achieve with that? The first one is obviously not collision or second pre-image resistant."
},
{
"comment_id": 45338,
"creation_date": 1358453137,
"owner": {
"user_id": 12407,
"user_type": "registered",
"display_name": "Stephen Touset",
"reputation": 1139,
"email_hash": "9ff064364151151cbce108b869e6e62d"
},
"post_id": 29213,
"post_type": "question",
"score": 0,
"edit_count": 1,
"body": "+1 to @CodesInChaoes. It's important to know what you're trying to accomplish. In addition to the first case, your second example does not uniquely identify the components. Better than both is (probably) H(32-bit-length-of-data1 || data1 || 32-bit-length-of-data2 || data2 || ...). But it's critically important to know exactly the problem you're trying to solve."
},
{
"comment_id": 45340,
"creation_date": 1358453226,
"owner": {
"user_id": 12407,
"user_type": "registered",
"display_name": "Stephen Touset",
"reputation": 1139,
"email_hash": "9ff064364151151cbce108b869e6e62d"
},
"post_id": 29213,
"post_type": "question",
"score": 1,
"edit_count": 1,
"body": "For your concatenation approach, consider H("Bob Dole" || "bobdole@example.com") versus H("Bob Dol" || "ebobdole@example.com"). For the XOR example, consider H(0b0001 ^ 0b0101) versus H(0b0000 ^ 0b0100)."
}
]
},
{
"tags": [
"cryptography",
"storage",
"server"
],
"answer_count": 1,
"answers": [
{
"answer_id": 27792,
"accepted": true,
"answer_comments_url": "/answers/27792/comments",
"question_id": 27789,
"owner": {
"user_id": 18192,
"user_type": "registered",
"display_name": "Cristian Dobre",
"reputation": 3890,
"email_hash": "bdf704acd5eb21225c99c83c3995016f"
},
"creation_date": 1357764522,
"last_activity_date": 1357764522,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 87,
"score": 1,
"community_owned": false,
"title": "Updating stored, encrypted containers on a server",
"comments": [
{
"comment_id": 43607,
"creation_date": 1357764858,
"owner": {
"user_id": 18523,
"user_type": "registered",
"display_name": "RyanInBinary",
"reputation": 118,
"email_hash": "839b5cdd9a518c5bff858e485bcc922b"
},
"post_id": 27792,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "This is exactly what I was looking for, I need to read up on it, but I had a few quick questions for you about it.\n\n1. When using rsync to match the containers, what data specifically is being sent? Is it the bit changes to the container file? \n\n2. What did you mean when you said almost identical encrypted files? The key will still work on it, but what changes?"
},
{
"comment_id": 43612,
"creation_date": 1357767099,
"owner": {
"user_id": 18192,
"user_type": "registered",
"display_name": "Cristian Dobre",
"reputation": 3890,
"email_hash": "bdf704acd5eb21225c99c83c3995016f"
},
"reply_to_user": {
"user_id": 18523,
"user_type": "registered",
"display_name": "RyanInBinary",
"reputation": 118,
"email_hash": "839b5cdd9a518c5bff858e485bcc922b"
},
"post_id": 27792,
"post_type": "answer",
"score": 1,
"body": "1. In order to make the encrypted data "transport efficient", the container is sliced up into chunks and each chunk is encrypted separately. Modifications to one part of the container would trigger a modification to the corresponding chunk. The chunk is modified, encrypted and sync-ed to the other side. 2. A normal encryption scheme would produce two very distinct encrypted files from two slightly different files. This would require resyncing of the whole encrypted file. This method of slicing up and encrypting chunks would produce almost identical encrypted files BUT for the different chunk"
}
]
}
],
"accepted_answer_id": 27792,
"favorite_count": 0,
"question_timeline_url": "/questions/27789/timeline",
"question_comments_url": "/questions/27789/comments",
"question_answers_url": "/questions/27789/answers",
"question_id": 27789,
"owner": {
"user_id": 18523,
"user_type": "registered",
"display_name": "RyanInBinary",
"reputation": 118,
"email_hash": "839b5cdd9a518c5bff858e485bcc922b"
},
"creation_date": 1357763764,
"last_activity_date": 1357764522,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 87,
"score": 3,
"community_owned": false,
"title": "Updating stored, encrypted containers on a server",
"comments": []
},
{
"tags": [
"cryptography",
"random",
"prng"
],
"answer_count": 1,
"answers": [
{
"answer_id": 26736,
"accepted": true,
"answer_comments_url": "/answers/26736/comments",
"question_id": 26734,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1357701451,
"last_activity_date": 1357701451,
"up_vote_count": 8,
"down_vote_count": 0,
"view_count": 101,
"score": 8,
"community_owned": false,
"title": "Detecting PRNG Use from Output",
"comments": [
{
"comment_id": 43491,
"creation_date": 1357701574,
"owner": {
"user_id": 10211,
"user_type": "registered",
"display_name": "Terry Chia",
"reputation": 11070,
"email_hash": "b62ccba5dd465e468c77c495dd67b737"
},
"post_id": 26736,
"post_type": "answer",
"score": 0,
"body": ""woodchuck wielding an abacus"... pure gold."
},
{
"comment_id": 43493,
"creation_date": 1357712130,
"owner": {
"user_id": 18492,
"user_type": "registered",
"display_name": "0x90",
"reputation": 128,
"email_hash": "fac3b8b1ff8fc2b46bf89c8c20ba0f43"
},
"post_id": 26736,
"post_type": "answer",
"score": 0,
"body": "Lost it at the gnome."
}
]
}
],
"accepted_answer_id": 26736,
"favorite_count": 0,
"question_timeline_url": "/questions/26734/timeline",
"question_comments_url": "/questions/26734/comments",
"question_answers_url": "/questions/26734/answers",
"question_id": 26734,
"owner": {
"user_id": 18492,
"user_type": "registered",
"display_name": "0x90",
"reputation": 128,
"email_hash": "fac3b8b1ff8fc2b46bf89c8c20ba0f43"
},
"creation_date": 1357697748,
"last_edit_date": 1357701471,
"last_activity_date": 1357701471,
"up_vote_count": 5,
"down_vote_count": 0,
"view_count": 101,
"score": 5,
"community_owned": false,
"title": "Detecting PRNG Use from Output",
"comments": []
},
{
"tags": [
"encryption",
"cryptography",
"kerberos"
],
"answer_count": 1,
"answers": [
{
"answer_id": 29471,
"accepted": false,
"answer_comments_url": "/answers/29471/comments",
"question_id": 26695,
"owner": {
"user_id": 19905,
"user_type": "registered",
"display_name": "Jeff Hall",
"reputation": 31,
"email_hash": "9786d56108ec805995d152ed5eb99bc4"
},
"creation_date": 1358806305,
"last_activity_date": 1358806305,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 79,
"score": 1,
"community_owned": false,
"title": "Kerberos realm understanding",
"comments": []
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/26695/timeline",
"question_comments_url": "/questions/26695/comments",
"question_answers_url": "/questions/26695/answers",
"question_id": 26695,
"owner": {
"user_id": 18475,
"user_type": "registered",
"display_name": "Dave",
"reputation": 11,
"email_hash": "b2d3942129b64792b32e0ecb3b2c86b7"
},
"creation_date": 1357662143,
"last_activity_date": 1358806305,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 79,
"score": 2,
"community_owned": false,
"title": "Kerberos realm understanding",
"comments": []
},
{
"tags": [
"cryptography",
"public-key-infrastructure",
"digital-signature",
"asymmetric",
"p2p"
],
"answer_count": 3,
"answers": [
{
"answer_id": 26640,
"accepted": true,
"answer_comments_url": "/answers/26640/comments",
"question_id": 26639,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1357591683,
"last_activity_date": 1357591683,
"up_vote_count": 9,
"down_vote_count": 0,
"view_count": 368,
"score": 9,
"community_owned": false,
"title": "Is a 512 bit RSA key secure when used temporary?",
"comments": [
{
"comment_id": 43409,
"creation_date": 1357633901,
"owner": {
"user_id": 17161,
"user_type": "registered",
"display_name": "nightcracker",
"reputation": 165,
"email_hash": "7b4b3e7c9ac68b7d2c93ad02d0b9c79d"
},
"post_id": 26640,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "Thank you, ECDSA seems to be exactly what I want. I'm new to cryptography, and it seems I was trying to hammer in a screw instead of using a screwdriver :)"
},
{
"comment_id": 43411,
"creation_date": 1357634687,
"owner": {
"user_id": 17161,
"user_type": "registered",
"display_name": "nightcracker",
"reputation": 165,
"email_hash": "7b4b3e7c9ac68b7d2c93ad02d0b9c79d"
},
"post_id": 26640,
"post_type": "answer",
"score": 0,
"body": "Actually, considering I'm writing in Python and there is a binding simply available and it does what I want I think I'll settle for ed25519."
}
]
},
{
"answer_id": 26641,
"accepted": false,
"answer_comments_url": "/answers/26641/comments",
"question_id": 26639,
"owner": {
"user_id": 1080,
"user_type": "registered",
"display_name": "bethlakshmi",
"reputation": 6289,
"email_hash": "a4dceca566159e483cb8748012eb3ab2"
},
"creation_date": 1357591744,
"last_activity_date": 1357591744,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 368,
"score": 2,
"community_owned": false,
"title": "Is a 512 bit RSA key secure when used temporary?",
"comments": []
},
{
"answer_id": 26642,
"accepted": false,
"answer_comments_url": "/answers/26642/comments",
"question_id": 26639,
"owner": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"creation_date": 1357591774,
"last_edit_date": 1358500439,
"last_activity_date": 1358500439,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 368,
"score": 2,
"community_owned": false,
"title": "Is a 512 bit RSA key secure when used temporary?",
"comments": []
}
],
"accepted_answer_id": 26640,
"favorite_count": 0,
"question_timeline_url": "/questions/26639/timeline",
"question_comments_url": "/questions/26639/comments",
"question_answers_url": "/questions/26639/answers",
"question_id": 26639,
"owner": {
"user_id": 17161,
"user_type": "registered",
"display_name": "nightcracker",
"reputation": 165,
"email_hash": "7b4b3e7c9ac68b7d2c93ad02d0b9c79d"
},
"creation_date": 1357591183,
"last_edit_date": 1358438307,
"last_activity_date": 1358500439,
"up_vote_count": 5,
"down_vote_count": 0,
"view_count": 368,
"score": 5,
"community_owned": false,
"title": "Is a 512 bit RSA key secure when used temporary?",
"comments": []
},
{
"tags": [
"cryptography",
"authentication",
"software",
"otp"
],
"answer_count": 2,
"answers": [
{
"answer_id": 26565,
"accepted": false,
"answer_comments_url": "/answers/26565/comments",
"question_id": 26559,
"owner": {
"user_id": 18315,
"user_type": "registered",
"display_name": "Dinu S",
"reputation": 1481,
"email_hash": "dca05ac1ce0a49b33357f50901f7a467"
},
"creation_date": 1357463941,
"last_activity_date": 1357463941,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 206,
"score": 2,
"community_owned": false,
"title": "Can I use hardware token OTP to stop piracy?",
"comments": [
{
"comment_id": 43282,
"creation_date": 1357480271,
"owner": {
"user_id": 2138,
"user_type": "registered",
"display_name": "Michael Kjörling",
"reputation": 277,
"email_hash": "fe2211d28f1196deadce36ba7f9cd93e"
},
"post_id": 26565,
"post_type": "answer",
"score": 2,
"edit_count": 1,
"body": ""If the time you have read is before the last save time, then the date has been changed." Two things. Daylight saving time. Or people travelling (especially westwards) and setting their computer's clock to the local time of their destination."
},
{
"comment_id": 43285,
"creation_date": 1357482489,
"owner": {
"user_id": 18315,
"user_type": "registered",
"display_name": "Dinu S",
"reputation": 1481,
"email_hash": "dca05ac1ce0a49b33357f50901f7a467"
},
"reply_to_user": {
"user_id": 2138,
"user_type": "registered",
"display_name": "Michael Kjörling",
"reputation": 277,
"email_hash": "fe2211d28f1196deadce36ba7f9cd93e"
},
"post_id": 26565,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "You are right. This kind of protection has many flaws and it is not the best solution. Of course you may implement certain exceptions, for Daylight saving or small date changes, but the this would still have problems."
}
]
},
{
"answer_id": 26582,
"accepted": true,
"answer_comments_url": "/answers/26582/comments",
"question_id": 26559,
"owner": {
"user_id": 414,
"user_type": "registered",
"display_name": "Gilles",
"reputation": 10126,
"email_hash": "a717291747c76567bb0f086e15ae6e43"
},
"creation_date": 1357514686,
"last_activity_date": 1357514686,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 206,
"score": 1,
"community_owned": false,
"title": "Can I use hardware token OTP to stop piracy?",
"comments": []
}
],
"accepted_answer_id": 26582,
"favorite_count": 0,
"question_timeline_url": "/questions/26559/timeline",
"question_comments_url": "/questions/26559/comments",
"question_answers_url": "/questions/26559/answers",
"question_id": 26559,
"owner": {
"user_id": 18410,
"user_type": "unregistered",
"display_name": "juragan",
"reputation": 8,
"email_hash": "3fad4baeeb2c3cc5e8af77c92b667c9a"
},
"creation_date": 1357432485,
"last_activity_date": 1357514686,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 206,
"score": 1,
"community_owned": false,
"title": "Can I use hardware token OTP to stop piracy?",
"comments": []
},
{
"tags": [
"encryption",
"cryptography"
],
"answer_count": 2,
"answers": [
{
"answer_id": 26529,
"accepted": true,
"answer_comments_url": "/answers/26529/comments",
"question_id": 26528,
"owner": {
"user_id": 975,
"user_type": "registered",
"display_name": "Rook",
"reputation": 21214,
"email_hash": "7cedb843eb2922000eb41b4561ed660d"
},
"creation_date": 1357358134,
"last_edit_date": 1357358763,
"last_activity_date": 1357358763,
"up_vote_count": 4,
"down_vote_count": 0,
"view_count": 316,
"score": 4,
"community_owned": false,
"title": "how strong is AES without salt",
"comments": [
{
"comment_id": 43207,
"creation_date": 1357359980,
"owner": {
"user_id": 6862,
"user_type": "registered",
"display_name": "Novice User",
"reputation": 396,
"email_hash": "1014ba58176f5e095219c3447f85285c"
},
"post_id": 26529,
"post_type": "answer",
"score": 0,
"body": "Thanks ... last link explains quite a lot !"
},
{
"comment_id": 43209,
"creation_date": 1357371917,
"owner": {
"user_id": 6862,
"user_type": "registered",
"display_name": "Novice User",
"reputation": 396,
"email_hash": "1014ba58176f5e095219c3447f85285c"
},
"post_id": 26529,
"post_type": "answer",
"score": 0,
"body": "Though you have explained quite a bit .. but can you emphasize on the downside of the process I am following of using a timestamp for making the cipher different everytime, instead of using an IV ?"
},
{
"comment_id": 43246,
"creation_date": 1357405211,
"owner": {
"user_id": 975,
"user_type": "registered",
"display_name": "Rook",
"reputation": 21214,
"email_hash": "7cedb843eb2922000eb41b4561ed660d"
},
"reply_to_user": {
"user_id": 6862,
"user_type": "registered",
"display_name": "Novice User",
"reputation": 396,
"email_hash": "1014ba58176f5e095219c3447f85285c"
},
"post_id": 26529,
"post_type": "answer",
"score": 0,
"body": "@Novice User It sounds horribly insecure, but I'm not sure that follow. you.. what mode are you using?"
},
{
"comment_id": 43253,
"creation_date": 1357413331,
"owner": {
"user_id": 5400,
"user_type": "registered",
"display_name": "Polynomial",
"reputation": 32757,
"email_hash": "6fc641bdddde78a51c0db6b8527c54f7"
},
"reply_to_user": {
"user_id": 6862,
"user_type": "registered",
"display_name": "Novice User",
"reputation": 396,
"email_hash": "1014ba58176f5e095219c3447f85285c"
},
"post_id": 26529,
"post_type": "answer",
"score": 2,
"body": "@NoviceUser Adding data to the plaintext is a type of cryptographic padding. However, if you're using ECB, you'll still run into the problem that statistical patterns are transferred into the ciphertext, as demonstrated by the above image. Cryptography is hard to get right - you should always use properly tested configurations (i.e. cipher mode, proper IV use, proper key generation, etc.) with a modern cryptographic cipher."
}
]
},
{
"answer_id": 26536,
"accepted": false,
"answer_comments_url": "/answers/26536/comments",
"question_id": 26528,
"owner": {
"user_id": 18315,
"user_type": "registered",
"display_name": "Dinu S",
"reputation": 1481,
"email_hash": "dca05ac1ce0a49b33357f50901f7a467"
},
"creation_date": 1357380629,
"last_activity_date": 1357380629,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 316,
"score": 1,
"community_owned": false,
"title": "how strong is AES without salt",
"comments": []
}
],
"accepted_answer_id": 26529,
"favorite_count": 1,
"question_timeline_url": "/questions/26528/timeline",
"question_comments_url": "/questions/26528/comments",
"question_answers_url": "/questions/26528/answers",
"question_id": 26528,
"owner": {
"user_id": 6862,
"user_type": "registered",
"display_name": "Novice User",
"reputation": 396,
"email_hash": "1014ba58176f5e095219c3447f85285c"
},
"creation_date": 1357357350,
"last_activity_date": 1357380629,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 316,
"score": 3,
"community_owned": false,
"title": "how strong is AES without salt",
"comments": []
},
{
"tags": [
"encryption",
"cryptography",
"passwords",
"authentication"
],
"answer_count": 1,
"answers": [
{
"answer_id": 26591,
"accepted": false,
"answer_comments_url": "/answers/26591/comments",
"question_id": 26527,
"owner": {
"user_id": 18315,
"user_type": "registered",
"display_name": "Dinu S",
"reputation": 1481,
"email_hash": "dca05ac1ce0a49b33357f50901f7a467"
},
"creation_date": 1357543723,
"last_activity_date": 1357543723,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 133,
"score": 2,
"community_owned": false,
"title": "Storing Private Keys Generated on Server with specific User's Password Securely",
"comments": []
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/26527/timeline",
"question_comments_url": "/questions/26527/comments",
"question_answers_url": "/questions/26527/answers",
"question_id": 26527,
"owner": {
"user_id": 16941,
"user_type": "registered",
"display_name": "cgoddard",
"reputation": 111,
"email_hash": "e4d27d7ca92971240991448976f8b1b5"
},
"creation_date": 1357357220,
"last_activity_date": 1357543723,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 133,
"score": 0,
"community_owned": false,
"title": "Storing Private Keys Generated on Server with specific User's Password Securely",
"comments": []
},
{
"tags": [
"cryptography",
"authentication",
"multi-factor"
],
"answer_count": 1,
"answers": [
{
"answer_id": 26265,
"accepted": false,
"answer_comments_url": "/answers/26265/comments",
"question_id": 26261,
"owner": {
"user_id": 28,
"user_type": "registered",
"display_name": "SteveS",
"reputation": 6935,
"email_hash": "0a75c8ca1046d24847d55cd748f53ea3"
},
"creation_date": 1356993944,
"last_activity_date": 1356993944,
"up_vote_count": 4,
"down_vote_count": 0,
"view_count": 161,
"score": 4,
"community_owned": false,
"title": "Can I re-use another vendor's dual factor token in my own system? (Avoid physical token bloat)",
"comments": [
{
"comment_id": 42790,
"creation_date": 1356998700,
"owner": {
"user_id": 17000,
"user_type": "registered",
"display_name": "Happy ninja",
"reputation": 117,
"email_hash": "bd1dd31b1f99e9978cd88f042a74fb5c"
},
"post_id": 26265,
"post_type": "answer",
"score": 1,
"body": "the system holding information need at least the same level of security as the information it hold."
}
]
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/26261/timeline",
"question_comments_url": "/questions/26261/comments",
"question_answers_url": "/questions/26261/answers",
"question_id": 26261,
"owner": {
"user_id": 396,
"user_type": "registered",
"display_name": "makerofthings7",
"reputation": 12638,
"email_hash": "9cc3e3bb2ff2ef30810be80ca741de70"
},
"creation_date": 1356990516,
"last_activity_date": 1356993944,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 161,
"score": 3,
"community_owned": false,
"title": "Can I re-use another vendor's dual factor token in my own system? (Avoid physical token bloat)",
"comments": []
},
{
"tags": [
"encryption",
"cryptography",
"aes",
"des"
],
"answer_count": 2,
"answers": [
{
"answer_id": 26181,
"accepted": true,
"answer_comments_url": "/answers/26181/comments",
"question_id": 26179,
"owner": {
"user_id": 18192,
"user_type": "registered",
"display_name": "Cristian Dobre",
"reputation": 3890,
"email_hash": "bdf704acd5eb21225c99c83c3995016f"
},
"creation_date": 1356809209,
"last_edit_date": 1357246760,
"last_activity_date": 1357246760,
"up_vote_count": 11,
"down_vote_count": 0,
"view_count": 1402,
"score": 11,
"community_owned": false,
"title": "Security comparsion of 3DES and AES",
"comments": [
{
"comment_id": 42929,
"creation_date": 1357157820,
"owner": {
"user_id": 5501,
"user_type": "registered",
"display_name": "Andrey Botalov",
"reputation": 1132,
"email_hash": "4e31661f52c220d37ac75e105bfddf1f"
},
"post_id": 26181,
"post_type": "answer",
"score": 1,
"edit_count": 2,
"body": "AES and other NIST standards aren't very good in software"
},
{
"comment_id": 43096,
"creation_date": 1357247546,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"reply_to_user": {
"user_id": 5501,
"user_type": "registered",
"display_name": "Andrey Botalov",
"reputation": 1132,
"email_hash": "4e31661f52c220d37ac75e105bfddf1f"
},
"post_id": 26181,
"post_type": "answer",
"score": 1,
"edit_count": 1,
"body": "@AndreyBotalov: for the case AES, this is a quite biased view. At the time of the AES selection process (I was there !), after having assembled lots of analysis to the effect that 13 of the 15 candidates looked "rock solid", a lot of performance measurements were done, and Rijndael was one of the "fast" ciphers. Actually it was the one which was the most consistently fast across many architectures, and that was very instrumental in its choice. RC6 was faster on a PC but a PC is the last platform to have real encryption performance issues. AES beats RC6 on smartcards and small ARM/Mips."
},
{
"comment_id": 43642,
"creation_date": 1357809375,
"owner": {
"user_id": 5400,
"user_type": "registered",
"display_name": "Polynomial",
"reputation": 32757,
"email_hash": "6fc641bdddde78a51c0db6b8527c54f7"
},
"post_id": 26181,
"post_type": "answer",
"score": 0,
"body": "Plus we now have AES extensions in modern processors, which can massively increase the speed of the cipher."
}
]
},
{
"answer_id": 26185,
"accepted": false,
"answer_comments_url": "/answers/26185/comments",
"question_id": 26179,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1356811500,
"last_activity_date": 1356811500,
"up_vote_count": 11,
"down_vote_count": 0,
"view_count": 1402,
"score": 11,
"community_owned": false,
"title": "Security comparsion of 3DES and AES",
"comments": [
{
"comment_id": 42690,
"creation_date": 1356826329,
"owner": {
"user_id": 11869,
"user_type": "registered",
"display_name": "Rell3oT",
"reputation": 1577,
"email_hash": "a80bb08451e390eecbea836c9b422ac2"
},
"post_id": 26185,
"post_type": "answer",
"score": 6,
"body": "Thanks, I learned a new technical term today. "Quite a lot of data""
},
{
"comment_id": 42696,
"creation_date": 1356828136,
"owner": {
"user_id": 1373,
"user_type": "registered",
"display_name": "Reid",
"reputation": 103,
"email_hash": "47e59138176e5872732d321f0cff6279"
},
"post_id": 26185,
"post_type": "answer",
"score": 2,
"edit_count": 1,
"body": "+1 for "quite a lot of data." According to WolframAlpha, 2^68 bytes of data is approximately 20 times the information content of "all human knowledge.""
},
{
"comment_id": 42928,
"creation_date": 1357157622,
"owner": {
"user_id": 5501,
"user_type": "registered",
"display_name": "Andrey Botalov",
"reputation": 1132,
"email_hash": "4e31661f52c220d37ac75e105bfddf1f"
},
"post_id": 26185,
"post_type": "answer",
"score": 0,
"body": "It should be 2^64"
},
{
"comment_id": 42941,
"creation_date": 1357162132,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"reply_to_user": {
"user_id": 5501,
"user_type": "registered",
"display_name": "Andrey Botalov",
"reputation": 1132,
"email_hash": "4e31661f52c220d37ac75e105bfddf1f"
},
"post_id": 26185,
"post_type": "answer",
"score": 3,
"body": "@AndreyBotalov: it is 2^64 blocks, and each block is 16 bytes (2^4), hence 2^68 bytes."
}
]
}
],
"accepted_answer_id": 26181,
"favorite_count": 0,
"question_timeline_url": "/questions/26179/timeline",
"question_comments_url": "/questions/26179/comments",
"question_answers_url": "/questions/26179/answers",
"question_id": 26179,
"owner": {
"user_id": 15038,
"user_type": "registered",
"display_name": "DaGhostman Dimitrov",
"reputation": 155,
"email_hash": "ff6edc2734a306e7a215e743e02e5055"
},
"creation_date": 1356804904,
"last_edit_date": 1357486689,
"last_activity_date": 1357486689,
"up_vote_count": 4,
"down_vote_count": 0,
"view_count": 1402,
"score": 4,
"community_owned": false,
"title": "Security comparsion of 3DES and AES",
"comments": []
},
{
"tags": [
"encryption",
"cryptography",
"authentication",
"multi-factor"
],
"answer_count": 1,
"answers": [
{
"answer_id": 26258,
"accepted": false,
"answer_comments_url": "/answers/26258/comments",
"question_id": 26105,
"owner": {
"user_id": 18236,
"user_type": "unregistered",
"display_name": "David Maples",
"reputation": 31,
"email_hash": "9af00bd66e76cfea2c6d143caa32d123"
},
"creation_date": 1356980414,
"last_activity_date": 1356980414,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 159,
"score": 3,
"community_owned": false,
"title": "How does the YubiKey Validation Server work from an encryption perspective?",
"comments": [
{
"comment_id": 51143,
"creation_date": 1363784466,
"owner": {
"user_id": 3272,
"user_type": "registered",
"display_name": "Tobias Kienzler",
"reputation": 704,
"email_hash": "79175a222a9933b9fc278cd94b228bf7"
},
"post_id": 26258,
"post_type": "answer",
"score": 0,
"body": "Hello David, welcome to security.SE! It is great that you directly indicate your affiliation, but in contrast to a forum we prefer putting this in the "About me" section of the user section instead - that way it will always be up to date (and when you have gained 1000 rep, the text will be shown when hovering over your user icon: security.stackexchange.com/privileges/established-user)"
}
]
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/26105/timeline",
"question_comments_url": "/questions/26105/comments",
"question_answers_url": "/questions/26105/answers",
"question_id": 26105,
"owner": {
"user_id": 396,
"user_type": "registered",
"display_name": "makerofthings7",
"reputation": 12638,
"email_hash": "9cc3e3bb2ff2ef30810be80ca741de70"
},
"creation_date": 1356702523,
"last_edit_date": 1356712667,
"last_activity_date": 1356980414,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 159,
"score": 0,
"community_owned": false,
"title": "How does the YubiKey Validation Server work from an encryption perspective?",
"comments": []
},
{
"tags": [
"encryption",
"cryptography"
],
"answer_count": 1,
"answers": [
{
"answer_id": 26064,
"accepted": true,
"answer_comments_url": "/answers/26064/comments",
"question_id": 26033,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1356632539,
"last_activity_date": 1356632539,
"up_vote_count": 5,
"down_vote_count": 0,
"view_count": 154,
"score": 5,
"community_owned": false,
"title": "Combining MAC and Encryption",
"comments": []
}
],
"accepted_answer_id": 26064,
"favorite_count": 2,
"question_timeline_url": "/questions/26033/timeline",
"question_comments_url": "/questions/26033/comments",
"question_answers_url": "/questions/26033/answers",
"question_id": 26033,
"owner": {
"user_id": 11801,
"user_type": "registered",
"display_name": "Ali Ahmad",
"reputation": 1453,
"email_hash": "213640d2094df6d75b4c9344846aaef1"
},
"creation_date": 1356606229,
"last_edit_date": 1359633996,
"last_activity_date": 1359633996,
"up_vote_count": 5,
"down_vote_count": 1,
"view_count": 154,
"score": 4,
"community_owned": false,
"title": "Combining MAC and Encryption",
"comments": [
{
"comment_id": 42549,
"creation_date": 1356618453,
"owner": {
"user_id": 10211,
"user_type": "registered",
"display_name": "Terry Chia",
"reputation": 11070,
"email_hash": "b62ccba5dd465e468c77c495dd67b737"
},
"post_id": 26033,
"post_type": "question",
"score": 1,
"body": "Another option would be to use a authenticated mode like GCM."
}
]
},
{
"tags": [
"cryptography",
"vpn"
],
"answer_count": 1,
"answers": [
{
"answer_id": 25973,
"accepted": true,
"answer_comments_url": "/answers/25973/comments",
"question_id": 25971,
"owner": {
"user_id": 971,
"user_type": "registered",
"display_name": "D.W.",
"reputation": 44861,
"email_hash": "6dd038614af7e490e8baf53483637999"
},
"creation_date": 1356485877,
"last_edit_date": 1356486233,
"last_activity_date": 1356486233,
"up_vote_count": 3,
"down_vote_count": 0,
"view_count": 232,
"score": 3,
"community_owned": false,
"title": "OpenVPN Why CBC mode is recommended?",
"comments": [
{
"comment_id": 42469,
"creation_date": 1356514693,
"owner": {
"user_id": 17115,
"user_type": "registered",
"display_name": "Disa",
"reputation": 165,
"email_hash": "a27797089c8d03c6fd0c99078e8367dd"
},
"post_id": 25973,
"post_type": "answer",
"score": 0,
"body": "Thank you for the answer. BTW I updated my first post to include the link."
}
]
}
],
"accepted_answer_id": 25973,
"favorite_count": 1,
"question_timeline_url": "/questions/25971/timeline",
"question_comments_url": "/questions/25971/comments",
"question_answers_url": "/questions/25971/answers",
"question_id": 25971,
"owner": {
"user_id": 17115,
"user_type": "registered",
"display_name": "Disa",
"reputation": 165,
"email_hash": "a27797089c8d03c6fd0c99078e8367dd"
},
"creation_date": 1356465598,
"last_edit_date": 1356559349,
"last_activity_date": 1356559349,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 232,
"score": 2,
"community_owned": false,
"title": "OpenVPN Why CBC mode is recommended?",
"comments": [
{
"comment_id": 42457,
"creation_date": 1356474354,
"owner": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 25971,
"post_type": "question",
"score": 0,
"body": "If it's used correctly (With random IV and a MAC in a encrypt-then-mac scheme) CBC is secure."
},
{
"comment_id": 42461,
"creation_date": 1356486287,
"owner": {
"user_id": 971,
"user_type": "registered",
"display_name": "D.W.",
"reputation": 44861,
"email_hash": "6dd038614af7e490e8baf53483637999"
},
"post_id": 25971,
"post_type": "question",
"score": 0,
"edit_count": 1,
"body": "By the way: Welcome to IT Security, Disa!"
}
]
},
{
"tags": [
"cryptography",
"authentication"
],
"answer_count": 1,
"answers": [
{
"answer_id": 25841,
"accepted": true,
"answer_comments_url": "/answers/25841/comments",
"question_id": 25840,
"owner": {
"user_id": 5400,
"user_type": "registered",
"display_name": "Polynomial",
"reputation": 32757,
"email_hash": "6fc641bdddde78a51c0db6b8527c54f7"
},
"creation_date": 1356090872,
"last_activity_date": 1356090872,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 92,
"score": 2,
"community_owned": false,
"title": "Reasonable computationally lightweight security?",
"comments": [
{
"comment_id": 42243,
"creation_date": 1356091444,
"owner": {
"user_id": 17783,
"user_type": "registered",
"display_name": "SF.",
"reputation": 108,
"email_hash": "81060fe344980bc9a3273a48b8f3e31c"
},
"post_id": 25841,
"post_type": "answer",
"score": 0,
"body": "I'm not very worried about man-in-the-middle: the infrastructure makes it difficult. While sniffing and injection of packets would be still within reach of the attacker, compromising/replacing one of the nodes would be rather hard. Besides, the asset protected isn't very valuable - more of a target for pranks than for data theft - the attacker has little to gain. Still, SSL may be the right avenue; SSH works quite reasonably on the system."
},
{
"comment_id": 42262,
"creation_date": 1356096284,
"owner": {
"user_id": 16502,
"user_type": "registered",
"display_name": "Callum Wilson",
"reputation": 1285,
"email_hash": "5b71c36bad02b411d657e96418036541"
},
"post_id": 25841,
"post_type": "answer",
"score": 0,
"body": "TLS is easy on CPU most of the time - but the connection process is very hard on CPUs where there is no client side certificate. So if the system has lots of single request SSL connections then the CPU will have a tough time coping. (*depends on what "a lot" is in the context of this question)"
},
{
"comment_id": 42757,
"creation_date": 1356912166,
"owner": {
"user_id": 5400,
"user_type": "registered",
"display_name": "Polynomial",
"reputation": 32757,
"email_hash": "6fc641bdddde78a51c0db6b8527c54f7"
},
"reply_to_user": {
"user_id": 16502,
"user_type": "registered",
"display_name": "Callum Wilson",
"reputation": 1285,
"email_hash": "5b71c36bad02b411d657e96418036541"
},
"post_id": 25841,
"post_type": "answer",
"score": 0,
"body": "@CallumWilson It depends on the CPU, really. It's possible to implement SSL on a 40MHz SoC microcontroller and still cope with up to a dozen concurrent clients. If you've got to deal with hundreds or thousands of connections per second, then SSL might become a burden on a modern machine, but below that level you should be absolutely fine."
}
]
}
],
"accepted_answer_id": 25841,
"favorite_count": 0,
"question_timeline_url": "/questions/25840/timeline",
"question_comments_url": "/questions/25840/comments",
"question_answers_url": "/questions/25840/answers",
"question_id": 25840,
"owner": {
"user_id": 17783,
"user_type": "registered",
"display_name": "SF.",
"reputation": 108,
"email_hash": "81060fe344980bc9a3273a48b8f3e31c"
},
"creation_date": 1356089770,
"last_edit_date": 1356096699,
"last_activity_date": 1356096699,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 92,
"score": 1,
"community_owned": false,
"title": "Reasonable computationally lightweight security?",
"comments": [
{
"comment_id": 42242,
"creation_date": 1356091324,
"owner": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 25840,
"post_type": "question",
"score": 0,
"body": "Depending on the application, you might be able to let the client do the hashing. It doesn't matter if it is honest, since the only one he can hurt with bad hashing is himself."
},
{
"comment_id": 42245,
"creation_date": 1356091476,
"owner": {
"user_id": 17783,
"user_type": "registered",
"display_name": "SF.",
"reputation": 108,
"email_hash": "81060fe344980bc9a3273a48b8f3e31c"
},
"reply_to_user": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 25840,
"post_type": "question",
"score": 0,
"edit_count": 1,
"body": "@CodesInChaos: I'm more worried about password theft. Since the challenge is plaintext and a part of the hash, known plaintext attack might reveal the password."
},
{
"comment_id": 42247,
"creation_date": 1356091793,
"owner": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 25840,
"post_type": "question",
"score": 0,
"body": "These hashfunctions are used for key strengthening. This can be done on the client without any issues. You can combine it with a cheap hashing step done on the server."
},
{
"comment_id": 42250,
"creation_date": 1356093047,
"owner": {
"user_id": 485,
"user_type": "moderator",
"display_name": "Rory Alsop",
"reputation": 32567,
"email_hash": "af1ed0816ed5a2164a4e343ad09309ad"
},
"post_id": 25840,
"post_type": "question",
"score": 0,
"body": "Can you define what you mean by "The honest systems" - my understanding of this phrase really doesn't fit here."
},
{
"comment_id": 42258,
"creation_date": 1356095678,
"owner": {
"user_id": 17783,
"user_type": "registered",
"display_name": "SF.",
"reputation": 108,
"email_hash": "81060fe344980bc9a3273a48b8f3e31c"
},
"reply_to_user": {
"user_id": 485,
"user_type": "moderator",
"display_name": "Rory Alsop",
"reputation": 32567,
"email_hash": "af1ed0816ed5a2164a4e343ad09309ad"
},
"post_id": 25840,
"post_type": "question",
"score": 0,
"edit_count": 1,
"body": "@Rory: as per security.stackexchange.com/a/6415/17783 - off-the-shelf hardware, a PC or something comparable. (it is entirely possible I mis-understood the term...)"
},
{
"comment_id": 42261,
"creation_date": 1356096166,
"owner": {
"user_id": 13909,
"user_type": "registered",
"display_name": "Mark C. Wallace",
"reputation": 1540,
"email_hash": "5c308d4d2c3aea44ec6ef525706e5254"
},
"post_id": 25840,
"post_type": "question",
"score": 0,
"edit_count": 1,
"body": "I believe the "honest" system in the referenced article is the defending system - i.e. one which is controlled by admin, not the attacker. There is an embedded assumption, but I think it is legitimate for this case."
}
]
},
{
"tags": [
"cryptography",
"programming"
],
"answer_count": 7,
"answers": [
{
"answer_id": 25852,
"accepted": false,
"answer_comments_url": "/answers/25852/comments",
"question_id": 25835,
"owner": {
"user_id": 17804,
"user_type": "registered",
"display_name": "David R.",
"reputation": 211,
"email_hash": "8fe34365d6b8a5d2daea5c3378744ae3"
},
"creation_date": 1356098774,
"last_activity_date": 1356098774,
"up_vote_count": 11,
"down_vote_count": 0,
"view_count": 611,
"score": 11,
"community_owned": false,
"title": "At what level of abstraction should a developer work with with regards to cryptography?",
"comments": [
{
"comment_id": 42278,
"creation_date": 1356104122,
"owner": {
"user_id": 13909,
"user_type": "registered",
"display_name": "Mark C. Wallace",
"reputation": 1540,
"email_hash": "5c308d4d2c3aea44ec6ef525706e5254"
},
"post_id": 25852,
"post_type": "answer",
"score": 6,
"body": "+1 for the rarely noted, but quite valid "Obfuscation is a valid layer of defense in depth,""
},
{
"comment_id": 42456,
"creation_date": 1356471662,
"owner": {
"user_id": 4967,
"user_type": "registered",
"display_name": "Bernie White",
"reputation": 1859,
"email_hash": "39490337e09de0998dd48cf11deedc46"
},
"post_id": 25852,
"post_type": "answer",
"score": 0,
"body": "Obfuscation has it's place but not everywhere is the right place. Equally obfuscation can decrease internal understanding of a configuration by the people who run it, this increases the risk of error, which decreases security over time and also reduces the ability to detect security events of interest."
}
]
},
{
"answer_id": 25936,
"accepted": false,
"answer_comments_url": "/answers/25936/comments",
"question_id": 25835,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1356374113,
"last_activity_date": 1356374113,
"up_vote_count": 11,
"down_vote_count": 0,
"view_count": 611,
"score": 11,
"community_owned": false,
"title": "At what level of abstraction should a developer work with with regards to cryptography?",
"comments": [
{
"comment_id": 42704,
"creation_date": 1356859489,
"owner": {
"user_id": 33,
"user_type": "moderator",
"display_name": "AviD",
"reputation": 20366,
"email_hash": "a88248f632c039340efa02505be355e5"
},
"post_id": 25936,
"post_type": "answer",
"score": 0,
"body": "Even according to your ideal world, there is still a gap between (step 1) analyze the problem, and (step 2) find an existing protocol which matches his problem. That is, there is a not-insignificant problem of misapplied protocols. Using a well-vetted protocol for the wrong problem usually results in additional security vulnerabilities. There is an implicit assumption in your statement, that he understands the protocol's context well-enough to know that it matches his problem, or not."
}
]
},
{
"answer_id": 25846,
"accepted": false,
"answer_comments_url": "/answers/25846/comments",
"question_id": 25835,
"owner": {
"user_id": 17793,
"user_type": "unregistered",
"display_name": "Joseph K.",
"reputation": 71,
"email_hash": "affbc7cb94aad0eb8ae94be864974c66"
},
"creation_date": 1356095135,
"last_activity_date": 1356095135,
"up_vote_count": 7,
"down_vote_count": 0,
"view_count": 611,
"score": 7,
"community_owned": false,
"title": "At what level of abstraction should a developer work with with regards to cryptography?",
"comments": [
{
"comment_id": 42265,
"creation_date": 1356096580,
"owner": {
"user_id": 13909,
"user_type": "registered",
"display_name": "Mark C. Wallace",
"reputation": 1540,
"email_hash": "5c308d4d2c3aea44ec6ef525706e5254"
},
"post_id": 25846,
"post_type": "answer",
"score": 3,
"body": "A link to the class would have been nice, and I'm not sure you've really addressed the OP's question. But welcome to the site."
},
{
"comment_id": 42413,
"creation_date": 1356381917,
"owner": {
"user_id": 2264,
"user_type": "registered",
"display_name": "tylerl",
"reputation": 11081,
"email_hash": "d767f66c88601286938590f8ab51bf35"
},
"post_id": 25846,
"post_type": "answer",
"score": 0,
"edit_count": 1,
"body": "Presumably he's talking about the coursera crypto course. Seems to fit the description."
}
]
},
{
"answer_id": 26056,
"accepted": true,
"answer_comments_url": "/answers/26056/comments",
"question_id": 25835,
"owner": {
"user_id": 1080,
"user_type": "registered",
"display_name": "bethlakshmi",
"reputation": 6289,
"email_hash": "a4dceca566159e483cb8748012eb3ab2"
},
"creation_date": 1356626614,
"last_activity_date": 1356626614,
"up_vote_count": 6,
"down_vote_count": 0,
"view_count": 611,
"score": 6,
"community_owned": false,
"title": "At what level of abstraction should a developer work with with regards to cryptography?",
"comments": []
},
{
"answer_id": 25857,
"accepted": false,
"answer_comments_url": "/answers/25857/comments",
"question_id": 25835,
"owner": {
"user_id": 8281,
"user_type": "registered",
"display_name": "KeithS",
"reputation": 2684,
"email_hash": "8f455043e5d839da0c6695407b318ad5"
},
"creation_date": 1356107451,
"last_activity_date": 1356107451,
"up_vote_count": 5,
"down_vote_count": 0,
"view_count": 611,
"score": 5,
"community_owned": false,
"title": "At what level of abstraction should a developer work with with regards to cryptography?",
"comments": []
},
{
"answer_id": 25938,
"accepted": false,
"answer_comments_url": "/answers/25938/comments",
"question_id": 25835,
"owner": {
"user_id": 2264,
"user_type": "registered",
"display_name": "tylerl",
"reputation": 11081,
"email_hash": "d767f66c88601286938590f8ab51bf35"
},
"creation_date": 1356382608,
"last_activity_date": 1356382608,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 611,
"score": 2,
"community_owned": false,
"title": "At what level of abstraction should a developer work with with regards to cryptography?",
"comments": []
},
{
"answer_id": 25930,
"accepted": false,
"answer_comments_url": "/answers/25930/comments",
"question_id": 25835,
"owner": {
"user_id": 10836,
"user_type": "registered",
"display_name": "miniBill",
"reputation": 109,
"email_hash": "fdb435376f06014566318fd7e920d25c"
},
"creation_date": 1356345672,
"last_activity_date": 1356345672,
"up_vote_count": 1,
"down_vote_count": 1,
"view_count": 611,
"score": 0,
"community_owned": false,
"title": "At what level of abstraction should a developer work with with regards to cryptography?",
"comments": [
{
"comment_id": 42407,
"creation_date": 1356367295,
"owner": {
"user_id": 414,
"user_type": "registered",
"display_name": "Gilles",
"reputation": 10126,
"email_hash": "a717291747c76567bb0f086e15ae6e43"
},
"post_id": 25930,
"post_type": "answer",
"score": 1,
"body": "I think you misunderstood the question. This isn't about at which stage of processing cryptography should be used, but what level of abstraction most developers should view cryptography from: do they need to understand Merkle-Damgård constructions or can they treat SHA-2 as a black box? Is it enough to view SSL as a secure channel or is a more detailed understanding necessary? etc."
},
{
"comment_id": 42412,
"creation_date": 1356380288,
"owner": {
"user_id": 10836,
"user_type": "registered",
"display_name": "miniBill",
"reputation": 109,
"email_hash": "fdb435376f06014566318fd7e920d25c"
},
"reply_to_user": {
"user_id": 414,
"user_type": "registered",
"display_name": "Gilles",
"reputation": 10126,
"email_hash": "a717291747c76567bb0f086e15ae6e43"
},
"post_id": 25930,
"post_type": "answer",
"score": 0,
"body": "Yes, you are right, I completely misunderstood the question :) Should I delete my answer?"
}
]
}
],
"accepted_answer_id": 26056,
"favorite_count": 5,
"bounty_amount": 50,
"question_timeline_url": "/questions/25835/timeline",
"question_comments_url": "/questions/25835/comments",
"question_answers_url": "/questions/25835/answers",
"question_id": 25835,
"owner": {
"user_id": 10211,
"user_type": "registered",
"display_name": "Terry Chia",
"reputation": 11070,
"email_hash": "b62ccba5dd465e468c77c495dd67b737"
},
"creation_date": 1356088183,
"last_activity_date": 1356626614,
"up_vote_count": 19,
"down_vote_count": 0,
"view_count": 611,
"score": 19,
"community_owned": false,
"title": "At what level of abstraction should a developer work with with regards to cryptography?",
"comments": [
{
"comment_id": 42232,
"creation_date": 1356088997,
"owner": {
"user_id": 33,
"user_type": "moderator",
"display_name": "AviD",
"reputation": 20366,
"email_hash": "a88248f632c039340efa02505be355e5"
},
"post_id": 25835,
"post_type": "question",
"score": 6,
"body": "I would say, don't use uLogin. That would require you to use PHP."
},
{
"comment_id": 42405,
"creation_date": 1356354676,
"owner": {
"user_id": 5263,
"user_type": "registered",
"display_name": "pipTheGeek",
"reputation": 191,
"email_hash": "97a64435b3b6b1f1330a8f2adb2eecd4"
},
"post_id": 25835,
"post_type": "question",
"score": 2,
"body": "Doesn't Jeff's post cover it? The highest level possible, and no lower than the level at which you are expert."
},
{
"comment_id": 42406,
"creation_date": 1356357915,
"owner": {
"user_id": 10211,
"user_type": "registered",
"display_name": "Terry Chia",
"reputation": 11070,
"email_hash": "b62ccba5dd465e468c77c495dd67b737"
},
"reply_to_user": {
"user_id": 5263,
"user_type": "registered",
"display_name": "pipTheGeek",
"reputation": 191,
"email_hash": "97a64435b3b6b1f1330a8f2adb2eecd4"
},
"post_id": 25835,
"post_type": "question",
"score": 1,
"body": "@pipTheGeek Because while I certainly respect Jeff's opinions, he is certainly no security expert. Nothing wrong with getting the opinions of the experts over here eh?"
},
{
"comment_id": 42425,
"creation_date": 1356387248,
"owner": {
"user_id": 18017,
"user_type": "registered",
"display_name": "K1773R",
"reputation": 111,
"email_hash": "6b42bd2a520266e8b02254a044cea36b"
},
"reply_to_user": {
"user_id": 5263,
"user_type": "registered",
"display_name": "pipTheGeek",
"reputation": 191,
"email_hash": "97a64435b3b6b1f1330a8f2adb2eecd4"
},
"post_id": 25835,
"post_type": "question",
"score": 0,
"body": "@pipTheGeek perfect answer."
}
]
},
{
"tags": [
"cryptography",
"javascript",
"browser"
],
"answer_count": 0,
"favorite_count": 0,
"closed_date": 1356026408,
"closed_reason": "exact duplicate",
"question_timeline_url": "/questions/25730/timeline",
"question_comments_url": "/questions/25730/comments",
"question_answers_url": "/questions/25730/answers",
"question_id": 25730,
"owner": {
"user_id": 13239,
"user_type": "registered",
"display_name": "Jonathan Garber",
"reputation": 316,
"email_hash": "8981af42f91e5fbf174bc8616677ef3e"
},
"creation_date": 1356016476,
"last_activity_date": 1356016476,
"up_vote_count": 4,
"down_vote_count": 1,
"view_count": 59,
"score": 3,
"community_owned": false,
"title": "Is the use of JavaScript for cryptography ever appropriate in the browser?",
"comments": [
{
"comment_id": 42168,
"creation_date": 1356040419,
"owner": {
"user_id": 6566,
"user_type": "registered",
"display_name": "bobince",
"reputation": 3085,
"email_hash": "3f6f1bea81a68b2f1cfe3efbb9be94bc"
},
"post_id": 25730,
"post_type": "question",
"score": 0,
"body": "There are certainly niche uses for crypto in JS. But it is never a substitute for protecting the parent connection with TLS, due to the trust-bootstrapping problem."
}
]
},
{
"tags": [
"encryption",
"cryptography",
"public-key-infrastructure"
],
"answer_count": 0,
"favorite_count": 0,
"closed_date": 1355756290,
"closed_reason": "off topic",
"question_timeline_url": "/questions/25502/timeline",
"question_comments_url": "/questions/25502/comments",
"question_answers_url": "/questions/25502/answers",
"question_id": 25502,
"owner": {
"user_id": 20882,
"user_type": "registered",
"display_name": "pier",
"reputation": 55,
"email_hash": "ab1a49a1aa0895445fdfbc1c0d5296d7"
},
"creation_date": 1355670287,
"last_edit_date": 1355732824,
"last_activity_date": 1355732824,
"up_vote_count": 1,
"down_vote_count": 1,
"view_count": 81,
"score": 0,
"community_owned": false,
"title": "What McEliece key size can provide standard security today?",
"comments": [
{
"comment_id": 41678,
"creation_date": 1355750545,
"owner": {
"user_id": 3826,
"user_type": "registered",
"display_name": "CodesInChaos",
"reputation": 3867,
"email_hash": "57e2ba76e6290c4e9e19821a068bc8c1"
},
"post_id": 25502,
"post_type": "question",
"score": 0,
"edit_count": 1,
"body": "cross posted on crypto.SE: crypto.stackexchange.com/questions/5719/…"
},
{
"comment_id": 41686,
"creation_date": 1355756274,
"owner": {
"user_id": 33,
"user_type": "moderator",
"display_name": "AviD",
"reputation": 20366,
"email_hash": "a88248f632c039340efa02505be355e5"
},
"post_id": 25502,
"post_type": "question",
"score": 0,
"body": "Pier please do not crosspost between SE sites. If you need to, you can flag it for a moderator's attention to migrate it."
}
]
},
{
"tags": [
"encryption",
"cryptography",
"ssl",
"asymmetric"
],
"answer_count": 2,
"answers": [
{
"answer_id": 25507,
"accepted": false,
"answer_comments_url": "/answers/25507/comments",
"question_id": 25496,
"owner": {
"user_id": 17035,
"user_type": "registered",
"display_name": "mricon",
"reputation": 755,
"email_hash": "fcd791a56792e612a8ed1ddbbfa73535"
},
"creation_date": 1355675680,
"last_edit_date": 1355676607,
"last_activity_date": 1355676607,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 461,
"score": 2,
"community_owned": false,
"title": "KDC(Key Distribution Center) vs Asymmetric Key Exchange",
"comments": []
},
{
"answer_id": 26086,
"accepted": false,
"answer_comments_url": "/answers/26086/comments",
"question_id": 25496,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1356644019,
"last_activity_date": 1356644019,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 461,
"score": 1,
"community_owned": false,
"title": "KDC(Key Distribution Center) vs Asymmetric Key Exchange",
"comments": []
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/25496/timeline",
"question_comments_url": "/questions/25496/comments",
"question_answers_url": "/questions/25496/answers",
"question_id": 25496,
"owner": {
"user_id": 17138,
"user_type": "registered",
"display_name": "caramel1995",
"reputation": 106,
"email_hash": "c25a2661b0fb2a324cb59d3e697db90d"
},
"creation_date": 1355655769,
"last_edit_date": 1355696000,
"last_activity_date": 1356644019,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 461,
"score": 1,
"community_owned": false,
"title": "KDC(Key Distribution Center) vs Asymmetric Key Exchange",
"comments": []
},
{
"tags": [
"cryptography",
"passwords"
],
"answer_count": 1,
"answers": [
{
"answer_id": 25432,
"accepted": false,
"answer_comments_url": "/answers/25432/comments",
"question_id": 25431,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"creation_date": 1355494335,
"last_activity_date": 1355494335,
"up_vote_count": 0,
"down_vote_count": 0,
"view_count": 132,
"score": 0,
"community_owned": false,
"title": "What is the highest limit of security in the biggest agencies of the world?",
"comments": [
{
"comment_id": 41535,
"creation_date": 1355494462,
"owner": {
"user_id": 9377,
"user_type": "registered",
"display_name": "lynks",
"reputation": 4352,
"email_hash": "9a21812b9a1037044c110bc3c8948627"
},
"post_id": 25432,
"post_type": "answer",
"score": 0,
"body": "thanks, now I'm going to have that song in my head all afternoon..."
},
{
"comment_id": 41536,
"creation_date": 1355494575,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"reply_to_user": {
"user_id": 9377,
"user_type": "registered",
"display_name": "lynks",
"reputation": 4352,
"email_hash": "9a21812b9a1037044c110bc3c8948627"
},
"post_id": 25432,
"post_type": "answer",
"score": 0,
"body": "@Lynks - I'm a little scared to ask... what song?"
},
{
"comment_id": 41538,
"creation_date": 1355494825,
"owner": {
"user_id": 9377,
"user_type": "registered",
"display_name": "lynks",
"reputation": 4352,
"email_hash": "9a21812b9a1037044c110bc3c8948627"
},
"post_id": 25432,
"post_type": "answer",
"score": 0,
"body": "I take no responsibility for any loss of kudos you may suffer as a result of humming this in the elevator: youtube.com/watch?v=Yw5RkzbHb-w"
}
]
}
],
"favorite_count": 0,
"closed_date": 1355494313,
"closed_reason": "not a real question",
"question_timeline_url": "/questions/25431/timeline",
"question_comments_url": "/questions/25431/comments",
"question_answers_url": "/questions/25431/answers",
"question_id": 25431,
"owner": {
"user_id": 16084,
"user_type": "registered",
"display_name": "Salman",
"reputation": 60,
"email_hash": "58009de1944998a7111f3afffc916fe5"
},
"creation_date": 1355493848,
"last_edit_date": 1355614730,
"last_activity_date": 1355614730,
"up_vote_count": 0,
"down_vote_count": 3,
"view_count": 132,
"score": -3,
"community_owned": false,
"title": "What is the highest limit of security in the biggest agencies of the world?",
"comments": [
{
"comment_id": 41533,
"creation_date": 1355493934,
"owner": {
"user_id": 5400,
"user_type": "registered",
"display_name": "Polynomial",
"reputation": 32757,
"email_hash": "6fc641bdddde78a51c0db6b8527c54f7"
},
"post_id": 25431,
"post_type": "question",
"score": 4,
"body": "Security in what sense? Physical? Cryptographic? Process-based? Authentication? Authorization? There are so many variables. This is an incredibly vague, unanswerable question."
},
{
"comment_id": 41534,
"creation_date": 1355494358,
"owner": {
"user_id": 485,
"user_type": "moderator",
"display_name": "Rory Alsop",
"reputation": 32567,
"email_hash": "af1ed0816ed5a2164a4e343ad09309ad"
},
"post_id": 25431,
"post_type": "question",
"score": 0,
"body": "Hi Salman - this question doesn't really make sense. As per Polynomial's comment, you need to think about what you mean by security."
},
{
"comment_id": 41546,
"creation_date": 1355506665,
"owner": {
"user_id": 836,
"user_type": "moderator",
"display_name": "Jeff Ferland",
"reputation": 21466,
"email_hash": "34e5e0b41202f3c375552750c0d6f309"
},
"post_id": 25431,
"post_type": "question",
"score": 1,
"body": ""What is the highest degree of security?" A secret shared by two people, never written down, and one of them is dead."
}
]
},
{
"tags": [
"encryption",
"cryptography",
"public-key-infrastructure"
],
"answer_count": 2,
"answers": [
{
"answer_id": 26124,
"accepted": false,
"answer_comments_url": "/answers/26124/comments",
"question_id": 25397,
"owner": {
"user_id": 655,
"user_type": "registered",
"display_name": "Thomas Pornin",
"reputation": 82803,
"email_hash": "07ccc97c05f3fb80560ebc618a7de8bc"
},
"creation_date": 1356709745,
"last_activity_date": 1356709745,
"up_vote_count": 2,
"down_vote_count": 0,
"view_count": 278,
"score": 2,
"community_owned": false,
"title": "What hardware technology (GPU, FPGA) is fastest at generating RSA keys?",
"comments": []
},
{
"answer_id": 25398,
"accepted": false,
"answer_comments_url": "/answers/25398/comments",
"question_id": 25397,
"owner": {
"user_id": 12578,
"user_type": "registered",
"display_name": "AJ Henderson",
"reputation": 10952,
"email_hash": "d4983a2cfa45afe8cda060ea4a71b5ca"
},
"creation_date": 1355417211,
"last_activity_date": 1355417211,
"up_vote_count": 1,
"down_vote_count": 0,
"view_count": 278,
"score": 1,
"community_owned": false,
"title": "What hardware technology (GPU, FPGA) is fastest at generating RSA keys?",
"comments": []
}
],
"favorite_count": 0,
"question_timeline_url": "/questions/25397/timeline",
"question_comments_url": "/questions/25397/comments",
"question_answers_url": "/questions/25397/answers",
"question_id": 25397,
"owner": {
"user_id": 587,
"user_type": "registered",
"display_name": "TLDR",
"reputation": 127,
"email_hash": "5245c44a669ced2c623dcc089b9a647f"
},
"creation_date": 1355416713,
"last_edit_date": 1355422059,
"last_activity_date": 1356709745,
"up_vote_count": 4,
"down_vote_count": 2,
"view_count": 278,
"score": 2,
"community_owned": false,
"title": "What hardware technology (GPU, FPGA) is fastest at generating RSA keys?",
"comments": [
{
"comment_id": 41439,
"creation_date": 1355416849,
"owner": {
"user_id": 5400,
"user_type": "registered",
"display_name": "Polynomial",
"reputation": 32757,
"email_hash": "6fc641bdddde78a51c0db6b8527c54f7"
},
"post_id": 25397,
"post_type": "question",
"score": 0,
"body": "Product recommendations are off-topic here."
},
{
"comment_id": 41442,
"creation_date": 1355418187,
"owner": {
"user_id": 587,
"user_type": "registered",
"display_name": "TLDR",
"reputation": 127,
"email_hash": "5245c44a669ced2c623dcc089b9a647f"
},
"reply_to_user": {
"user_id": 5400,
"user_type": "registered",
"display_name": "Polynomial",
"reputation": 32757,
"email_hash": "6fc641bdddde78a51c0db6b8527c54f7"
},
"post_id": 25397,
"post_type": "question",
"score": 0,
"body": "@Polynomial I'm interested in learning what technology is appropriate. e.g. Are stream processors in a GPU more important or is memory (to handle larger numbers), or is GPU speed in MHZ? I'm not looking for a product, just technology name."
},
{
"comment_id": 41462,
"creation_date": 1355422211,
"owner": {
"user_id": 9377,
"user_type": "registered",
"display_name": "lynks",
"reputation": 4352,
"email_hash": "9a21812b9a1037044c110bc3c8948627"
},
"post_id": 25397,
"post_type": "question",
"score": 1,
"body": "An FPGA is always going to be the fastest hardware at performing any task, as it is simply re-mappable silicon dedicated to the task in question."
},
{
"comment_id": 41515,
"creation_date": 1355459722,
"owner": {
"user_id": 17078,
"user_type": "registered",
"display_name": "Alan",
"reputation": 101,
"email_hash": "89ad90c0fa6e2de363ee61d1dc278b80"
},
"reply_to_user": {
"user_id": 9377,
"user_type": "registered",
"display_name": "lynks",
"reputation": 4352,
"email_hash": "9a21812b9a1037044c110bc3c8948627"
},
"post_id": 25397,
"post_type": "question",
"score": 1,
"edit_count": 1,
"body": "@lynks I disagree. An ASIC would be better. FPGAs are used because they are re-mappable and readily available for cheap. I'm not saying FPGA isn't the right answer, but I wouldn't go as far as saying an FPGA is "always going to be the fastest hardware""
}
]
}
]
}