Re: [Cryptography] Opening Discussion: Speculation on "BULLRUN"

On 9/6/2013 1:05 PM, Perry E. Metzger wrote: I have re-read the NY Times article. It appears to only indicate that this was *a* standard that was sabotaged, not that it was the only one. In particular, the Times merely indicates that they can now confirm that this particular standard was sabota

Re: 'Padding Oracle' Crypto Attack Affects Millions of ASP.NET Apps

elopers are forced to adhere to. I'm sure that you all know well that those who understand the risks best are not always those setting policy. -kevin -- Kevin W. Wall "The most likely way for the world to be destroyed, most experts agree, is by

Re: 2048 bits, damn the electrons! [...@openssl.org: [openssl.org #2354] [PATCH] Increase Default RSA Key Size to 2048-bits]

is one of the important cutoff dates, such as the date that the CAs have to stop issuing certs with 1024-bit keys. I can dig up the NIST URL once I get back to work, assuming anyone actually cares. -kevin -- Kevin W. Wall "The most likely way for the world to be destroyed, most experts ag

Re: 'Padding Oracle' Crypto Attack Affects Millions of ASP.NET Apps

spec for using with PSK was adopted tomorrow, the adoption would take quite a long time. Sure hope I'm wrong about that. Maybe one of you real cryptographers can set me straight on this. -kevin -- Kevin W. Wall "The most likely way for the world to be destroyed, most experts

Re: 'Padding Oracle' Crypto Attack Affects Millions of ASP.NET Apps

his padding oracle attack. So apparently Microsoft didn't apply the MAC protection quite right in their implementation. -kevin -- Kevin W. Wall "The most likely way for the world to be destroyed, most experts agree, is by accident. That's where we come in; we&#

Call to review OWASP ESAPI crypto code

an help. -kevin -- Kevin W. Wall "The most likely way for the world to be destroyed, most experts agree, is by accident. That's where we come in; we're computer professionals. We cause accidents."-- Natha

Re: Proper way to check for JCE Unlimited Strength Jurisdiction Policy files

I am understanding it correctly. Thanks, -kevin -Original Message- Kevin W. Wall wrote: > Hi list...hope there are some Java developers out there and that this is not > too off topic for this list's charter. > > Does anyone know the *proper* (and portable) way to check if a

Proper way to check for JCE Unlimited Strength Jurisdiction Policy files

d, the max allowed AES key size is 128-bits.) Does that seem like a sound plan or is there more that I need to check? If not, please explain what else I will need to do. Thanks in advance, -kevin wall -- Kevin W. Wall "The most likely way for the world to be destroyed, most experts agree, is by

Question about Shamir secret sharing scheme

igInteger or BigDecimal weren't widely available when came up with this scheme back in 1979. So other than perhaps compatibility with other implementations (which we are not really too concerned about) is there any reason to continue to do the calculations over Zp ??? Thanks, -kevin -- Kevin W. W

Re: Detecting attempts to decrypt with incorrect secret key in OWASP ESAPI

your responses, but it looks like I have a lot of research to do before I understand everything that all of you said. Regards, -kevin -- Kevin W. Wall "The most likely way for the world to be destroyed, most experts agree, is by accident. That'

Detecting attempts to decrypt with incorrect secret key in OWASP ESAPI

nswer to #1, is 'yes', which one is "safer" / more secure? 3) If answer to #1 is 'no', do you have any suggestions less computationally expensive then digital signatures that would allow us to detect attempts to decrypt with the incorrect secret k