[cryptography] Timeline graphic of hacking attacks

2015-05-26 Thread Michael Nelson
http://RecentHacks.com This new site has a timeline of hacking attacks (Target, Sony, Tesla, etc.).   You can click on an attack and see a summary.  It starts early 2013.  Though it's a new site, I find it surprisingly useful -- both to recall what an attack was, and to get a feel for the range

Re: [cryptography] Privacy-Preserving Photo Sharing via crypto

2013-04-12 Thread Michael Nelson
http://www.usc.edu/uscnews/newsroom/news_release.php?id=3017   I didn't read more than the above, but one imagines that the trick is in handling compression.  With bmp, the following immediately comes to mind: Take a seed, generate a mask and xor it with the bmp pixels.  Now the pic is white

Re: [cryptography] Key extraction from tokens (RSA SecurID, etc) via padding attacks on PKCS#1v1.5

2012-07-02 Thread Michael Nelson
There seems to be a bit of uncertainty about this attack.  I'm hearing a lot of misunderstanding from customers. Here is my summary.  I'll first give a concrete example explaining key wrap and unwrap.  Skip this post if you know all this stuff.  Then I'll generalize a bit, and finally comment

Re: [cryptography] Intel RNG

2012-06-21 Thread Michael Nelson
James A. Donald wrote: I see no valid case for on chip whitening.  Whitening looks like a classic job for software.  Why waste chip real estate on something that will only be used On that Intel forum site someone pointed to, one of the Intel guys said with respect to the whitening and

[cryptography] Duplicate primes in lots of RSA moduli

2012-02-14 Thread Michael Nelson
Paper by Lenstra, Hughes, Augier, Bos, Kleinjung, and Wachter finds that two out of every one thousand RSA moduli that they collected from the web offer no security.  An astonishing number of generated pairs of primes have a prime in common.  Once again, it shows the importance of proper

Re: [cryptography] How are expired code-signing certs revoked?

2011-12-21 Thread Michael Nelson
where well-intentioned systems are can be too rigid and get ignored.  What am I missing? Mike N - Original Message - From: Marsh Ray ma...@extendedsubset.com To: Michael Nelson nelson_mi...@yahoo.com Cc: cryptography@randombit.net cryptography@randombit.net Sent: Wednesday, December 21