Re: [cryptography] Questions about crypto in Oracle TDE

2012-11-09 Thread Morlock Elloi
There is some space. But this is not the usual PK situation where 256-bit secret key is stuffed in 2000+ bit space. Few notes: - Data integrity/authenticity was not the objective. Only secrecy. - Obtaining 'public' key means subverting and reverse engineering the application input modules,

Re: [cryptography] Questions about crypto in Oracle TDE

2012-11-08 Thread Morlock Elloi
We have been using a different approach for securing particular fields in the database. The main issue with symmetric ciphers inside (distributed) systems is that the encrypting entity is always the most numerous weak point. Whoever subverts your input flow - and there are lots of

Re: [cryptography] -currently available- crypto cards with onboard key storage

2011-10-28 Thread Morlock Elloi
Take a cheap Android, write the code you need for it, make it talk via USB, rip out all antennas, put it in your box (wrap in a paper bag first), and connect with USB cable to the internal USB port. HW cost: $80 a Trojan. Security certification concerns put aside, the architectural demands

Re: [cryptography] Digital cash in the news...

2011-06-11 Thread Morlock Elloi
BitCoin has only one problem: maintenance of the relationship between unit BitCoin value and the material world (energy, as in KWh) is 'soft', it requires some sort of a volatile communal effort, which sets it for failure (as a counter example, the amount of Au atoms on this planet is rather

Re: [cryptography] key management guidelines

2010-09-04 Thread Morlock Elloi
The basic fallacy here is the assumption that some magical 'identity' exists and all we have to do is be brilliant enough to figure it out. It doesn't. It's just a collection of beneficial behaviors, a Nash equilibrium that changes as the rules of the Game change (which, by definition, exists