The DMZ

8:14 AM

@forest Re:only a full HMAC can do that - so if I concatenate an hmac-sha512 to 256 bits, is that also insecure?

Hey why isn't markdown for italics working in chat?

Yes it is

hmmm

wow it works now

it didn't before it just showed me the *s

That's odd

I don't think they preview though

So you need to hit enter to see it

8:29 AM

yes I did

@forest I mean truncate, not concatenate :)

A. Hersean

@nobody A MAC must be at least 256 bits long to get 128 bits of security. Also, by truncating an HMAC you might break its resistance against length-extension attacks (i'm not sure). Truncating an authenticated SHA3 would be better.

@A.Hersean That's why I was asking about truncating a 512 bit mac to 256 bits

A. Hersean

8:46 AM

But why would someone truncate a HMAC-512 instead of using a HMAC-256? If I encountered it in an audit, I would flag it as insecure because it's not proven secure.

Yeah I'm just asking theoretically

A. Hersean

9:04 AM

After reviewing the HMAC construction, you should be fine by truncating it to 256 bits. That complies with its design principle. However, I did not prove it mathematically.

2 hours later…

10:36 AM

Is it bad form to ask a question only to answer it myself?

Or, let me rephrase that: Anyone want some free rep?

10:58 AM

@MechMK1 no

Alright, will do so in a bit then

It’s OK to Ask and Answer Your Own Questions

Jeff Atwood on July 01, 2011

The FAQ has contained one key bit of advice from the very beginning: It’s also perfectly fine to ask and answer your own question, as long as you pretend you’re on Jeopardy! — phrase it in the form of a question. So … if you have a question that you already know the answer to…

Rory Alsop

@MechMK1 there has been discussion on various sites as to whether or not it is polite to wait a wee bit to give someone else a chance to post a good answer, but there is no definite guidance on this. If you have a great answer, just go for it :-)

Q: Should a server set a cipher order?

I'll ask the question and see if someone has a good answer

I've seen conflicting opinions on whether or not setting a cipher order is recommended. testssl.sh prints a red warning when no cipher order is encountered, implying that a lack of cipher order is considered a deficit. It also makes intuitive sense that a server should begin by offering the stron...

tls

Enjoy your free rep :D

admittedly I also use SE as a documentation tool :D

for example superuser.com/questions/1164376/…

11:08 AM

Nice!

I should start doing that as well

superuser.com/questions/1409745/… was an excuse to document packet capture with my DIY router :D

Also that's a pretty cool question

its not 'efficient' but DIY routers are fun :D

10 hours later…

9:17 PM

How the fuck did my question become a HNQ again?

9:28 PM

Can anyone recommend a "Security for Beginners" style of book?

Like something you can give to a web developer so they can learn security concepts

I believe OWASP made such a thing but I can't find it

Anonymous

10:05 PM

I wish I had a good suggestion for a book like that... Unfortunately, I don't. Web App Hackers Handbook is likely too unnecessary for a dev.

I wish I had some good book to point to like "You're interested in InfoSec? Start here!"

Anonymous

@forest Can you confirm if this is a printing issue for me...? (two secs)

Anonymous

Anonymous

why is P_1 at the far right.

Anonymous

and P_0 in the middle

Anonymous

10:08 PM

And same for why is FF_1 at the far right.

Anonymous

And same for S_1 actually

Anonymous

I feel like im asking a very stupid question.

Anonymous

WHich I likely am.

Anonymous

(LFSRs in case it wasn't clear)

Anonymous

For reference why I am confused... In ANOTHER diagram of the same thing. It is ordered with P_0 at the far right side. And likewise FF_0 and S_0 at the far right side.

Anonymous

10:11 PM

@MechMK1 Yeah, I wish I had more of those too... Unfortunately, all of the books I recommend are often more technical than you'd like for a beginner.

Anonymous

I generally don't have many good texts for someone REALLY new.

@J-- True

Anonymous

Yeah.. I think it is because when I started I generally didn't read many books.

Anonymous

I just started hacking shit.