The DMZ

« first day (330 days earlier) ← previous day next day → last day (4848 days later) »

Ninefingers

00:34

@thisjosh migration. I'm pretty certain we have something similar here already though, on second thoughts.

6 hours later…

Stack Exchange

06:38

9 hours later…

Rory Alsop

15:19

afternoon all - anyone fancy reviewing this wee QOTW post I rattled off during a conference call?

security.blogoverflow.com/wp-admin/…

Stefano Palazzo

15:45

somone here told me to publish my lab notes.

was it you, @thisjosh?

Stack Exchange

16:14

Stack Overflow Blog: Elder Scrolls vs. Call of Duty – Livestream @ 4 EST

Posted by David Fullerton on November 11th, 2011

As you may have noticed, we’re throwing a party over on the Gaming site.

If you’re not a gamer, you may not know that two huge games came out this week: The Elder Scrolls V: Skyrim and Call of Duty: Modern Warfare 3. Game launches are always big for gaming.stackexchange.com because they’re a unique opportunity to get Google search result share before it vanishes into the void of vBulletin and phpBB. We wanted to throw a big launch party for this year’s game release season, but we couldn’t agree on which game to pick. …

Rory Alsop

@StefanoPalazzo Hi Stefano - your new avatar threw me.

Stefano Palazzo

:-) It's one day only

Rory Alsop

@StefanoPalazzo for a special reason?

Stefano Palazzo

today is Oli appreciation day

Oli ♦, England, United Kingdom

34.2k 1 44 116

Rory Alsop

LOL

Stefano Palazzo

16:21

Rory Alsop

Checking our blog stats for today - top referrer: Bruce Schneier's blog. Amazing what a little comment over there can do :-)

Stefano Palazzo

:-)

Rory Alsop

@StefanoPalazzo oh - that is brilliant

Thomas Pornin

@RoryAlsop Looks good to me.

Rory Alsop

@ThomasPornin Cheers - just thought I'd write up a quickie as there has been a bit of a gap

hmm - decision time - post it now, or wait until Monday....

ahh - now will do just fine :-)

Scott Pack

16:50

@StefanoPalazzo It's a bit fun doing stuff like that. See the fervor around our August event.

Q: Paddington Bear Choppertar

Many of our top users seem to have avatars with a picture of themselves in a car with what appears to me to be Paddington Bear: So what is the story behind this?

discussion fun bears many-bears

Stefano Palazzo

Yeah I remember being confused by that :)

Scott Pack

Looks like nobody got a picture of the chatroom side bar. Too bad.

Stack Exchange

Stack Exchange Security Blog: QOTW 13 – Standards for server security, besides PCI-DSS?

posted on November 11, 2011 by roryalsop

The Question of the week this week was asked by nealmcb in response to the ever wider list of standards which apply in different industries. The Financial Services industry has a well defined set of standards including the Payment Card Industry Data Security Standard (PCI-DSS) which focuses specifically on credit card data and primary account numbers, but [...]

Stefano Palazzo

so, we've written down all the things we learned when implementing RSA. It'd be fantastic if you guys could take a quick look at it, and maybe give me some notes. There must be a few mistakes

mh, the formatting is slightly messed up there.

Ninefingers

@StefanoPalazzo One note for you... φ(pq) = φ(p)φ(q) = (p−1)(q−1) is only true when p,q are prime. That is, φ(p) = p-1 for p prime, but not for say 10, where it is in fact equal to 4 (co-prime numbers being 1, 3, 7, 9 < 10)

It doesn't really cause any problems not having that in though, since p,q must be prime.

Stefano Palazzo

17:08

still, that wasn't obvious. I'll put it in, thanks :)

Ninefingers

I basically skipped over that bit in my post on crypto linking RSA to fermat's last theorem - crypto.stackexchange.com/questions/388/…

(blatant self promotion... no wait, it's site promotion!)

Stefano Palazzo

oh, I should really put this answer into the references section.

Thomas Pornin

17:24

@StefanoPalazzo You might want to add a note somewhere stating that even though the exponentiation is at the core of RSA, you also need an appropriate padding scheme if you want to achieve decent security (and the padding will be distinct, depending on whether you want signatures or asymmetric encryption)

Stefano Palazzo

that's a good idea, I'll add it as a footnote to "we can only encrypt numbers"

and mention that the recommended padding scheme is / has to be really complicated

Thomas Pornin

@StefanoPalazzo what it has to be... well, that's complex to define. The recommended padding schemes (OAEP and PSS) are complicated, but they can be "proven" (in the random oracle model, which is not the best, but better than nothing).

Stefano Palazzo

just to make sure. When I started this project, I thought you could just treat your bytes as a base256 number. Took me a while to figure out that that's a bad idea :)

I can't really explain semantic security and chosen-plaintext attacks in the margin, but that'll do.

1 hour later…

Ninefingers

18:35

@ThomasPornin Out of interest is there a paper I can read on that?

Or explanation somewhere on the internet?

Thomas Pornin

@Ninefingers cryptography.com/public/pdf/TimingAttacks.pdf

Ninefingers

Perfect!

Thomas Pornin

Rumour has it that Paul Kocher did not actually invent it; he received a tip from the NSA