The Side Channel

« first day (2743 days earlier) ← previous day next day → last day (1921 days later) »

2:21 AM

Have I ever joked that the 90's were the dark age of cryptography?

Some of the ideas from the recent past are kind of embarrassing. For example that CBC > CTR. Are we going to look back on the beliefs of the 2010's with embarrassment in the year 2040?

Pathfinder

2:42 AM

Just finished generating a Private SSL cert for my wan dev box server, which I've installed as a trusted root cert on client machines. I don't think it's possible to man in the middle attack this. right?

Since you definitely require the private key for the trusted root cert. XD =P

8 hours later…

kelalaka

11:07 AM

@MaartenBodewes I write a note for the OP.

1 hour later…

Maarten Bodewes

12:15 PM

@kelalaka Great, although I'm not so sure what you mean with that comment. Sometimes you take things a bit too much out of context for me :)

kelalaka

Well, he was satisfied with my comment. High probably he made a mistake. If not I'm waiting for a response.

1 hour later…

Maarten Bodewes

1:46 PM

Sorry, I meant the text above. I mean, I am performing ops on many questions, so I didn't get what question / note you were talking about. If everything is OK, then it's OK :)

kelalaka

Seems fine. No worries. I know how it should be hard for you.

@MaartenBodewes i don't know any such Organization do you?

Q: Which organization is responsible for certifying a TSA?

I see there a number of free TSA services according to this page (not all are still in service). In other sources I see references to the requirement of audits for the TSA to be 'rfc3161 compliant'. Given the number of free services, not to mention the new blockchain services (which are similar ...

1 hour later…

Maarten Bodewes

2:54 PM

TuV IT may be able to do it. Maybe the German BSI has some protection profile for it. But the free ones? I mean, to just have an audit on EAL 2 or higher costs lots of money.

Best chances are probably Latvia, and hope they have some national agency that does this for free. They are pretty forward when it comes to IT infrastructure of their government.

If they don't advertise it, they are not certified. If you go through all that trouble I expect something to say that they are.

1 hour later…