diagprov

What about GIAC certs @RoryAlsop? They're pretty expensive but there seems to be a huge range. I think one of our members did the certified incident handler one before OSCP.

I think it is... but @RoryAlsop care to comment?

He really works in HR. Security is just a front ;)

it's also quite expensive

apparently troopers in germany is like the defcon of europe. Never been to that either

CCC is quite a large famous one in Germany, usually in December every year. I've never been, but it's supposed to be good

I'm no help there, my career is... unconventional.

and talking to people like @RoryAlsop for careers advice :D

ah ok. well, there's plenty of conferences. There's also some good ones in Europe if you don't mind travelling a bit. Just as good is learning as much as you can about what you're interested in :)

ahhhh, sorry I haven't logged into sec.se in absolutely ages

@JoshJones you're doing A-levels atm?

I'll ask them if there's any meetups

I'm not sure about the south west but I know a couple of people who work for secret squirrel types in the area

I'm not regularly in the UK any more unfortunately. But there's also B-Sides Manchester, Steelcon in Sheffield and apparently leeds has a b-sides

;)

some of the adults need to attend with an adult

HI

Note that my description above is a simplified explanation of merkle-damgard. If you look into say SHA3, or @CodesInChaos work, you'll find those hashes work in a different way.

but @Codes is right, we can't even compute them by hand ourselves efficiently. We'd be there forever.

in a more basic sense than that

I think he means if we created it, why can't we undo it

to trace your way back through all the intermediate states is incredibly complex

what they don't know is all the data that went in

and the knowledge of the algorithm and the initial state

All the attacker gets is the wheels in their final position

Start at a set combination and twiddle each wheel according to a specified algorithm

If you like it is like a very large lock with those digit wheel things you can set to a combination to unlock

They follow what is called a merkle-damgard construction, a form of one way compression. So they start with an initial state and as you feed data to them they alter that state

Then I'd have a look into how SHA hashes work, e.g. SHA1 and SHA2, for example.

This is assuming that hash functions are one-to-one, which they cannot be.

The answer is simple. You can guess. Of course you can. However, the probability you will be right is extremely low, as in you are more likely to be struck by lightning twice and win the lottery three times than make a successful guess assuming a single guess.

@Developer I am assuming you are looking for a preimage of a hash. To put it another way if you have the hash 3fb7b39416f1d067268747fc214494d759d2609f863ace1a8a76705618d5c80b you want to know what was hashed to get this value.

@Avio they're the cipher suites in use. CCMP is AES-CCM, whereas GCMP is AES-GCM. They're basically two ways of doing AES with authenticated encryption (you want this) so you can't submit modified ciphertext for decryption (called malleability).

@DavidRicherby no, it decreases the maximum possible entropy. Actual entropy depends on what the probability P(pin=1111) is and whether this is equal to every other choice. If it is, they're uniformly distributed and you have the maximum possible entropy. However, if you allow a human to choose the PIN, entropy will be lower. By ruling out those choices that skew the entropy figure (mean self-information) towards low values you (counter-intuitively) increase entropy, at the cost of decreasing maximum possible entropy.

I'll let you know if I get anything to work

@SEJPM I'm gonna have a fiddle around with some more ideas I have

OK I'll give it a try

;)

that's nice and clear

ho hum

but it's still not what I hoped for

I figured this would be the case

It's not the end of the world

I think basically any choice here is going to suck

yeah it looks like the ASE versions work with opensc too, apparently

As I would much rather spend money buying a couple of cards than time trying to work out how to get these cards working

and if they work with Linux/opensc please shout

their stuff objectively does not work on any hardware I have

Actually I am. Reverse engineering law in switzerland says you may reverse engineer stuff for compatibility reasons with your own kit

I hear rumours their on card filesystem matches the minidriver spec exactly, so...