81–90 of 104 posts
Earlier quoted context omitted.
He doesn't know how to write even simple mathematics. Umm...
If you know how to write math, then do so. In particular, define your symbols. Nearly none of your symbols are defined.
There are better ways to ask someone to define their symbols.
Earlier quoted context omitted.
This lets me down a little bit. If two guys that I consider to be very knowledgeable on this topic disagree on some key things, how am I supposed to get most of this right?
I was skipping the details because Thomas and I have had this argument here at least a dozen times, and I figured that people were getting sick of it by now. To summarize the arguments: Both CTR+HMAC and combined AEAD modes, correctly implemented and correctly used, will keep you safe against existing published attacks. Thomas takes the view that "correctly implemented and correctly used" is a problem, and I'll accep…
Also, if you asked me who was more likely to get crypto right, the Django web guy or the C daemon guy, I'd bet on the Django guy every time. Betting against crypto implemented in C is like betting when you've made a full house on the flop: all in.
Earlier quoted context omitted.
Dan Boneh's free "Crypto 1" on coursera. A new session will be starting on the 30th of June. I've taken it myself and this is hands down one of the best MOOCs (and class overall) I've ever taken.
I agree, "Crypto 1" was excellent! On Coursera's website, in the upcoming section, it says that "Crypto 2" starts in 3 months. I hope that's true!
Earlier quoted context omitted.
If you know how to write math, then do so. In particular, define your symbols. Nearly none of your symbols are defined.
You know that this is a presentation, right? And that the symbols will be defined in the talk? There are better ways to ask someone to define their symbols.
It's simple.
Look, guys, 'n' just does not abbreviate 'integer', and 'k' does not abbreviate 'key'. Yes, yes, yes, I know; I know; and we should all know, that while too often people write, say, O(ln(n)) saying nothing about either 'n' or 'O', it's darned bad mathematical writing. If in some context n is a positive integer, then in that context it is just necessary to say so.
Read math from calculus to Halmos, Rudin, Dunford and Schwartz, Spivak, Lang, to Bourbaki, and will find that symbols are always defined; good authors just do not have undefined symbols hanging around. It's just not done.
Now you have learned something important. Sorry some people didn't know.
Use SSL for transport""
Honest question here: suppose I have a webapp with multiple servers, being load-balanced through Amazon's ELB. This sounds about as standard as it can get. Question is: how does one handle client migration between servers, and client authentication, without writing cryptographic code or knowing anything about cryptography?
(apologies if this is trivial)
Actually, this is a bit wrong - it's just that this is not cryptography and security-related and doesn't have anything to do with authentication. It's the same reason why some fansubbers still include CRC32 into filename - basic unauthenticated integrity checking. Totally insecure, but still better than nothing.
I had case where downloaded file was broken - for some weird case either software, storage or a network had failed but TCP/IP checksumming didn't help and the fact was, I had wrong bits on the hard drive. I hadn't broadband connectivity at home and that cryptographically-pointless CHECKSUM.SHA256 (well, actually it was MD5) helped to find that out before I left the library.
And recently, the same concept had helped me to validate files with a faulty cloud storage service that managed to lose some chunks and silently replaced them with zeroes when I tried to download the data back.
Obviously, a signed file stored on another server would always be a better idea.
Just nitpicking.
"""Conventional wisdom: Don't write cryptographic code! Use SSL for transport"" Honest question here: suppose I have a webapp with multiple servers, being load-balanced through Amazon's ELB. This sounds about as standard as it can get. Question is: how does one handle client migration between servers, and client authentication, without writing cryptographic code or knowing anything about cryptography? (apologies if t…
A quick googling found this guide to setting up SSL on ELB: http://docs.aws.amazon.com/ElasticLoadBalancing/latest/Devel...
"""Conventional wisdom: Don't write cryptographic code! Use SSL for transport"" Honest question here: suppose I have a webapp with multiple servers, being load-balanced through Amazon's ELB. This sounds about as standard as it can get. Question is: how does one handle client migration between servers, and client authentication, without writing cryptographic code or knowing anything about cryptography? (apologies if t…
SSL usually terminates at the load balancer. A quick googling found this guide to setting up SSL on ELB: http://docs.aws.amazon.com/ElasticLoadBalancing/latest/Devel...
Disclaimed: I know sweet f-a about cryptography, and was expecting 100% of this pdf to go straight over my head. On the other hand, why is the author using "i++" in a preamble of a for loop?
http://en.wikipedia.org/wiki/For_loop#C.2FC.2B.2B
... also used in Java, Javascript, Perl, Php, Bash (and many more I'm sure).
Earlier quoted context omitted.
As someone who is completely new to cryptography and knows very little, where would you recommend I start? I've recently been reading about bitwise operations to become familiar with how to (somewhat) interpret what a cryptograhic algorithm is doing in a program, since bitwise operations seems to be popular in almost all crypto algorithms.
Dan Boneh's free "Crypto 1" on coursera. A new session will be starting on the 30th of June. I've taken it myself and this is hands down one of the best MOOCs (and class overall) I've ever taken.
I found the course pretty hard as programmer with a strong interest in crypto, but no formal CS/maths background. The coding pieces were fairly straightforward, but the maths hurt.