Dec
22
awarded Yearling
Nov
14
awarded Supporter
Oct
26
comment A fast non-cryptographic hash function that is "strong enough"?
Skein wasn't necessarily the fastest SHA-3 finalist. That depends on what machine you're benchmarking on. Here are a lot of them: bench.cr.yp.to/results-hash.html NIST wrote this into the final SHA-3 report: “Skein and BLAKE have the best overall software performance.” blake2.net/acns/slides.html
Oct
2
awarded Supporter
Jul
21
awarded Nice Answer
Jul
13
awarded Yearling
Jul
13
awarded Yearling
Feb
4
answered Have the same README both in Markdown and reStructuredText
Jan
27
awarded Good Answer
Aug
12
awarded Nice Answer
May
2
awarded Commentator
May
2
comment Can I jettison MAC if I already have SHA1(M)?
However, I should add that the short answer is likely to be right, in that the scheme and its implementation are likely to expose the sort of vulnerability that D.W. described. Likewise, the advice to use authenticated encryption might be perfect, depending on the needs of the user. So these answers are not wrong, but they overstate the case when they say that the proposal is definitely not secure. It might be.
May
2
comment Can I jettison MAC if I already have SHA1(M)?
I disagree with the advice in the summary because the proposed alternative — to use a message authentication code or authenticated encryption — has weaker security properties than the original proposal to use the secure hash of the plaintext has. Whether those reduced security properties would entail actual risk to the users can't be determined without more information about the way this protocol is used.
May
2
comment Can I jettison MAC if I already have SHA1(M)?
I disagree with this short answer and also with the advice in this "Summary". I disagree with the short answer because it assumes that the padding scheme used is amenable to that sort of chosen-plaintext attack. In fact there are padding schemes that, when combined with implementations free of timing and error-handling side channels, prevent all such attacks. (I.e. padding schemes in which there is a bijection from message to padded-message, and therefore there is no ciphertext block other than the original ciphertext block which will result in a plaintext that matches the hash. …
Jan
14
awarded Yearling
Jan
14
awarded Yearling
Sep
27
comment How do I write a setup.py for a twistd/twisted plugin that works with setuptools, distribute, etc?
With the fix to Pip bug #355, Chris Miles's approach seems to work. I used it to package oauth-proxy just now and it appeared to work: github.com/mojodna/oauth-proxy/pull/5
Apr
29
awarded Necromancer
Apr
20
awarded Supporter
Apr
12
awarded Good Answer
1 2 3 4 5