Dec
9
awarded Yearling
Aug
12
awarded Nice Answer
Jul
13
awarded Yearling
Jul
13
awarded Yearling
May
2
awarded Commentator
May
2
comment Can I jettison MAC if I already have SHA1(M)?
However, I should add that the short answer is likely to be right, in that the scheme and its implementation are likely to expose the sort of vulnerability that D.W. described. Likewise, the advice to use authenticated encryption might be perfect, depending on the needs of the user. So these answers are not wrong, but they overstate the case when they say that the proposal is definitely not secure. It might be.
May
2
comment Can I jettison MAC if I already have SHA1(M)?
I disagree with the advice in the summary because the proposed alternative — to use a message authentication code or authenticated encryption — has weaker security properties than the original proposal to use the secure hash of the plaintext has. Whether those reduced security properties would entail actual risk to the users can't be determined without more information about the way this protocol is used.
May
2
comment Can I jettison MAC if I already have SHA1(M)?
I disagree with this short answer and also with the advice in this "Summary". I disagree with the short answer because it assumes that the padding scheme used is amenable to that sort of chosen-plaintext attack. In fact there are padding schemes that, when combined with implementations free of timing and error-handling side channels, prevent all such attacks. (I.e. padding schemes in which there is a bijection from message to padded-message, and therefore there is no ciphertext block other than the original ciphertext block which will result in a plaintext that matches the hash. …
Jan
14
awarded Yearling
Jan
14
awarded Yearling
Sep
27
comment How do I write a setup.py for a twistd/twisted plugin that works with setuptools, distribute, etc?
With the fix to Pip bug #355, Chris Miles's approach seems to work. I used it to package oauth-proxy just now and it appeared to work: github.com/mojodna/oauth-proxy/pull/5
Apr
29
awarded Necromancer
Apr
20
awarded Supporter
Apr
12
awarded Good Answer
Mar
14
comment Standard way to embed version into python package?
Here's a mostly-complementary tool by my long-time programming partner Brian Warner: blog.mozilla.org/warner/2012/01/31/… Versioneer is a tool to generate the version number from git history. Ideally I would like to use Versioneer to generate the version number, and then use the technique described in my answer here to make that version number available to all the places where it is needed. I'm doing something like that in this project: github.com/zooko/pycryptopp
Mar
14
revised Standard way to embed version into python package?
deleted 24 characters in body
Oct
23
awarded Supporter
Mar
7
awarded Announcer
Mar
1
awarded Scholar
Mar
1
accepted How can I change the background colors of a table cell in reStructuredText?
1 2 3 4 5