# Tag Info

2

The once part inside of the nonce in CTR mode means effectively "once for this particular key". If you use a fresh key for each message (e.g. by encrypting it using public-key crypto or similar), you can use the same nonce for all the messages (or a size-zero nonce). The important part is that the combination of nonce and ctr-value (i.e. what is input into ...

10

This depends on the public-key system (algorithm). For RSA, technically the private and public key (i.e. the exponents, the keys share the same modulus) are symmetric, you can swap them, and it still works. But you usually don't want to do this: The public exponent is usually a small number (like $3$ or $2^{16} + 1$) in order to speed up ...

1

It seems that you are trying to implement your own KBKDF (Key Based Key Derivation Function) using HMAC. Maybe it is better to use a pre-defined one. It would be more sensible maybe to use an HSM that is FIPS certified for NIST SP 800-108. These use one of the KBKDFs defined in NIST SP 800-108. You can still use the idea of the random by putting it in the ...

8

It looks like, given your adversary model, things should be secure. HMAC as a randomness extractor has been shown to be good, especially when we can assume the hash function is collision resistant. That paper also has some results which tell how you could guard against the collision resistance being broken (basically use a hash function with larger output ...

2

Short answer, before someone marks this as a duplicate or answers it with an essay or something: You're exactly right. This was one of the biggest consequences of the infamous Heartbleed exploit in OpenSSL, which exposed the memory of processes using OpenSSL for TLS to anyone with an Internet connection. It's also significant for cold boot attacks, where ...

1

Related to Curve25519 Curve25519 seems to be secure so far. Yet, you have to remind yourself that Dr. Bernstein specified Curve25519 for key-exchange. Meaning: key-generation, transaction signing, and verification are somewhat different beasts – you might want to cross-check on that before jumping toward Curve25519. Sure, Curve25519-java supports signing… ...

2

I know how Diffie-Hellman Key Exchange works. Is this the main way of encrypting with PGP, ssh, ssl (https), DKIM, ...? As the name says Diffie-Hellman key exchange is a key exchange protocol, i.e., a protocol where two parties agree on a common secret without having exchanged any secret prior to that, in an interactive way, i.e., both parties are ...

3

A key derivation function lets you derive keys from others. In this case I would use HKDF, which means using HMAC in a predefined way. Your key material is the keys $X$ and $Y$, so you can concatenate those to get the PRK for HKDF-Expand. An output key would then be $\operatorname{HMAC}(X||Y, \text{info} || \text{0x01})$, if the size of the HMAC is long ...

1

HMAC is considered the most secure way of combining two keys, as compared to a single round of SHA256. hmac is designed to fold in the key material in 2 hash operations, which helps resist chosen plaintext attacks on sha-256, although SHA256 has no known chosen plaintext attacks at this time. Symmetric ciphers are considered less reliable than hashes for ...

0

HMAC: The hmac version is considered slightly more secure than sha-256, assuming it's also based on SHA-256, because the HMAC formulation folds in the key material with 2 rounds of hashing, making it harder to use a chosen plaintext attack on the digest. SHA-256: SHA-256 should be relatively secure against chosen plaintext attacks, but it's better to be ...

6

While it may be confusing, that Wikipedia article is actually correct! Let me try to explain it a bit better… Definition of key whitening Key whitening is an extremely simple technique to make block ciphers like DES much more resistant against brute-force attacks. Like you’ve already discovered yourself, this is the basic scheme: Or, defining it a bit ...

3

One way key whitening improves security is by increasing resistance to bruteforce attacks (and doing this essentially for free). Consider, for example, DES. Key is 56 bits, so given a single pair $(M, E=DES(K,M))$ attacker will find $K$ in $2^{55}$ operations on average. By employing key whitening it is possible to increase required effort substantially: we ...

2

Trevor Perrin wrote a library doing exactly that. Explanation can be found on in the curves mailing list archives. To convert a Curve25519 public key $x_C$ into an Ed25519 public key $y_E$, with a Ed25519 sign bit of $0$: $$y_E = \frac{x_C - 1}{x_C + 1} \mod 2^{255}-19$$ The Ed25519 private key may need to be adjusted to match the sign bit of $0$: if ...

0

The answer to both questions lies in understanding entropy, and how entropy is gathered to create a key. (And, of course, how well the implementation does so without bugs.) Each operating system creates and maintains a pool of entropy from which the entropy – also known as “randomness” – is tapped in the process of generating the key. Also, to the extent ...

0

if someone generates the same RSA key pair as someone else, then ... someone will have the same RSA key pair as someone else. when someone generates a key pair, how can he/she be sure that nobody has already generated this key pair? The exact same ways he/she can generate any unique value. Proof: Let the unique value be the key pair, or let the ...

Top 50 recent answers are included