Reputation
7,969
Next tag badge:
63/100 score
25/20 answers
Badges
2 12 42
Impact
~121k people reached

1h
comment Would this method allow fast authenticated encryption using only a single encryption operation per block?
One scheme per question please Anon2000... And that's one to many if you haven't tried to prove it secure yourself.
1h
revised Would this method allow fast authenticated encryption using only a single encryption operation per block?
rolled back to a previous revision
4h
revised Why is Bcrypt called a Key Derivation Function?
added 8 characters in body
5h
revised Why is Bcrypt called a Key Derivation Function?
added 318 characters in body
5h
answered Why is Bcrypt called a Key Derivation Function?
6h
comment Authenticated EC key exchange without a signing/signature scheme?
If you change PAKE to read PACE then you've got another one - though I haven't compared them yet :)
6h
revised Why does TLS do Authenticate-then-Encrypt instead of Encrypt-then-Authenticate?
added 58 characters in body
6h
revised Why do we truncate the hash when using DSA?
added 191 characters in body
7h
answered Why do we truncate the hash when using DSA?
17h
comment Hardening of random number generators
That's true, but usually the internal state is pretty large. I'm not sure about the precise implementation though. Never hurts to reseed it a bit of course, maybe between calls.
19h
comment Hardening of random number generators
If the RNG does provide entropy then it may be more sensible generate a lot of data and to use a KBKDF such as HKDF or to feed the entropy in into a random number generator (just to bring it back to a previous problem, maybe I'm a mathematician after all :) )
19h
comment Hardening of random number generators
Seems to me that if the RNG is broken in the sense that it is predictable (by someone) that performing PBKDF2 won't do much good. The salt will be predictable as well. If the RNG doesn't generate enough entropy then this technique seems to add a bit of security. Basically, if the attacker has to guess than it may add a layer of security. How much depends on how much the attacker has to guess (if only 2 random values are possible then having the attacker do 2 PBKDF2 calculations won't do much).
23h
comment HKDF entropy extraction
In your solution you are using a key derivation method as key generator. DRBG's, KDF's and key generators are closely related, but they differ on the details. As it seems that your issue is with the random generator, it seems more logical to replace that. Changed the answer a bit to reflect this.
23h
revised HKDF entropy extraction
added 182 characters in body
1d
comment HKDF entropy extraction
@Paya I didn't know that that answer existed, but it is nice to know that I'm being backed up by Thomas :) Your idea isn't bad or anything, but if you want to have more random numbers than just for the key (and you usually do) then a PRNG makes a bit more sense.
1d
answered HKDF entropy extraction
1d
comment Hash length extension attack - SHA256 to 512 - impossible, correct?
Just out of curiosity, would the different initial values be enough to thwart a length extension attack?
2d
comment Hash length extension attack - SHA256 to 512 - impossible, correct?
Even if there's no known way I would recommend creating a canonical representation of messages, e.g. by prefixing the length for the user-key. Somebody may look at your code and decide that using a single hash function would be more efficient. At the very minimum create a design document and comment your code.
2d
comment Hash length extension attack - SHA256 to 512 - impossible, correct?
Guys, maybe something for meta, but I see very few people upvoting questions. Now I can understand not upvoting questions if they are too specific but there seems to be a growing gap between the amount of upvotes for answers and questions.
2d
comment The difference in size between ECDSA output and hash size
Well, with modular arithmetic that should be almost nothing, even with 256 bits. Note that there is also the less known SHA-512/256 which is somewhat more secure and actually faster on 64 bit machines (but support, alas, is generally lacking from crypto-API's.