Reputation
7,502
Next tag badge:
61/100 score
23/20 answers
Badges
2 11 42
Newest
 Enlightened
Impact
~112k people reached

1d
comment How are onetimepads distributed?
Yes. As explained you need as many bits from pad 1 to distribute pad 2. The net effect is that you have exactly as many bits left, minus the ones you used for the (encoded ) message of course. And the bits may be changed by an active attack on top of that.
1d
answered How are onetimepads distributed?
1d
revised Why use randomness in digital signature algorithms?
just rephrazing a sentence a bit so it reads more smoothly
1d
comment Why rogued certificate from hash collision is harmful
Side node: it may be that the maximum path length is controlled by the CA certificates. In that case a well implemented client should not accept a leaf certificate for which the path length is out of range.
1d
comment Generating interactive, secure multiple ECC key pairs deterministically
With point 2 you say that "User A and B can generate future public keys". I understand from your explanation below that that they may cooperate to do this? Because I don't understand how A and B can create public keys without exchanging X...
1d
comment Why use randomness in digital signature algorithms?
"I don't understand why digital signature schemes that employ randomness, like RSA-PSS, are any better than purely deterministic ones like RSA-FDH." - could you point out where this claim is made?
1d
comment Why use randomness in digital signature algorithms?
Maybe not a problem for EUF-CMA, but leaking information about the plaintext may be an issue in other situations. I'm not sure that the message and signature are always available to an attacker at the same time. In that case a deterministic signature will (at least) indicate to an attacker if a message is identical to one that was send before.
Apr
21
comment The difference between MAC algorithms and what to use
@ThomasM.DuBuisson I'll write it as part of Bouncy and send it to David. I should still upgrade the AEAD interface as well, but I cannot do this at work time, so it's hard to find time that I can focus (and tomorrow I have to go kayaking again :) ). I'll send it to you as well. But lets not monopolize this Q/A...
Apr
21
comment The difference between MAC algorithms and what to use
@ThomasM.DuBuisson Trying to fix this and my knowledge about SIV by making an implementation of SIV in Java - found a small bug in the RFC, I'll let you know after I've verified it (that's the second ERRATA in so many days if it's true)
Apr
21
answered Why rogued certificate from hash collision is harmful
Apr
21
comment Using HMAC SHA256 to protect payment files in local trusted network
The timing attacks are on the HMAC value itself, not on the key. The key can only be found by reversing the hash, which should be impossible. It could be that some side channel attacks are able to find the key value by studying the initial rounds of the hash, but as the running doesn't depend on the values of the bits much, that would be a pretty good trick to pull off.
Apr
20
comment Using HMAC SHA256 to protect payment files in local trusted network
No, although you normally talk about secret keys instead of private keys for symmetric algorithms. That last compare should be consistent in time, i.e. the compare should not stop at the first bit/byte that is different. Usually that should be taken care of by a verify function in the API, but please check.
Apr
20
comment Is it possible to break enigma code with a todays laptop
@schroeder The decoding of a block of ciphertext would be considered off topic, but question on how to decrypt and if it is feasible at all are indeed 100% on topic & welcome there.
Apr
20
comment The difference between MAC algorithms and what to use
@ThomasM.DuBuisson More the lack of implementations in the case of SIV. But feel free to edit it in - there's at least a RFC for it. The lists are not complete in any way (you'd run out of space on the page :) )
Apr
20
comment correct usage of keys and nonce
Well, usually you indicate failure to the user (and nothing else) and write the failure to a log (excluding the secrets of course), while keeping DOS attacks in mind.
Apr
20
comment correct usage of keys and nonce
Yep, the OtherInfo part of the KDF doesn't have to be protected.
Apr
20
revised correct usage of keys and nonce
added 174 characters in body
Apr
20
comment correct usage of keys and nonce
Ouch forgot about the separate session keys for client and server, just to indicate the many pitfalls. Best to study existing protocols including e.g. PACE for smart cards and TLS.
Apr
20
revised correct usage of keys and nonce
added 174 characters in body
Apr
20
comment correct usage of keys and nonce
AEAD ciphers such as GCM play nice and already include the nonce into the calculation of the authentication tag .