Reputation
9,539
Next tag badge:
77/100 score
31/20 answers
Badges
3 13 45
Impact
~148k people reached

1h
revised Signature Verification: High level
added that ECDSA doesn't have the same symmetry between signature generation & encryption + non-reputability
12h
answered Signature Verification: High level
12h
comment Implementing CBC Encryption Using Decryption
If the IV is reused then you can XOR the middle ciphertext block with another one to retrieve the last plaintext XOR'ed with the other plaintext.
19h
revised What is the difference between PKCS#5 padding and PKCS#7 padding
added 116 characters in body
1d
revised What is the advantage of AEAD ciphers?
edited body
1d
comment What is the advantage of AEAD ciphers?
During encryption you can directly feed the plaintext to the internal encryption function (e.g. to perform CTR mode encryption in GCM, EAX or CCM). You can directly store the ciphertext, possibly in place. You cannot do this during decryption because you may be either dealing with the ciphertext or the tag. So you get update functions that return more or less plaintext compared to the ciphertext. If you have a doFinal method it may still need to return plaintext as well. So you need special buffer handling for decryption, not encryption. In implementations (Bouncy) it takes 33% more room.
1d
comment What is the advantage of AEAD ciphers?
Note that I think it is extremely stupid to include the authentication tag directly in the ciphertext as RFC 5116 does. It requires the decryption side to buffer the ciphertext until the location of the authentication tag is found. This makes for a horrible implementation that is not online nor symmetric for encryption/decryption. API developers certainly should not follow this example. I really should make this a blog post soon.
1d
revised What is the advantage of AEAD ciphers?
added 269 characters in body
1d
answered What is the advantage of AEAD ciphers?
1d
comment Understanding elliptic curve encryption
I'm voting to close this question as off-topic because this was about a simple misunderstanding about modular arithmetic.
Jul
29
comment Why calculate pi to estimate randomness?
@tylo fgrieu's answer seems new as well. I'm not sure which one came first, but this information certainly seems to be in the second paragraph of the answer of fgrieu, which would make this answer redundant.
Jul
26
comment Is there a signature scheme for the Cramer-Shoup cryptosystem?
@Sebi Trust me if I say that it is the same on SO. Not so much here. But you do have to give people some time. Last time I asked a question - not something that occurs often - I was asked out to dinner right after... Anyway, welcome to crypto :)
Jul
26
revised Is there a signature scheme for the Cramer-Shoup cryptosystem?
mainly formatting, clarifying question
Jul
26
comment Is there a signature scheme for the Cramer-Shoup cryptosystem?
@Sebi Easy there, cowboy. It's OK to ask for accepting an answer after a day or so, if there is no peep from the poster in the mean time.
Jul
23
comment What are the implications of a birthday attack on a HMAC?
@otus Changed my mind on it. Would you agree with the current definition?
Jul
23
revised What are the implications of a birthday attack on a HMAC?
added 66 characters in body
Jul
23
comment What are the implications of a birthday attack on a HMAC?
@mikeazo I'm not sure if it is only true for Merkle-Damgård hash functions, but some kind of linearity in the way the input is treated seems required.
Jul
23
revised What are the implications of a birthday attack on a HMAC?
added 66 characters in body
Jul
23
revised Why should $a,b < N$ for Montgomery Reduction?
added 1 character in body; edited title
Jul
23
revised Execution speed of AES_128 GMAC operation
added 30 characters in body