7,167 reputation
21041
bio website
location Netherlands
age 41
visits member for 3 years, 4 months
seen 5 hours ago

Security professional with many years of experience with the practical application of cryptographic algorithms and protocols. I'm helping with the design of protocols and API's within international standardization bodies. Lead developer of a common criteria certified product. Over 30 years of general experience with computers.


Feb
11
answered Is the key deducible with AES CTR when we know about the plaintext, IV and the ciphertext?
Feb
11
comment 3DES Modes EED orEDE?
Of course in general we don't try and use DES at all anymore. Although this question is interesting from a theoretical point of few, please use a newer cipher such as AES for practical needs.
Feb
10
comment Self changeable key
That also depends on the algorithm used. A better answer than mine would explicitly mention what cryptographic properties the primitives should have. This is tricky though because the security requirements depend on the other function.
Feb
10
comment Why does NaCL have different keys for signing and encryption?
This is Bernstein's library. You can rest assured that he'll always go for safety/security first.
Feb
9
answered Self changeable key
Feb
9
comment CBC-MAC: is it secure to authenticate a fixed length ciphertext?
See for instance chapter 5: Truncated output in RFC 2104. Note that for SHA-512 everybody probably agrees that using 128 bits instead of 256 is OK; this RFC was written before SHA-512 became available and most hash algorithms had 128 to 160 bits of output.
Feb
9
revised CBC-MAC: is it secure to authenticate a fixed length ciphertext?
deleted 4 characters in body
Feb
9
comment Storing AES encrypted RSA private keys on a server
I think most of the time the keys are stored locally because the apps don't use a separate password for their application. Besides the fact that most of the security is bunk anyway.
Feb
9
comment CBC-MAC: is it secure to authenticate a fixed length ciphertext?
As far as I can judge the amount of any well known MAC can be reduced to a certain number of bits. I don't think SHA-256, let alone SHA-512, has less security than AES-MAC or AES-CMAC for the same amount of bits. AES-CBC is known to be insecure. It can be secure in particular situations - fixed message length being one - but you should be very wary of using it because there are more secure alternatives. Besides the security aspect, you should be wary about locking yourself to messages of a particular size.
Feb
9
comment CBC-MAC: is it secure to authenticate a fixed length ciphertext?
Not an answer, but why would you ever use CBC-MAC if CMAC and HMAC would leave you more secure? Even if CBC-MAC is only available it would be relatively easy to convert it to CMAC...
Feb
8
comment OpenSSL encrypted text length
Let us continue this discussion in chat.
Feb
8
comment OpenSSL encrypted text length
I don't see any mention of base 64 encoding while skimming those pages.
Feb
8
revised OpenSSL encrypted text length
base64 length calculation, some formatting
Feb
8
comment OpenSSL encrypted text length
I don't know what kind of function you are currently using to decode. What about the len in len = BIO_read(bio, *buffer, strlen(b64message)); ?
Feb
8
comment Additional Data in AEAD (Chacha20-poly1305 libsodium)
Note that Additional Data is also known as Additional Authenticated Data (AAD) in other schemes, I think AAD is more common.
Feb
8
answered Additional Data in AEAD (Chacha20-poly1305 libsodium)
Feb
8
comment OpenSSL encrypted text length
It's not a (textual) string, so don't treat it like one. You need either to have the length in advance (e.g. given to you during base 64 decode) or you need to encode the length yourself. As the octet string (also known as byte array) can have any value anywhere, you cannot determine the length from the content.
Feb
8
comment Hash function as secure as one-time pad?
As a hash smaller than the message space will always have collisions and since provable security would allow for brute force search of all messages, the hash function would have to redefine the meaning of "compression" to be secure. I.e. the hash should be larger than the message itself - that kind of ridiculous property?
Feb
8
answered OpenSSL encrypted text length
Feb
7
comment Trivium example
The test vectors are in the test framework, you can download an entire CD image, but the code that I linked to also contains the test vectors, to compile on my Linux system I just needed to type make in the folder containing the extracted files, and then run the resulting exe.