Reputation
7,677
Next tag badge:
61/100 score
23/20 answers
Badges
2 11 42
Newest
 Enlightened
Impact
~115k people reached

Apr
26
revised Where is the authentication tag stored in file encrypted using AES-GCM?
added 25 characters in body
Apr
26
revised Password length versus hash length?
password stretching = method, password strengthening = goal
Apr
26
comment Where is the authentication tag stored in file encrypted using AES-GCM?
I've just written a proposal for an international API specification that doesn't directly "tag the tag" to the end of the ciphertext. The size of the ciphertext was usually known in advance anyway, so the buffering just added unnecessary overhead on an already constrained system (and it messes up the symmetry with the encryption functionality, as that doesn't need to buffer).
Apr
26
revised Where is the authentication tag stored in file encrypted using AES-GCM?
added 111 characters in body
Apr
26
comment Where is the authentication tag stored in file encrypted using AES-GCM?
The GCM specification from NIST specifies the 96 bit nonce as default on 8.2.1 of the document. GCM is required to do additional calculations for differently sized IV's.
Apr
26
answered Where is the authentication tag stored in file encrypted using AES-GCM?
Apr
26
comment Adding two public keys
@RickyDemer My feeling is that the first paragraph does answer the question, but that the text should be clarified and further explained why and how it answers the question.
Apr
26
answered Password length versus hash length?
Apr
25
comment If you hashed a hash an infinite number of times would you end up with a unique hash?
For most secure hash functions with big enough output, you need a pretty big amount of times to get into a cycle. Not quite infinite (nothing is), but big enough for it not to be an issue in practice.
Apr
25
comment Can a cryptographic hash be used as a cryptographic RNG?
If you are talking about KDF's you are talking about KBKDF (key based KDF's). In that case you may want to refer to NIST SP 800-108 (counter based KDF's) and HKDF, as well as KDF1/2. Some libraries may already have implementations.
Apr
24
comment How are onetimepads distributed?
Yes. As explained you need as many bits from pad 1 to distribute pad 2. The net effect is that you have exactly as many bits left, minus the ones you used for the (encoded ) message of course. And the bits may be changed by an active attack on top of that.
Apr
23
answered How are onetimepads distributed?
Apr
23
revised Why use randomness in digital signature algorithms?
just rephrazing a sentence a bit so it reads more smoothly
Apr
23
comment Why rogued certificate from hash collision is harmful
Side node: it may be that the maximum path length is controlled by the CA certificates. In that case a well implemented client should not accept a leaf certificate for which the path length is out of range.
Apr
23
comment Generating interactive, secure multiple ECC key pairs deterministically
With point 2 you say that "User A and B can generate future public keys". I understand from your explanation below that that they may cooperate to do this? Because I don't understand how A and B can create public keys without exchanging X...
Apr
23
comment Why use randomness in digital signature algorithms?
"I don't understand why digital signature schemes that employ randomness, like RSA-PSS, are any better than purely deterministic ones like RSA-FDH." - could you point out where this claim is made?
Apr
23
comment Why use randomness in digital signature algorithms?
Maybe not a problem for EUF-CMA, but leaking information about the plaintext may be an issue in other situations. I'm not sure that the message and signature are always available to an attacker at the same time. In that case a deterministic signature will (at least) indicate to an attacker if a message is identical to one that was send before.
Apr
21
comment The difference between MAC algorithms and what to use
@ThomasM.DuBuisson I'll write it as part of Bouncy and send it to David. I should still upgrade the AEAD interface as well, but I cannot do this at work time, so it's hard to find time that I can focus (and tomorrow I have to go kayaking again :) ). I'll send it to you as well. But lets not monopolize this Q/A...
Apr
21
comment The difference between MAC algorithms and what to use
@ThomasM.DuBuisson Trying to fix this and my knowledge about SIV by making an implementation of SIV in Java - found a small bug in the RFC, I'll let you know after I've verified it (that's the second ERRATA in so many days if it's true)
Apr
21
answered Why rogued certificate from hash collision is harmful