Reputation
17,362
Next tag badge:
68/100 score
24/20 answers
Badges
3 19 67
Impact
~286k people reached

Apr
21
comment Is Schannel supposed to use SHA1 for (EC)DHE params?
It could be a misconfiguration as the private key operation itself is performed at the server side. As far as I know the server is responsible for indicating the hash algorithm. I'm not sure you can (easily) configure this for SChannel though, so hence the comment instead of an answer.
Apr
19
answered Key Hierarchy and key Encryption
Apr
19
comment Is Schannel supposed to use SHA1 for (EC)DHE params?
Just to be clear: it's the signature being generated by the private key of the TLS server certificate over the handshake frames that uses SHA-1. This SHA-1 is not used for certificate chain verification or for key derivation after the ECDH key agreement. In that sense it could very well be a misconfiguration IMHO, but I'm not that familiar with SChannel to know for sure.
Apr
18
comment How to perform collision attack
See my answer here. You're slightly late tat the game. Better hurry up :) Note: this answer will be closed as dupe at the first upvote of one of the answers over there.
Apr
18
answered SHA1 collision for first 32 bits for two different message
Apr
17
comment Would A5/1 with a much larger state be a good choice of stream cipher for hardware?
If I look at the Wikipedia article there seem to be a lot of attacks on A5/1. You'd have to dispel all of them and then hope that there aren't any others I suppose. It seems more logical to go for a more modern stream cipher
Apr
16
comment Robust combination of two Password Based KDFs
The point is that you assume one of the functions may be broken. They currently aren't so creating identical output isn't possible. But if you take that stance, you don't need dual functions at all. So, as we don't know how these functions are cracked, we'd have to assume their output can be controlled. I.e. the function itself is under control of the attacker.
Apr
16
comment Robust combination of two Password Based KDFs
@ravenstone I didn't make it up, just check the help center under analysis for more information. We're generally helpful and provide hints. But there simply is no definite answer to "analyse this scheme" as it is not a concise question...
Apr
16
awarded  Enlightened
Apr
16
awarded  Nice Answer
Apr
16
comment How to Perform Computation on AES Encrypted Data
You state you want to use "somewhat homomorphic encryption". That's as bad a question as the quality of the code you post. Why do we need to read Android API code? Why do we read all those commented out lines? Why don't you keep to Java code guidelines? I can understand your frustration, but honestly, maybe you should try and reread your question as if you're one of us.
Apr
16
comment Is it possible to brute-force a hash algorithm of 32 bits
Yeah, that is my concern as well. You'd get a match pretty quickly, but this is not like finding a collision in, say, SHA-256. Of course most passwords are not random bit strings, and you could try the entire set against another service as well - if that service would allow it.
Apr
16
comment Is it possible to brute-force a hash algorithm of 32 bits
@MichaelKjörling If your goal is to find the exact password - instead of just one that matches the hash - then then collisions are only in the way of finding a correct one. If the passwords were randomly generated then you may never find a password with 100% certainty. Also see the first comment or Xander below the question. If you just need a password that hashes to the 32 bit value, yeah, trivial.
Apr
16
comment Stripping off message authentication or signature
Note that without the complete protocol this is a bit of a tricky question. Usually symmetric operations and asymmetric primitives are not directly mixed; it's a bit strange to require an asymmetric key if you've already shared a symmetric key. You'd probably have to agree (or wrap) the symmetric key using an additional operation if you cannot share the secret key in advance. So there seems to be an operation or two missing in the description of the protocol in your question.
Apr
16
revised Why can't we use the first block of AES-CBC as MAC
edited tags
Apr
16
revised Format Preserving Encryption FF1 Samples
formatting
Apr
16
answered Stripping off message authentication or signature
Apr
16
revised Is it possible to brute-force a hash algorithm of 32 bits
added 42 characters in body
Apr
16
comment Why can't we use the first block of AES-CBC as MAC
Note that CBC-MAC is not secure for dynamically sized input, you'd have to use CMAC for that (which actually uses CBC-MAC underneath).
Apr
16
answered Why can't we use the first block of AES-CBC as MAC