Reputation
9,489
Next tag badge:
77/100 score
31/20 answers
Badges
3 13 45
Impact
~147k people reached

Jul
7
revised If RSA is only used to encrypt symmetric keys which are random, what's wrong with textbook RSA?
added 6 characters in body
Jul
7
comment Can there be a need for 1024-bit (symmetric) encryption?
Threefish was slow when I implemented it, but it wasn't called "Skein from spec" for nothing, and Java is relatively slow compared to AVX / native implementations of course :) But you make interesting points and it is now clear that you did mean what was written down. Thanks for the clarification.
Jul
7
comment Can there be a need for 1024-bit (symmetric) encryption?
What do you mean with "besides performance and flexibility"? Do mean that a symmetric cipher with a 1024 bit symmetric key would be flexible and fast? Because it definitely wouldn't. If you agree with that then you may have to rewrite the last sentence.
Jul
7
comment Secure symmetric encryption algorithm for any-size base62 data
$E_{62}$ is encoding of data, $D_{62}$ is decoding, while $E_k$ is the encryption transformation using the FPE or the CTR cipher. I thought these functions would be clear. The 8 byte IV is the absolute minimum which indeed carries a risk. This risk could be worth it if the amount of data is small ("it is only for small data" can either be read as small packets or a minimal amount of data). Of course if there are many packets then the IV/nonce should be larger as the chance of a collision of the counter rises with the amount of blocks due to the birthday "paradox". Thanks for the warning @otus.
Jul
7
comment What are the advantages of using OFB (Output Feedback Mode)?
If you use GCM, CCM or EAX you would of course still be using CTR mode, even if that's not visible in the API :)
Jul
7
comment Can I reduce the MAC size in TLS?
Data in TLS divided up in records, each record carries some overhead. If the fragments are large this is not much of a problem. If you send many small fragments it might however carry too much overhead.
Jul
6
comment HMAC-SHA1( secret key ) with header of a transmitted file
Well, you say that you want to use HMAC, but in that case you would require a key and data. Now you could use the key and pre defined data, but that's a bit of a kludge. With a KDF you could just use the key as seed.
Jul
6
comment Software interface for KDF and PBKDF?
That's basically how Java solves this, injecting through a parameters instance and then validating if the parameter class is supported. That doesn't preclude a relatively general implementation of the parameter interface with just the commom options of course.
Jul
6
comment Software interface for KDF and PBKDF?
Note that Diffie-Hellman is key agreement rather than key derivation. It possibly includes a KBKDF scheme, but it isn't one itself. Also note that you may want to check out HKDF which has possibly separate parts for key extraction and key expansion. You may want to somehow reflect that in the API (although having a separate HKDF and HKDF-Extract may do the trick so you don't have to alter the parameters).
Jul
6
comment Source for PKCS#11 Header Files
Yeah, it seems like the current 2.40 version is a release candidate, although I could not really understand the way versioning is realised or if the header files are going to be updated in any way. The OASIS website is IMHO insufficiently clear on this.
Jul
6
revised Can I reduce the MAC size in TLS?
added 7 characters in body
Jul
6
comment Can I reduce the MAC size in TLS?
That's possible of course. If it is just overhead I would certainly first look at other options though, such as compression of the application data or removing the fragment overhead of SSL itself. Changing the size of the authentication tag should be one of the last measures you should consider.
Jul
6
answered Can I reduce the MAC size in TLS?
Jul
3
revised Parallel authentication of encrypted data. What AE type to choose?
added 9 characters in body
Jul
3
comment Parallel authentication of encrypted data. What AE type to choose?
Being online does not mean that there are no length limitations, it just means that you can perform the encryption/decryption directly - specifically without knowing the length in advance. GCM can be parallelized, but at the cost of performing additional calculations. It may be tricky to find a library that supports that. If the solution space is empty then the obvious solution is to split up the input and verify the blocks separately (with an additional authentication tag over the first authentication tag, like a hash tree).
Jul
3
comment Is there any practical attack to create a printable chosen prefix MD5 collision?
I'm not sure if it fits your needs, but you could use any byte code after a 00 character. Many editors and such don't display anything after the 00 "end of file/input" control character.
Jul
3
comment Is standardizing a modified AES a good idea?
Note: it seems like this replaces the previous GOST algorithm, which is an 64 bit block cipher with 256 bit key from Russia. After reading the text it seems to me that the cipher was chosen by competition is mainly AES with some of its deficiencies fixed. The question is if the Ukraine has a large enough crypto community to verify correct operation, because I would say that the crypto community of the world hasn't looked at it.
Jul
2
comment Is standardizing a modified AES a good idea?
I had some success doing exactly that on the security site. I just asked the author to respond. I think he was grateful to be notified. With a bit of luck we even get people to join this site :)
Jul
2
comment Is standardizing a modified AES a good idea?
They are all about Kalyna it seems so I'm OK with the fact that there are sub-questions. On the other hand, "the most likely design rationale" is a kind of asking to be guessing. Do you have any other resources that we could read? There is only a short description of the cipher, bar the test vectors.
Jul
2
revised Is standardizing a modified AES a good idea?
added 1 character in body