6,543 reputation
2938
bio website
location Netherlands
age 40
visits member for 3 years, 2 months
seen 5 hours ago

Security professional with many years of experience with the practical application of cryptographic algorithms and protocols. I'm helping with the design of protocols and API's within international standardization bodies. Lead developer of a common criteria certified product. Over 30 years of general experience with computers.


2d
comment Why should the RSA private exponent have the same size as the modulus?
I think it's not just France where numbers do not have a size. Actually, I've just asked for a standard to be reworded to distinguish between the encoding (representation) of a value and the value itself. If we are talking in bits then the requirement does not make much sense, but even if you are talking octets then FIPS approved HSM's will still generate invalid private exponents. Somehow I don't think they wanted to exclude FIPS certified HSM's. Personally this seems to be just a badly worded requirement. Use an approved generator and reference that if questions ever come up.
2d
comment Why should the RSA private exponent have the same size as the modulus?
Actually, the requirement - when interpreted literally - would be worse than just requiring $d>N/2$. $N$ could be just over $2^{l-1}$ where $l$ is the keysize in bits, in that case $N/2$ would already be a single bit shorter.
Jan
28
comment 2048-bit RSA Decryption
Is there any particular problem with keeping the question, ABC? Maybe you could flag a mod instead. Note that any trusted user can roll back at any time.
Jan
28
comment Why isn't CTR mode (counter mode) used more often?
@CodesInChaos True, until you want to make an optimized multithreaded version with a smart buffering strategy :P
Jan
28
comment Why isn't CTR mode (counter mode) used more often?
@Anthony Good point, I only gave that answer for his other question. Thanks!
Jan
27
comment Help converting sha256 to 32-bit stream
If this solves the question then don't forget to accept!
Jan
26
comment Reusing one-time-pad with random plaintext
Never give up. Maybe reevaluate now and then. But do try to study the subject, this was more meant as an incentive to study the subject than to put you off. There are hundreds if not thousands of proposals. If you cannot describe them well or show a security reduction than your proposal has a snowballs chance in hell, even if it is good.
Jan
25
comment Achieving 32-bit verification code with 16-bit CRC?
In general CRC's have been designed to detect a certain amount of bits being changed. It would be tricky to get the same level using CRC's that are half the size.
Jan
25
comment Spritz cipher sponge function capacity
I've removed my comment. I've reread Spritz architecture, but it is hard to actually pinpoint the precise security level that is reached given the state of the sponge. An answer could clear this up.
Jan
24
comment Now that quantum computers have been out for a while, has RSA been cracked?
Above comments of D.W. were because I asked if "unlimited number of qubits" is really a requirement for a quantum computer. I however used infinite instead of unlimited, which is of course quite something different. @D.W. Yeah, I understood enough to see why D-Wave's solutions are different from what we expect when we talk about quantum computing, I just fixed one word in your excellent answer but I had some doubts about changing "unlimited" to something else - rightfully so it seems.
Jan
24
comment Is it possible to perform one-way Diffie-Hellman MITM?
I guess the intuitive answer is that if you have nothing to see if you are communicating with your friend, then an MITM attack is always possible. Although the secure channel exists, you don't know who it has been established with. If you are indeed connected to your friend, then everything after that is indeed secured (assuming everything is implemented as it should be, of course).
Jan
24
comment Is it possible to construct a secure block cipher of size $2n$ given a secure block cipher of size $n$?
Was this question sufficiently answered?
Jan
24
comment Why do Certificate Authorites cross-sign each other?
Although I agree, I do note that the answers given there are not of terribly high quality at this point in time. That's no reason to allow it here though. I was looking for a better explanation on the web, but I didn't find any. The explanation in the paper of Entrust seems to have some issues as well (including general readability, in my opinion).
Jan
24
comment ElGamal and Schnorr groups
Note: my above answer merely shows why it doesn't matter that it takes a long time generating, it doesn't give a mathematical reason why Schnorr groups cannot be used. Mints97 feel free to change the accept if somebody does give a mathematical reason.
Jan
24
comment ElGamal and Schnorr groups
@Mints97 You mean apart from breaking the security reduction? I may not create a good enough answer on it, as I'm still in the process of upgrading my math skills. Note that if you are worried about efficiency you could switch to Elliptic Curve primitives and use a named curve (e.g. using ECDSA and ECIES) which deploy schemes with similar properties to El-Gamal.
Jan
21
comment HMAC-Ripemd-160 in TrueCrypt
That depends on the entropy in the password. If we don't know the "key space" we cannot do the calculation.
Jan
17
comment Performing HMAC with random key before MAC comparison
@poncho I think it could be simpler than that; if there is no time constant comparison and there is a HMAC function it may be easier to use the latter. I'm not sure if the PHP type system would be a burden, but personally I don't see why a time constant compare wouldn't work.
Jan
17
comment How to implement HMAC SHA-256
Remember: for almost all crypto algorithms there are test vectors available online: see my question here for possible locations (that was about block ciphers, but the same thing goes for HMAC's etc). One day does not sound too bad, actually, you can easily try forever if you don't know the exact binary input to a cryptographic algorithm.
Jan
17
comment How to implement HMAC SHA-256
The online encoder is correct if you interpret the key 256'h603deb1015ca71be2b73aef0857d77811f352c073b6108d72d9810a30914dff4 as ASCII. However, if I input your message without quotation marks I get 292ed0240964c62dc685ebf028801fdb4e5895a1f908c7c824dd53a993fc4e66 (and the same on Java).
Jan
17
comment How to implement HMAC SHA-256
OK, so they perform character encoding for the key value as well, while you are specifying hex characters. This may mean that you are using hex decoded bytes instead. And their sample key is in hex; brilliantly stupid - don't use code from random sites!