Reputation
7,969
Next tag badge:
63/100 score
25/20 answers
Badges
2 12 42
Impact
~122k people reached

17m
comment Finding public exponent e
yes, I've got some ideas like checking the often used ones first and then check a simple encrypt/decrypt, but I would like the answers not to be influenced by my non-optimal ideas :) And yes, I am aware that this may be hard to do if the public exponent is very large, but this is not commonly the case.
1h
comment How to calculate RSA CRT parameters from public key and private exponent
You may be interested in this question / answers on SO.
2h
comment Authenticated EC key exchange without a signing/signature scheme?
Yeah, I guess, the trick is just that it doesn't leak the identity before authentication.
19h
comment Compacting a substitution cipher key
OK, now it is a random permutation from ${\{0,1\}}^3$ to ${\{0,1\}}^3$, helped you a bit with the edit. I presume any random permutation is allowed.
19h
comment Compacting a substitution cipher key
That's not a key, that's a permutation from ${\{0,1}\}^3$ to ${\{0,1\}}^3$. And it is identical to performing XOR with 1 for each bit, also known as a bit complement.
1d
comment Authenticated EC key exchange without a signing/signature scheme?
If you change PAKE to read PACE then you've got another one - though I haven't compared them yet :)
1d
comment Hardening of random number generators
That's true, but usually the internal state is pretty large. I'm not sure about the precise implementation though. Never hurts to reseed it a bit of course, maybe between calls.
1d
comment Hardening of random number generators
If the RNG does provide entropy then it may be more sensible generate a lot of data and to use a KBKDF such as HKDF or to feed the entropy in into a random number generator (just to bring it back to a previous problem, maybe I'm a mathematician after all :) )
1d
comment Hardening of random number generators
Seems to me that if the RNG is broken in the sense that it is predictable (by someone) that performing PBKDF2 won't do much good. The salt will be predictable as well. If the RNG doesn't generate enough entropy then this technique seems to add a bit of security. Basically, if the attacker has to guess than it may add a layer of security. How much depends on how much the attacker has to guess (if only 2 random values are possible then having the attacker do 2 PBKDF2 calculations won't do much).
1d
comment HKDF entropy extraction
In your solution you are using a key derivation method as key generator. DRBG's, KDF's and key generators are closely related, but they differ on the details. As it seems that your issue is with the random generator, it seems more logical to replace that. Changed the answer a bit to reflect this.
2d
comment HKDF entropy extraction
@Paya I didn't know that that answer existed, but it is nice to know that I'm being backed up by Thomas :) Your idea isn't bad or anything, but if you want to have more random numbers than just for the key (and you usually do) then a PRNG makes a bit more sense.
2d
comment Hash length extension attack - SHA256 to 512 - impossible, correct?
Just out of curiosity, would the different initial values be enough to thwart a length extension attack?
May
22
comment Hash length extension attack - SHA256 to 512 - impossible, correct?
Even if there's no known way I would recommend creating a canonical representation of messages, e.g. by prefixing the length for the user-key. Somebody may look at your code and decide that using a single hash function would be more efficient. At the very minimum create a design document and comment your code.
May
22
comment Hash length extension attack - SHA256 to 512 - impossible, correct?
Guys, maybe something for meta, but I see very few people upvoting questions. Now I can understand not upvoting questions if they are too specific but there seems to be a growing gap between the amount of upvotes for answers and questions.
May
21
comment The difference in size between ECDSA output and hash size
Well, with modular arithmetic that should be almost nothing, even with 256 bits. Note that there is also the less known SHA-512/256 which is somewhat more secure and actually faster on 64 bit machines (but support, alas, is generally lacking from crypto-API's.
May
21
comment nonce of AES-GCM in SSL
There are a few differences: in GCM the tag size is preconfigured as it is an input parameter for the algorithm (although the result is created by truncation, so). The tag size is more important in GCM with regards to security as well. Otherwise it would be entirely possible to use a 10 byte tag.
May
21
comment secure dynamicaly growing memory (libsodium)
As long as there are no answers here you can simply copy the question source & title, enter it on SO and then delete it here. Don't forget to add the right tags.
May
21
comment one-way deterministic hash for low entropy input?
I presume that with SHA512SUM you are simply referring to SHA-512 (sha512sum is not an algorithm, it's a GNU command line utility) and that with RSA you are referring to RSA / PKCS#1 v1.5 signature generation? Have you taken a look at PBKDFs?
May
21
comment one-way deterministic hash for low entropy input?
@CodesInChaos Right. The only advantage of using RSA here is that it is probably 1) already available and 2) already slow (for private key operations, which is what I presume we are talking about). Eh, wouldn't be an advantage to check the validity of H with a public key as well?
May
21
comment prepaid meters that rely on a disconnected system
There are just too many schemes possible with an online protocol. Maybe if you could specify the specific products/protocols that somebody knows the answer. But as this is pretty domain specific you would have to be rather lucky. Maybe you could ask a vendor.