Reputation
14,580
Next tag badge:
77/100 score
34/20 answers
Badges
3 16 60
Newest
 Nice Answer
Impact
~234k people reached

2h
comment RSA PKCS#1, v1.5 padding output
@fgrieu Adjusted. Still listening to Skunk Anansie though... wow, what a show....
7h
comment RSA PKCS#1, v1.5 padding output
Minimum of 8 random bytes
9h
comment RSA PKCS#1, v1.5 padding output
Strange, could not directly find any dupes.
1d
comment HRNG for One Time Pad
RDRAND is standardized nowadays in probably all mainstream Intel CPU's. Not sure what the status is for AMD though, I think it will only be integrated into their next line of CPU's.
1d
comment How to encrypt incomplete block with RSA as a block cipher?
Note to self: add links to answer.
1d
comment How to encrypt incomplete block with RSA as a block cipher?
Clarification of Poncho's comment: there aren't any standard ways of doing this for textbook RSA. For normal RSA there's OAEP which is secure (if you can avoid the side channel padding oracle attacks on it).
2d
comment HW acceleration for Camellia cipher (x86_64/AES-NI/AVX2)
@otus That link just displays a login page unfortunately (without explaining what login is required). Interesting information though. It could still require some configuration - kinda hard to establish without more info.
2d
comment HW acceleration for Camellia cipher (x86_64/AES-NI/AVX2)
After looking at the Japanese information on it I tend to agree with this opinion.
2d
comment HW acceleration for Camellia cipher (x86_64/AES-NI/AVX2)
@Raoul722 That C code mostly looks like a stub. However, up till now I didn't find any OpenSSL implementations that use AES-NI, so it is probably not supported out of the box.
Feb
5
comment Security of RSA for paranoids with padding?
Still an interesting question, have you made any progress on this? Note that PACE-CAM could also be considered for dual authentication (SPAKE seems to only provide chip authentication ).
Feb
5
comment What is the difference between SHA-3(Keccak) and previous generation SHA algorithms?
This is indeed the reason why the SHA-3 competition was started. I'm not sure that this is the main reason why Keccak was chosen though, and I did at least follow the mailinglist.
Feb
5
comment Why is AES-SIV not used, but AESKW, AKW1?
AES-SIV is 6 years newer and the other wrapping mechanism isn't exactly broken. Personally I don't like the fact that AES-SIV places the IV at the start. This means you cannot encrypt the key value in place. That's not a huge issue when used as a cipher, but it unnecessarily complicates memory handling when used for key wrapping.
Feb
5
comment Can OTP be made practical by using stretched hash algorithms?
@RickyDemer True, not with regards to secrecy though :)
Feb
5
comment Can OTP be made practical by using stretched hash algorithms?
@JamesCameron You should be able to just paste the link in the top text field (or maybe that only comes with more rep, I'm not 100% sure). A somewhat belated welcome to crypto, by the way :)
Feb
5
comment Can OTP be made practical by using stretched hash algorithms?
Although I've answered, mainly to directly answer some parts of the question of James, I don't mind if this gets closed or not. I do think there will be many dupes in the end.
Feb
5
comment Can OTP be made practical by using stretched hash algorithms?
With an OTP an "added layer of security" doesn't make any sense. Either it is perfectly secure, or it is not.
Feb
5
comment What are the practical implications of ciphertext distinguishability?
I don't see how e.g. leaking the parity of messages would allow you direct access to the plaintext. Maybe an attack would be possible but that would require more messages. This seems contrary to your answer; you'd have at least substantially add to your answer to make this believable. Just pointing to a paper for this is not enough. Please prove my initial assumption wrong!
Feb
5
comment “Royal Flags Wave Kings Above”
We're fortunate that the people at Bletchley were better at correctly guessing hidden messages, eh?
Feb
5
comment What is the difference between SHA-3(Keccak) and previous generation SHA algorithms?
That's a bit strange. Skein seems to have this kind of flexibility as well, and that's certainly Merkle–Damgård. Furthermore, as it contains a 256 bit tweakable block cipher, it would be very useful to create a complete symmetric cryptosystem. That's why I supported it anyway. There are of course other considerations such as speed as well though.
Feb
4
comment What is the difference between SHA-3(Keccak) and previous generation SHA algorithms?
Ok, so we expect something about sponge construction here, length extension attacks and SHAKE at the least.