4,295 reputation
731
bio website
location Netherlands
age 40
visits member for 2 years, 9 months
seen 16 hours ago

Java and security expert with over 10 years of experience with the language and with the practical application of cryptographic protocols - including the design of protocols within international standardization bodies. Creator of a heavily used common criteria certified product. Over 30 years of experience with computers. Likes kids, cats, reading, movies and several sports.


16h
comment How do institutions like banks do RSA with big primes?
But notice that OpenSSL is pretty fast with regards to these kind of calculations. You may have much worse results on interpreted code (e.g. on the JVM), let alone interpreted code.
16h
comment GCM: Math behind update of AAD after ciphertext has been processed
Well, it does work for sure. It seems that it first calculates $\operatorname{GHASH}_H(A_{0..x}||C)$ (including the zero padding), removes the padded $\operatorname{GHASH}_H(A_{0..x})$ and substitutes the new $A_{0...z}$, which was continued from the unpadded $\operatorname{GHASH}_H(A_{0..x})$... at least if I interpret the code correctly.
1d
comment GCM: Math behind update of AAD after ciphertext has been processed
So if there is already AAD data then we can just exponentiate the difference, where the difference is calculated with XOR, right? Bouncy also works for $A_{0..x} || C || A_{(x+1)..z}$...
2d
comment What is the technical name for a public key container in DER format?
I do not agree with the close votes. This is not about decoding or decrypting a piece of ciphertext, it is about identifying a cryptography related data structure. That is both a concise question and of use to others.
2d
revised GCM: Math behind update of AAD after ciphertext has been processed
added 57 characters in body; edited title
Sep
16
comment GCM: Math behind update of AAD after ciphertext has been processed
I'm improving the GCM code of Bouncy Castle, making the nice properties of CTR return. I've already got everything running, but I still need to integrate this feature. I can do this better if I understand the involved mathematics.
Sep
16
asked GCM: Math behind update of AAD after ciphertext has been processed
Sep
11
revised AES-GCM Disadvantage
deleted 3 characters in body
Sep
11
revised AES-GCM Disadvantage
added 85 characters in body
Sep
11
comment AES-GCM Disadvantage
Done, same to you, if you think it is unclear, edit or let me know. I thought disclosure of a key is too serious to ignore, I mean, an authentication function cannot get more broken than that.
Sep
11
comment AES-GCM Disadvantage
I've removed my answer as Dimitry's answer is much better (don't forget to accept). But I'll put it here as a comment: the goal of the competition is to find better schemes of authenticated encryption. Even though GCM has many disadvantages, it seems mainly used as a base line within the competition. That does not mean that the previous modes have been broken, or that there is one particular advantage that they focus on.
Sep
11
comment AES-GCM Disadvantage
In Authentication weaknesses in GCM Niels Fergusson states (about forgeries): "This quickly leads to a situation in which the attacker knows all of H, after which arbitrary forgeries can be created without any chance of detection by the receiver." where H is the data used as authentication key (!). So short tags leads to complete loss of authentication, even for ciphertext with a larger tag used later on. This is clearly a more potent statement than your second statement.
Sep
10
comment Advantages of using intermediate hash over full hash in digital signature application
Still no substantial reasons other than that apparently some cryptographers want to maintain them in the standard.
Sep
8
comment Why does FIPS 186-4 require specific sizes for keys?
I wish NIST would do the same for KDF's. It's a mess with multiple MB of test vectors, that still don't cover all the options, and all the verified implementations (CAVP) implement a different KDF's.
Sep
8
comment How can SSL secure a two-way communication with only one key-pair?
Are there ciphersuites that only perform client authentication? Which ones?
Sep
8
comment Bit padding instead of PKCS#5 padding
@PaŭloEbermann I guess in principle you could extract timing information, but finding timing information about unpadding a bit string may be tricky (as it will take almost no time at all). That said, it can be done, e.g. by carefully putting the plaintext + padding on a page boundary of a modern CPU. Paging can be used to extract timing information.
Sep
8
comment Bit padding instead of PKCS#5 padding
@PaŭloEbermann Other Oracle attacks may be feasible of course, you may be able to use the errors generated by the application receiving the garbled plaintext to extract information about the plaintext. One of such attacks (on encrypted XML) is described here
Sep
8
revised Is this correct way to generate stream cipher using AES CTR mode?
integrated comment of CodesInChaos
Sep
8
reviewed No Action Needed “Practical” operations supported by functional encryption?
Sep
8
reviewed No Action Needed Perfectly secure shift cipher