3,601 reputation
629
bio website
location Netherlands
age 40
visits member for 2 years, 8 months
seen 1 hour ago

Java and security expert with over 10 years of experience with the language and with the practical application of cryptographic protocols - including the design of protocols within international standardization bodies. Creator of a heavily used common criteria certified product. Over 30 years of experience with computers. Likes kids, cats, reading, movies and several sports.


10h
comment Is it secure to use Diffie-Hellman key agreement to generate a nonce?
But the fact remains that the nonce does not have to be kept secret, and that GCM authentication already includes the nonce. In the end, just sending the nonce (at startup & when sync fails) is a whole lot less overhead than performing DH, both with regards to computation time and message size.
12h
revised Is it secure to use Diffie-Hellman key agreement to generate a nonce?
gcm already includes counter
12h
comment Is it secure to use Diffie-Hellman key agreement to generate a nonce?
With once I mean in the initial message. If you can keep the number synchronized then you don't need it afterwards. Note that if you have a message counter somewhere you already have a nonce. Even if not present, it's a good idea to make sure that the nonce is taken into account in the authentication tag. Heh, forgot that this is already the case for GCM mode of authentication.
13h
comment Is it secure to use Diffie-Hellman key agreement to generate a nonce?
The "key pairs" used for the Diffie-Hellman protocol. If you generate new x and y each time, it would be an ephemeral-ephemeral DH protocol, and you would be OK. As for the bandwidth, just sending over the (authenticated) nonce/IV once seems less overhead than a full DH protocol to me.
21h
revised Key Derivation from random salted seed, HMAC and HMAC based KDF
added explicit note about using HMAC before HMAC based KDF
21h
revised Key Derivation from random salted seed, HMAC and HMAC based KDF
added 8 characters in body; edited tags; edited title
21h
revised Is it secure to use Diffie-Hellman key agreement to generate a nonce?
edited title
21h
comment Is it secure to use Diffie-Hellman key agreement to generate a nonce?
Welcome in advance to crypto, Yoav R. :) I've removed the general description of Diffie-Hellman from your question, the people here will know what you are talking about.
21h
revised Is it secure to use Diffie-Hellman key agreement to generate a nonce?
added 543 characters in body
21h
revised Is it secure to use Diffie-Hellman key agreement to generate a nonce?
deleted 233 characters in body; edited tags
22h
comment CSPRNG that cannot be used as random extractor
@D.W. Don't go into overdrive now. I presumed (and the link to 90A kind of points this out) that CTR_DRBG was meant. It is specified in 10.2.1 of that document. This seems to be a CSPRNG to me, including seeding and reseeding and whatnot. Of course, you could wonder if the reseeding process cannot be used to add in additional entropy. Otus, could you point to this paragraph and name instead of AES-128 CTR CSPRNG (if I'm correct)? That does not seem to be the official name.
23h
comment CSPRNG that cannot be used as random extractor
@D.W. Was that a multiple choice question? For the latter - at least AES-CTR, they are OK if you have a fully random seed as key I suppose.
23h
comment CSPRNG that cannot be used as random extractor
@D.W. Something like Yarrow yes (although I don't know why you came up with that particular one), as indicated I started off from the Wiki page, which states that a CSPRNG has some properties that may not be compatible with a randomness extractor. Actually they seem quite different to me, but I guess you can still use a CSPRNG for practical post processing of random entropy, if the CSPRNG allows it. Hence I left the question open. /dev/urandom is not an algorithm and a block cipher in counter more or a stream cipher can only be building blocks for CSPRNG's it seems to me.
1d
answered Is it secure to use Diffie-Hellman key agreement to generate a nonce?
1d
comment OTT service using FPE
@e-sushi I guess that if the size of the stream does not have to be maintained that there would be room for such a thing. Obviously it would not be easy to create, and anybody listening in would likely either hear a lot of noise or - if stenography is also used - a receive a very large stream.
1d
reviewed Close Is complexity of ElGamal cryptosystem $O(log(n))$?
1d
comment Implementing CD serial key system
@RickyDemer It seems that the threshold was more about splitting the signature in multiple parts. I don't think that counts as threshold-crypto, so I removed the tag.
1d
revised Implementing CD serial key system
paragraphs; edited tags
1d
accepted CSPRNG that cannot be used as random extractor
1d
comment CSPRNG that cannot be used as random extractor
Your answer has a lot more information than the one of Otus, and as learning is concerned it is of more value. However, I think otus came closer with regards to providing an answer. +1 none-the-less of course.