5,479 reputation
2734
bio website
location Netherlands
age 40
visits member for 2 years, 11 months
seen 1 hour ago

Security professional with many years of experience with the practical application of cryptographic algorithms and protocols. I'm helping with the design of protocols and API's within international standardization bodies. Lead developer of a common criteria certified product. Over 30 years of general experience with computers.

On crypto I mainly answer less mathematically inclined questions, leaving security proofs to the theoretical cryptographers and analysts.


1h
comment PHP secure random number generator
Say you create a random number for the range 0..7FFFFFFF - d where d is a small delta. You have a random number in the range 0..7FFFFFFF however. How do you create a deterministic calculation where the numbers are evenly distributed over that particular range? When I said don't use floats I meant it.
1h
comment PHP secure random number generator
Related crypto.stackexchange.com/q/7996/1172 and crypto.stackexchange.com/q/5708/1172
1h
comment Compact digital signature for noisy data
@fgrieu Reed-Solomon is however also used for PAR2 where entire packets can be missing (I think grouping the bits differently for the ECC - i.e. over the first bits of all symbols etc - does the trick)...
10h
comment Is salt bring more security for digital signature!
I've got the feeling you are doing crypto the wrong way around. You are trying to implement crypto, and then learn about it. You need some basic understanding of crypto before asking these kind of questions. Either start learning or get some support.
1d
comment Why we can't implement AES 512 key size?
Is there some kind of authority where we should report this obvious abuse? If there is something I really hate it is fake scientific papers and results.
1d
comment Is salt bring more security for digital signature!
A salt is commonly used for key derivation functions, not for signature generation functions. If you think otherwise, please provide us information about the signature algorithm.
1d
comment PHP secure random number generator
I think my alteration of the above comment crossed the one you were writing, I think the Java class containing nextInt(int) should be sufficiently "pseudo code" to be used. Obviously it misses the calculation of the range and $min + but I presume that doesn't pose a problem.
1d
comment PHP secure random number generator
No, I meant that floating point numbers shouldn't be used at all, you get into trouble with rounding errors and such. Those may slightly alter the distribution, and slight errors in crypto almost always end up in less slight attacks. Take a look at for instance the Java Random class on how to do this using integers.
1d
comment PHP secure random number generator
One thing that I've learned is to avoid floating point numbers at all cost. This can and should be solved using integer (discrete) math.
Nov
21
revised Hash collision using the leading 40-bits of SHA-1
added 92 characters in body; edited title
Nov
21
comment Hash collision using the leading 40-bits of SHA-1
@user1813580 A quick test confirms this.
Nov
21
comment Hash collision using the leading 40-bits of SHA-1
will find a collision -> won't find a collision?
Nov
21
comment Encryption of big files in Java with AES/GCM
@alejo I started to doubt myself and have looked up the requirements from NIST SP 800-38D and changed my answer accordingly. If unsure, look up the standard document.
Nov
21
revised Encryption of big files in Java with AES/GCM
deleted 97 characters in body
Nov
20
comment Difference between signing with SHA256 vs. signing with RSA-SHA256
This question appears to be off-topic because it is about a specific API
Nov
20
comment AES - Encrypting multiple blocks of files
If you prefix something it becomes larger? If the maximum size of the encrypted blocks can be somewhat larger than the plaintext you can just use CBC + padding or CTR and prefix the IV.
Nov
20
comment Should I study advanced abstract algebra and more than elementary number theory to pursue a career in cryptography?
I would gobble up any maths on discrete numbers that you can find + statistics. Without that background it is hard to succeed as a cryptographer. A math study will provide a better background than computer science in that regard. Yes, even most cryptographers may not understand EC fully, it would be beneficial if you can read safecurves.cr.yp.to without blinking too much. This advice was brought to you by somebody that stumbled into crypto slightly late and didn't gobble up that much math in the process.
Nov
20
revised Availability of a simple limited PRNG algorithm
edited title
Nov
19
revised Encryption of big files in Java with AES/GCM
added 75 characters in body
Nov
19
revised Encryption of big files in Java with AES/GCM
added 75 characters in body