2,552 reputation
622
bio website
location Netherlands
age 40
visits member for 2 years, 4 months
seen 4 hours ago

Java and security expert with over 10 years of experience with the language and with the practical application of cryptographic protocols - including the design of protocols within international standardization bodies. Creator of a heavily used common criteria certified product. Over 30 years of experience with computers. Likes kids, cats, reading, movies and several sports.


6h
revised Security of KDF1 and KDF2 (hash based KDF's)
changed KDF0 to KDF1 and KDF1 to 2, as suggested by answer of Imari
17h
comment Cryptographic library quality
Because it takes a lot of resources away from actually developing the library. They are paper procedures mostly. Furthermore, FIPS and CC (CC much more so) have the nasty side effect that they do not promote updates to libraries.
1d
comment Relation between key size and PRNG state size
Then again, generating a 1024 key in itself is not fine, that key size should no longer be used.
1d
comment Cryptographic library quality
There is no answer here that is not at least opinionated. After the last debacle using a non-managed language (read: one that not intrinsically protects against buffer overflows), I would not consider anything in C. As Botan is object oriented C++ it would come slightly closer. FIPS certification is clearly not enough; it may even be detrimental to perform certification.
1d
comment Security of KDF1 and KDF2 (hash based KDF's)
Hopefully it does not matter if $c$ is signed or unsigned, of course :P. Maybe the security of the KDF can be directly mapped to a hash vs HMAC comparison?
1d
asked Security of KDF1 and KDF2 (hash based KDF's)
1d
comment Questions about Key Derivation Functions
I think you should use HKDF (or a KDF from NIST SP 800-108) if you require a KBKDF (key based KDF) and PBKDF2 if you require a PBKDF (password based KDF) that performs key stretching. You don't need a PBKDF2 (or salt nor iterations) if you already have a key / secret with enough entropy.
Apr
7
answered Convert SpookyHash to semi-secure 192bit hash
Mar
31
comment How can I convert a DER ECDSA signature to ASN.1?
Note that for Java, you can simply perform new BigInteger(1, byte[] r).toByteArray() as the default Java encoding of a BigInteger is identical to the ASN.1 encoding of INTEGER.
Mar
22
awarded  Nice Question
Mar
18
comment Why is H(k||x) not a secure MAC construction?
Thanks I knew by now how Keccak behaves of course, but I forgot to add the information myself.
Mar
18
awarded  Notable Question
Mar
17
comment Modular protocol design
I would pass on that last question as well, it would be highly debatable - you cannot prove if something has a modular design or not. E.g. "has a clear goal" is highly subjective. If this question is asked for a test you should give your own opinion and reasons why you think it is or is not modular instead. Then the given reasoning behind your decission could be evaluated.
Mar
17
awarded  Excavator
Mar
17
revised Cipher Feedback Mode
added a single word "enter" at the right spot
Mar
17
comment Elliptic Curves of different forms
In your openssl example you use "binary curve" twice. Is that intended or a typo?
Mar
17
comment Hash Based Encryption (fast & simple), how well would this compare to AES?
In general, hash functions are not fast compared to block ciphers. So at least the fast part is incorrect, and I'm not sure this is more simple than e.g. AES-CTR, which does approximately the same thing while using a block cipher.
Mar
17
comment Hash Based Encryption (fast & simple), how well would this compare to AES?
@fgrieu That's the answer, not a comment :)
Mar
3
comment How do process calculi, CSP, Promela, … compare?
I've marked this as not an answer PulpSpy. Probably you did not have enough rep. back in the day. You may want to delete this brand spanking old post :)'
Mar
2
comment Would it be secure to use random numbers from random.org in a cryptographic solution?
OK, but we cannot be assured either that random.org does not repeat its random stream on a reboot etc. That would preclude a lot of the above use cases. Basically, we can only hope that random.org is valid from what is pronounced at the front page. That's simply not enough.