4,946 reputation
1734
bio website
location Netherlands
age 40
visits member for 2 years, 11 months
seen 1 hour ago

Java and security expert with over 10 years of experience with the language and with the practical application of cryptographic protocols - including the design of protocols within international standardization bodies. Creator of a heavily used common criteria certified product. Over 30 years of experience with computers. Likes kids, cats, reading, movies and several sports.


1d
comment Secure way to derive separate encryption and MAC keys from a single master key?
Yes that's kind of possible, but scrypt was created to do key stretching using a work factor (and, in the case of scrypt, a large internal state). Usually it is possible to use a Password Based Key Derivation Function (PBKDF) instead of a Key Based Key Derivation Function (KBKDF), which is what is required.
2d
comment Secure way to derive separate encryption and MAC keys from a single master key?
@RichieFrame That's likely secure and likely the fastest method as well, but it doesn't scale with the size of the keys, hash or number of keys that required. Using a well defined KDF should be preferred IMHO.
2d
answered Secure way to derive separate encryption and MAC keys from a single master key?
2d
answered Prepending random data to encrypted file
2d
comment How to guess the encoding of a string?
Oh, toons in PNG format. Hint: first concatenate all the stings, then split on =. Then decode and save. There is an additional header that you may want to cut away. And it could be that there is no = delimiter. In that case you may get multiple files after each other. Good luck.
2d
revised Does a stream cipher require a KDF when it's key is variable length?
deleted 68 characters in body
2d
comment Rijndael performance
@otus I think it means operations, but that does not make much sense over operations per second. So I'll leave it to the user to explain.
Oct
22
revised Does google's Crypto.JS AES encryption use PBKDF2 as default?
added 144 characters in body
Oct
21
comment The security of an encrypt-and-MAC
A few remarks: the ciphertext itself is not protected, so this scheme could be vulnerable to padding oracle attacks - they are not prevented by this protocol in itself. Furthermore, having a HMAC over just the plaintext is a bit dangerous, usually you want to at least include the IV in the MAC calculation - if it is used and send with the ciphertext. If other protocol information and the IV is included in the MAC calculation then I guess you can alleviate the requirement to separate keys per transaction.
Oct
21
comment Verify signed file using GPG by passing in signature hosted online rather than stored locally (i.e. in keyring)?
What about wget or a similar cli utility?
Oct
20
answered Does a stream cipher require a KDF when it's key is variable length?
Oct
20
comment Protection of Elliptic Curve Implementations against side-channel attacks
@CodesInChaos You are probably right, but does it invalidate the question enough to close it?
Oct
20
comment Cryptography system that limits the length of the encypted message
Thank you for telling me all that, Tianren Lu, I never would have guessed.
Oct
20
awarded  Fanatic
Oct
19
comment Cryptography system that limits the length of the encypted message
Sorry, but a one time pad is basically a theoretical construct. Using it for a practical application such as SMS encryption is not a good idea. Using a stream cipher could work, but you would make sure that both sides stay in sync somehow.
Oct
19
comment Implementation of garbled circuits using RSA
@ThomasM.DuBuisson Maybe change that into an answer? Negative answers are answers just as well.
Oct
19
comment problem with “one time pad”
This is pretty well explained by - for instance - Boneh, isn't it? The idea of such practice is that you learn to do this yourself.
Oct
19
comment SHA-1 collision resistance
Anything missing from the given answer, dear new user? It's been a while.
Oct
17
comment Elliptic curve parameters
I don't think you can validate outputs efficiently by hand. If you have a well described question for a specific implementation you could post on StackOverflow.
Oct
16
comment Encrypting twice with different modes?
How much more difficult than AES-256 in CTR mode? If the CTR is well applied, that question doesn't make much sense. Assumed that they could brute force 128/256 bit AES keys? You might as well assume that the attacker already has the keys, that would be a much more believable scenario.