3,601 reputation
629
bio website
location Netherlands
age 40
visits member for 2 years, 8 months
seen 55 mins ago

Java and security expert with over 10 years of experience with the language and with the practical application of cryptographic protocols - including the design of protocols within international standardization bodies. Creator of a heavily used common criteria certified product. Over 30 years of experience with computers. Likes kids, cats, reading, movies and several sports.


Jul
22
revised Spoofing protocol nonce
fixed my name, made it link to answer, which is now way way WAY down :)
Jul
20
revised KDF based on HMAC-SHA-256
added 134 characters in body
Jul
20
revised Spoofing protocol nonce
made it more clear according to comments below
Jul
20
comment Spoofing protocol nonce
Yes, I did exactly mean that.
Jul
20
revised Is it safe to seed a random number generator from system time?
changed text according to admission of author in 3rd comment
Jul
20
comment Spoofing protocol nonce
Mallory can send any nonce to either one of them, and they happily encrypt it for her in step 2. So note that the other party (Mallory in this case) is not authenticated to them in any way yet.
Jul
20
revised Spoofing protocol nonce
added 98 characters in body
Jul
20
answered Spoofing protocol nonce
Jul
20
revised Spoofing protocol nonce
initial formatting; edited tags; edited tags
Jul
20
revised Decrypting an encrypted text out of order
removed a lot of text not needed for the question, removed cap. of Encryption from title
Jul
20
comment KDF based on HMAC-SHA-256
I've removed the language specific part of the answer (edited out from the question by otus). As you ask if a KDF based on HMAC-SHA-256 is identical on multiple platforms, the side question is impossible to answer. Usually crypto algorithms are identical if they 1) are based and tested against standards and 2) they apply the same encoding (if any) to the input and output.
Jul
20
revised KDF based on HMAC-SHA-256
deleted 352 characters in body
Jul
20
comment Are HMACs based on hashes with larger bit-lengths also more secure?
This is also why HMAC-SHA1 is still commonly used, even though the SHA-1 algorithm shouldn't be used anymore for e.g. signature generation. It is unlikely that SHA-1 will be vulnerable to first pre-image attacks, and the 160 bit output size offers enough security. Of course, if possible, you should still move to SHA-2 or SHA-3 (when the latter has been standardized).
Jul
20
revised Predicting PRNG given some of its previous output
added 82 characters in body
Jul
20
revised Process of dividing 168bit key into 56bit keys in TripleDES
formatted according to FIPS 46-3, mentioned TDEA as name, removed links to blogs about language implementations
Jul
20
revised Process of dividing 168bit key into 56bit keys in TripleDES
formatted according to FIPS 46-3, mentioned TDEA as name, removed links to blogs about language implementations
Jul
20
reviewed Close Where can I begin to study the math behind modern cryptography?
Jul
19
answered KDF based on HMAC-SHA-256
Jul
19
comment Modes of operation that allow padding oracle attacks
@D.W. The best definition I can come up with is "any attack that relies on the unpadding of the decrypted plaintext message to retrieve information on the plaintext". If an attacker only has access to the ciphertext - and this presumption may be made - then it would be a subset of chosen ciphertext attacks. BTW I was expecting that this was more or less implied by the question. Obviously the CBC specific attack would not work for any other mode than CBC without some alteration.
Jul
18
comment Is TripleDES 168bit vulnerable to Differential Cryptanalysis?
Source: Wikipedia: "In 1994, a member of the original IBM DES team, Don Coppersmith, published a paper stating that differential cryptanalysis was known to IBM as early as 1974, and that defending against differential cryptanalysis had been a design goal.[2]"