5,480 reputation
2734
bio website
location Netherlands
age 40
visits member for 2 years, 11 months
seen 2 hours ago

Security professional with many years of experience with the practical application of cryptographic algorithms and protocols. I'm helping with the design of protocols and API's within international standardization bodies. Lead developer of a common criteria certified product. Over 30 years of general experience with computers.

On crypto I mainly answer less mathematically inclined questions, leaving security proofs to the theoretical cryptographers and analysts.


Nov
14
comment How can CBC-MAC be secure when message length is fixed?
I put the mathematical parts in mathematical notation, but I think you're missing some parentheses in your 4th paragraph, the XOR must be over an equal sized value. Could you have a look?
Nov
14
revised How can CBC-MAC be secure when message length is fixed?
formatting of math
Nov
14
accepted Which attacks are possible against raw/textbook RSA?
Nov
13
comment What is the use of segments in Cipher Feedback Mode (CFB)
Thanks for the extensive answer! I think that OFB8 being universally recognized as being a bad idea does place a few API designers and user applications in a different universe though. I did read about the short loops yes, I presume that that was the reason why NIST did not standardize OFB8.
Nov
13
accepted What is the use of segments in Cipher Feedback Mode (CFB)
Nov
13
comment Strange MAC algorithm
In short this would be relatively safe unless the message m allows a lot of freedom. In that case you would have to worry (immediately) about the security of MD5. Using HMAC or SHA-3 would fix both the length extension as well as the MD5 related attacks on the MAC (if we just focus on the MAC anyway, I have no idea about the security of the rest of the protocol).
Nov
13
comment Verifiable, Distributed Secret Santa Assignments
I could think of a few mathematical solutions, but none would be verifiable by my family. I'm not sure how well educated your family is, but mine would consider it some kind of magic. In the end you'll have to trust the web interface. This is why I don't play poker online (and if I ever do, I'll make sure I'll be the "dealer").
Nov
13
comment Verifiable, Distributed Secret Santa Assignments
+1 festive question :) Funny enough, this makes me think about domain parameter generation for Elliptic Curves...
Nov
13
revised What is the use of segments in Cipher Feedback Mode (CFB)
removed speculation
Nov
13
comment RSA-KEM construction
I don't think it is a good idea to directly encrypt the random key. It should be a secret of sufficient length (i.e. at least twice the key size of the key and preferably the size of the modulus minus one bit or so). That secret should then be used in a KBKDF - as in the answer of Ruggero. If I'm not mistaken there is an attack by Boneh that would leave only half the key strength if a symmetric key is encrypted without padding.
Nov
13
comment AES with weak keys
This should also make the link you've provided easier to understand. This is about the key schedule itself, i.e. if AES actually has a weak key schedule that compromises the block cipher itself. That's different from low entropy keys as you mention in your question.
Nov
13
comment AES with weak keys
Note that the notion of "weak keys" has usually a different meaning in crypto. DES has weak keys: these are keys that will result in the block cipher itself providing less (or even no) security. AES in contrast does not have "weak keys". Your only option is to perform a weighted brute force attack; the algorithm itself hasn't become weaker by choosing specific key values. I would call this AES with keys that contain lower entropy.
Nov
12
answered Blowfish ECB mode: Tools for known-plaintext attack?
Nov
12
comment CSPRNG's (ELI5) What's the purpose of multiple seeds/ regenerating sources of entropy (i.e. /dev/random)?
I'll stop flagging for transfer on SO and ask persons to ask on the other side and delete the original. Normally you don't have to do anything once a question has been flagged, but it takes weeks if not months nowadays.
Nov
12
comment How a file is encrypted?
No hex editors are for debugging mostly. Even if they would provide crypto functionality it would not be for everyday use.
Nov
12
comment How a file is encrypted?
You have to open it in binary mode. How to do this depends on your language/runtime environment. Most runtimes should provide tutorials for this; opening files is rather common :) Note that in practice crypto is petformed on sets of 8 bits called octets or bytes.
Nov
12
comment How a file is encrypted?
The key stream is "only" generated for stream ciphers and block ciphers used in a mode of operation (e.g. CTR) that produces a key stream. The still very common CBC mode of encryption encrypts by splitting the plaintext/ciphertext in blocks and does not use XOR for the last step. Otherwise the answer seems well explained to me.
Nov
12
comment How a file is encrypted?
Yes, reading them in an array is one option. For larger files binary streams and memory mapping may be more efficient though.
Nov
12
comment How a file is encrypted?
Modern crypto algorithms all operate on bits. Even PBKDF2 - which is used to derive keys from passwords - operates on bits instead of text. In modern crypto, the terms plaintext and ciphertext are rather confusing as neither one of them are actually text, you actually need character-encoding such as UTF-8 to convert from text to binary and encoding schemes such as base 64 to convert binary to text. So in that sense encrypting a file is actually easier as no encoding needs to be applied.
Nov
12
revised What is the use of segments in Cipher Feedback Mode (CFB)
added 23 characters in body