3,442 reputation
628
bio website
location Netherlands
age 40
visits member for 2 years, 7 months
seen 5 hours ago

Java and security expert with over 10 years of experience with the language and with the practical application of cryptographic protocols - including the design of protocols within international standardization bodies. Creator of a heavily used common criteria certified product. Over 30 years of experience with computers. Likes kids, cats, reading, movies and several sports.


Jun
23
comment DH “prime size” security in OpenSSL
At work, so I cannot look up the constants, but I'm pretty sure the security of DH also depends on the parameter which is now 5 in the question (sub-group?).
Jun
23
comment Deriving 2 keys using HKDF
HKDF is of course the latest/greatest method to do KBKDF calculations, but you may consider using KDF1 instead. That will mean you are using a less secure KDF, but you would be using it in the way that is intended to be used. Using a NIST specified KDF in counter mode (NIST SP 800-108 if I'm not mistaken) using AES may also speed up your KDF, especially on systems that have AES instructions on the CPU.
Jun
23
revised Deriving 2 keys using HKDF
deleted 14 characters in body
Jun
23
answered Deriving 2 keys using HKDF
Jun
22
comment Is either brainpoolP320r1 or brainpoolP320t1 a SafeCurve?
The generation of the parameters is not fully according to SafeCurve standards either. It's considered better than the (completely unspecified) method that NIST / Certicom curves have used to generate the curves, but it cannot be verified that there was no attempt to steer the values one way or another - it's just likely that they haven't been tampered with.
Jun
22
comment How do I decide what mode to use?
If a table is created, then you need to be able to understand the table. E.g. "succeptible to padding oracle attacks (Y/N) is nice", but you would have to understand padding mode attacks. In that case you are very likely to understand the crypto modes already.
Jun
22
revised How do I decide what mode to use?
forgot to exclude ECB
Jun
22
answered How do I decide what mode to use?
Jun
21
comment Using PBKDF2 twice with different argument order
Wanted to answer, but it says that x is stored, as I currently read it, that's the password. Could you make the question even more clear? Possibly, use specific variable names or assign the password and salt to the right variables.
Jun
20
reviewed Leave Closed RSA: Common modulus attack problem
Jun
18
comment Using PBKDF2 twice with different argument order
XCore: if a and b are keys, then what do you mean with "a and b are also stored"?
Jun
18
comment Using PBKDF2 twice with different argument order
@StephenTouset and Poncho: bad ideas, both require the PBKDF2 to be used for separate number of iterations. This means an attacker has to do less rounds than the user of PBKDF2. Better to use a KBKDF (such as HKDF) on the output of PBKDF2, once for the encryption key and one for the auth key.
Jun
15
comment Why does AES-GCM need MAC? (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
Usually it's appended, as you require all ciphertext and AAD to be present to verify the authentication tag. The location does not matter, as long as the ciphertext and tag are strongly linked together. Otherwise you may be performing authentication on one and decrypting another.
Jun
15
comment Leak-proof protocol: is such a thing possible?
I guess you would have to literally lock somebody up, and alice would be talking to a "lawyer" that is trusted by alice and bob alike. That's a use case, but it is a pretty restricted one.
Jun
14
reviewed Close RSA decrypting of a huge file by parts
Jun
13
comment Why does AES-GCM need MAC? (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
@MattNordhoff Thanks, answer edited.
Jun
13
revised Why does AES-GCM need MAC? (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
added final MAC
Jun
12
comment What are the consequences of not checking the server mac in a TLS connection?
Depends on the reader maybe, but this question would be hard to answer without reading the source material in my opinion. That's OK though, it's just 6 pages. Peanuts for most of us :)
Jun
12
answered Why does AES-GCM need MAC? (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
Jun
12
comment which of these is more secure (bcrypt vs srp)
Yeah, I thought the exact same thing after I wrote it up; the attacker won't be able to use a dictionary attack that way. Just to be sure, it could be useful to use salt on both client and server. Creating a rainbow table for random data does not sound useful, but better safe than sorry.