3,679 reputation
630
bio website
location Netherlands
age 40
visits member for 2 years, 8 months
seen 6 hours ago

Java and security expert with over 10 years of experience with the language and with the practical application of cryptographic protocols - including the design of protocols within international standardization bodies. Creator of a heavily used common criteria certified product. Over 30 years of experience with computers. Likes kids, cats, reading, movies and several sports.


12h
comment Is Encrypt+HMAC stronger than AEAD?
Same of course for challenge response protocols, if the challenge is indeed random, then side channel attacks won't be much help.
12h
comment Is Encrypt+HMAC stronger than AEAD?
What I'm missing from this answer is the part that the protocol plays in all this. There are plenty protocols where a single incorrect MAC would stop the protocol, delete the session keys and then require re-authentication. It's rather tricky to retrieve side channel information that way. You need some kind of oracle for this to be practical.
15h
comment How many RSA keys before a collision?
Thanks (also for the excellent answer of course). I've changed it to factors within the calculations. And there is me nitpicking on the comment in the answer that was there to avoid nitpicking :)
1d
comment Whitening and randomness extraction
@l19 Really? I would not want to have randomness extraction at a dentist :)
1d
comment Create multiple IV's from shared secret
@otus Bandwidth constraints for the question that I've referred to. Possibly the absence of a fast RNG (although that could be mitigated by using the CSPRNG seeded by the output of the slower RNG, I guess).
2d
comment SHA-256 RSA signature algorithm has thumbprint algorithm value as SHA-1. Is that valid?
The other fields are all part of X5.09v3 certificates, that's for sure. In Windows the SHA-1 algorithm is always used to create a thumbprint of the certificates.
2d
comment How many RSA keys before a collision?
Hi Codes, I've edited your anwer to make it easier to read / understand. However, could you explain what you mean with "I neglected a few small factors, but that's pretty irrelevant". I presume you mean that you didn't completely describe all the steps performed for key pair generation. But "factors" is also a mathematical term...
2d
comment Test Vectors for ciphers
The standard organizations, especially ISO, should take more care with this regards and only standardize algorithms and protocols that supply a full suite of test vectors.
Jul
29
comment Is it secure to use Diffie-Hellman key agreement to generate a nonce?
But the fact remains that the nonce does not have to be kept secret, and that GCM authentication already includes the nonce. In the end, just sending the nonce (at startup & when sync fails) is a whole lot less overhead than performing DH, both with regards to computation time and message size.
Jul
29
comment Is it secure to use Diffie-Hellman key agreement to generate a nonce?
With once I mean in the initial message. If you can keep the number synchronized then you don't need it afterwards. Note that if you have a message counter somewhere you already have a nonce. Even if not present, it's a good idea to make sure that the nonce is taken into account in the authentication tag. Heh, forgot that this is already the case for GCM mode of authentication.
Jul
29
comment Is it secure to use Diffie-Hellman key agreement to generate a nonce?
The "key pairs" used for the Diffie-Hellman protocol. If you generate new x and y each time, it would be an ephemeral-ephemeral DH protocol, and you would be OK. As for the bandwidth, just sending over the (authenticated) nonce/IV once seems less overhead than a full DH protocol to me.
Jul
28
comment Is it secure to use Diffie-Hellman key agreement to generate a nonce?
Welcome in advance to crypto, Yoav R. :) I've removed the general description of Diffie-Hellman from your question, the people here will know what you are talking about.
Jul
28
comment CSPRNG that cannot be used as random extractor
@D.W. Don't go into overdrive now. I presumed (and the link to 90A kind of points this out) that CTR_DRBG was meant. It is specified in 10.2.1 of that document. This seems to be a CSPRNG to me, including seeding and reseeding and whatnot. Of course, you could wonder if the reseeding process cannot be used to add in additional entropy. Otus, could you point to this paragraph and name instead of AES-128 CTR CSPRNG (if I'm correct)? That does not seem to be the official name.
Jul
28
comment CSPRNG that cannot be used as random extractor
@D.W. Was that a multiple choice question? For the latter - at least AES-CTR, they are OK if you have a fully random seed as key I suppose.
Jul
28
comment CSPRNG that cannot be used as random extractor
@D.W. Something like Yarrow yes (although I don't know why you came up with that particular one), as indicated I started off from the Wiki page, which states that a CSPRNG has some properties that may not be compatible with a randomness extractor. Actually they seem quite different to me, but I guess you can still use a CSPRNG for practical post processing of random entropy, if the CSPRNG allows it. Hence I left the question open. /dev/urandom is not an algorithm and a block cipher in counter more or a stream cipher can only be building blocks for CSPRNG's it seems to me.
Jul
28
comment OTT service using FPE
@e-sushi I guess that if the size of the stream does not have to be maintained that there would be room for such a thing. Obviously it would not be easy to create, and anybody listening in would likely either hear a lot of noise or - if stenography is also used - a receive a very large stream.
Jul
28
comment Implementing CD serial key system
@RickyDemer It seems that the threshold was more about splitting the signature in multiple parts. I don't think that counts as threshold-crypto, so I removed the tag.
Jul
28
comment CSPRNG that cannot be used as random extractor
Your answer has a lot more information than the one of Otus, and as learning is concerned it is of more value. However, I think otus came closer with regards to providing an answer. +1 none-the-less of course.
Jul
28
comment Whitening and randomness extraction
I guess without format definition of "whitening" this is the best it can get...
Jul
28
comment Whitening and randomness extraction
@D.W. That's probably part of my problem. Up to now I had in mind that whitening is something that is a relatively simple method such as performing a XOR on the output of one or two RNG's, but I sometimes see it use as a more general method of (at least) creating a good distribution of values given by an RNG.