2,563 reputation
623
bio website
location Netherlands
age 40
visits member for 2 years, 4 months
seen 2 mins ago

Java and security expert with over 10 years of experience with the language and with the practical application of cryptographic protocols - including the design of protocols within international standardization bodies. Creator of a heavily used common criteria certified product. Over 30 years of experience with computers. Likes kids, cats, reading, movies and several sports.


11m
comment HKDF vs TLS PRF. Which of the one is better?
So you can validate your implementation (say, HSM) to be FIPS compliant, but please don't try to find 2 vendors that implement exactly the same KDF :( Reporting this to NIST resulted in a clear "MEH" from NIST
14m
comment HKDF vs TLS PRF. Which of the one is better?
Note that the NIST SP 800-108 specs are more or less used to cover all secure KDF's that are allowed. I've created generic implementations of them and tested them against the test vectors. Those test vectors are not covering everything and are already multiple MB's for each KDF construction that is defined. Specifying the practical security level of NIST SP 800-108 is a moot point; there are too many variables. Heck, the KDF's don't even have official names let alone ASN.1 definitions or OID's.
4h
comment How does the key schedule of Rijndael looks for keysizes other than 128 bit?
@goldroger Use a KDF...
23h
comment How can I generate a brief (100) stream of random numbers, not using the computer or throwing dice?
You may not intentionally cheat, but just be compelled to round off to e.g. half centimeters. If you do a lot of measuring, you will notice that this is quite a strong tendency. Besides that, a long jump requires a lot of equipment to be in place, and 100 jumps are not healthy. Gosh, you were not joking.
1d
comment HMAC definition by using only one key
Welcome to crypto, Snox.
1d
comment How can I generate a brief (100) stream of random numbers, not using the computer or throwing dice?
Too easy to measure incorrectly - people are bad measurers, they tend to cheat, round off, etc. Besides, we are cryptographers - have you ever seen one of us jump? Removed downvote, probably a joke :)
1d
comment Burn after read algorythm. Software verification on compromised environment. Software smart card
@mikeazo In short: a method of calculating a checksum without a (practical) possibility for an attacker to alter the memory in such a way that the same checksum is obtained. (yawn)
1d
comment Is it necessary to use single hash function for signature generation and HMAC?
@MattNordhoff fortunately upvotes and downvotes only cancel each other out with regard to the answer, upvotes win from downvotes hands down regarding rep. Of course, if you are like me, that does not mean much, but it should keep you from becoming CodesInChaos :P
1d
comment Encryption mode with chained algorithms
Nice, you cannot go much deeper without getting your feet really wet :P
2d
comment Leaving authentication data blank less secure for AES GCM?
Note that the IV does not need to be part of the AAD for GCM mode encryption. It is required for CBC/HMAC schemes, so the inclusion of the IV in the associated data depends on the protocol.
2d
comment Security of KDF1 and KDF2 (hash based KDF's)
@CodesInChaos Yeah, I figured as much. Otherwise HMAC did not need to have additional passes. But most (if not all) of the time the input is just a key seed or an actual key, so length extensions are generally not applicable, at least not as far as I can see...
Apr
20
comment Cryptographic library quality
Because it takes a lot of resources away from actually developing the library. They are paper procedures mostly. Furthermore, FIPS and CC (CC much more so) have the nasty side effect that they do not promote updates to libraries.
Apr
19
comment Relation between key size and PRNG state size
Then again, generating a 1024 key in itself is not fine, that key size should no longer be used.
Apr
19
comment Cryptographic library quality
There is no answer here that is not at least opinionated. After the last debacle using a non-managed language (read: one that not intrinsically protects against buffer overflows), I would not consider anything in C. As Botan is object oriented C++ it would come slightly closer. FIPS certification is clearly not enough; it may even be detrimental to perform certification.
Apr
19
comment Security of KDF1 and KDF2 (hash based KDF's)
Hopefully it does not matter if $c$ is signed or unsigned, of course :P. Maybe the security of the KDF can be directly mapped to a hash vs HMAC comparison?
Apr
19
comment Questions about Key Derivation Functions
I think you should use HKDF (or a KDF from NIST SP 800-108) if you require a KBKDF (key based KDF) and PBKDF2 if you require a PBKDF (password based KDF) that performs key stretching. You don't need a PBKDF2 (or salt nor iterations) if you already have a key / secret with enough entropy.
Mar
31
comment How can I convert a DER ECDSA signature to ASN.1?
Note that for Java, you can simply perform new BigInteger(1, byte[] r).toByteArray() as the default Java encoding of a BigInteger is identical to the ASN.1 encoding of INTEGER.
Mar
18
comment Why is H(k||x) not a secure MAC construction?
Thanks I knew by now how Keccak behaves of course, but I forgot to add the information myself.
Mar
17
comment Modular protocol design
I would pass on that last question as well, it would be highly debatable - you cannot prove if something has a modular design or not. E.g. "has a clear goal" is highly subjective. If this question is asked for a test you should give your own opinion and reasons why you think it is or is not modular instead. Then the given reasoning behind your decission could be evaluated.
Mar
17
comment Elliptic Curves of different forms
In your openssl example you use "binary curve" twice. Is that intended or a typo?