4,228 reputation
731
bio website
location Netherlands
age 40
visits member for 2 years, 9 months
seen 10 hours ago

Java and security expert with over 10 years of experience with the language and with the practical application of cryptographic protocols - including the design of protocols within international standardization bodies. Creator of a heavily used common criteria certified product. Over 30 years of experience with computers. Likes kids, cats, reading, movies and several sports.


10h
comment CBC-MAC based on PRF
Did a bit of research, but this algorithm goes back to FIPS 113 (1985), and that "standard" does not do too much reasoning. OMAC and CMAC papers don't list the reason either. So the best answer may be that it uses a PRP because if it was a PRF, it would be a HMAC :P
10h
comment CBC-MAC based on PRF
Why not? Most of the time a PRP is faster, and it is nice if you can use the same primitive for both confidentiality and integrity/authenticity (e.g. CCM & EAX mode of encryption).
16h
comment Are partial hashes used in cryptographic protocols?
@tylo Well, for security tokens/smart cards there is PIN or biometric authentication. That's some kind of "user consent". I agree that there is still plenty that can be done by a malicious terminal though; that's actually one of my peeves against this kind of security - at some point in time you need to trust the terminal anyway. I mean, if a covert channel is possible, then it is also possible to sign any other content, which is much worse.
17h
comment Are partial hashes used in cryptographic protocols?
@tylo Agreed. And it would be rather easy to couple data or meaning to a hash as well. I think you need to be able to trust the data you are signing. The question is then if the partial hash is adding security or not. Of course, a covert channel in signed data is of more importance than a covert channel elsewhere (as there is user consent to create the signature, possibly at a specific time/place).
1d
comment Are partial hashes used in cryptographic protocols?
Edited the question to make it less "opinion based".
2d
comment How should I treat a new cipher release like Spritz?
Added some Spritz related information; interesting cipher indeed. Drop in replacement for RC4 and it resembles a sponge.
2d
comment practically verifying block ciphers strength
I've voted to close as it is now impossible to tell what is asked by now. Asking for tool references seems to be off topic as well.
Aug
29
comment Why do new versions of TLS use an explicit IV for CBC suites?
@imichaelmiers Looking back at this old comment; I guess using a secure random value as IV introduces more overhead than calculating one using symmetric primitives on most systems (i.e. where no hardware support is present).
Aug
29
comment Are there other digital certificate formats than X.509?
Or more concisely, I think it says that X509 certificates are generic certificates that are not tied to a particular use. I think the last sentences are a bit misleading. If I buy a digital certificate for a server, it does not make sense to use it to sign word documents as well. You can certainly make clear in how a certificate should be used within the certificate itself. The format is generic, the certificate itself may be particular to a use case.
Aug
28
comment Choice of authenticated encryption mode for whole messages
greed, 1 $1/2$ pass seems reasonable. I'm on CET as well, e-sushi. Germany and the Netherlands are quite close by :) Goodnight!
Aug
28
comment Choice of authenticated encryption mode for whole messages
GCM is a two pass scheme as well. Maybe it doesn't use a block cipher for the second pass, but that does not make it a single pass scheme in my mind (nor to the EAX authors, apparently "More recent still is GCM [22], a parallelizable, two-pass design based on multiplication in the finite field with 2128 elements.")
Aug
28
comment Can Bitcoin HD public keys be used for symmetric encryption?
It is always a good idea to use a KBKDF (such as HKDF, which indeed uses a hash function) over any secret before you use it as a key. I won't put this as an answer as I don't know the BitCoin model.
Aug
28
comment Proving HMAC collision probability bounds?
Made some edits, hope they are correct. Could you check?
Aug
28
comment Is hashing a list of hashes safe?
@otus Git hashes over a set of files. I presumed in my answer that the order is not significant, otherwise sorting would not make sense in the first place. Of course, after sorting, the initial bits of the hash value in the sequence are convergent, but that shouldn't matter for reasonably sized hashes. Unfortunately I'm not sure if I can easily express that mathematically.
Aug
27
comment why should one use lattice-based systems in travel documents in post- quantum computers era?
I think we would be too busy with rebuilding the complete PKI used by the internet to worry about ePassports, personally. Besides, I think you are showing a gross misunderstanding about the capabilities both of the standardization committees as well as those of smart card IC's.
Aug
27
comment Partial hash code protocol for security tokens providing signatures
As for the first remark: I guess that the benefit to the (holder of the) security token is that it is guaranteed that only hash values are used as input to the rest of the signature scheme.
Aug
27
comment Is using EAX mode with a 64-bit block cipher a bad idea?
@CodesInChaos OK, thanks. I think you understood my question sufficiently to answer. Interesting thought about the 256 bit blocks size for cipher. I'm mostly on embedded, so ciphers not being a available is/was something to consider, unfortunately.
Aug
26
comment EAX: OMAC and CMAC
Note that, in above quotations, OMAC itself seems to be a generic term for OMAC1 and OMAC2 according to Iwata and a refinement of OMAC according to NIST. I'll just call it CMAC from now on.
Aug
26
comment Is using EAX mode with a 64-bit block cipher a bad idea?
@CodesInChaos In contrast to D.W.'s answer, do you think there is still an argument in favor of using a 64 bit block cipher with EAX mode of operation (when a 128 bit block cipher is not available)?
Aug
26
comment EAX: OMAC and CMAC
It's always hard to argue against quotes straight from the source(s)... thanks.