4,946 reputation
1734
bio website
location Netherlands
age 40
visits member for 2 years, 11 months
seen 9 mins ago

Java and security expert with over 10 years of experience with the language and with the practical application of cryptographic protocols - including the design of protocols within international standardization bodies. Creator of a heavily used common criteria certified product. Over 30 years of experience with computers. Likes kids, cats, reading, movies and several sports.


2h
comment What do you call one time pad where pseudo-random numbers are used?
I like this question. It's simple, but seeing the number of questions on SO that confuse a OTP and stream cipher, it can be a good reference to use within comments and answers.
20h
comment Secure way to derive separate encryption and MAC keys from a single master key?
@RickyDemer Hmm, hard to put in words, tried "if larger input is allowed".
23h
comment Does the size of a SSH ECDSA key determine the hash algorithm?
@otus I was wondering, so I provided the answer myself and flagged it for transfer to IT security.
1d
comment Secure way to derive separate encryption and MAC keys from a single master key?
@RichieFrame Let us agree that it is fast (especially on 64 bit) and secure, but that it doesn't scale well :)
1d
comment Secure way to derive separate encryption and MAC keys from a single master key?
I toned that down somewhat and expanded the answer. I based that assumption on that of Ilmari who supplied the other answer. Nevertheless, KDF1/2 are used in practice and I've not seen any attacks on it either.
1d
comment Operation which needs much computing power to be created, but just a little to be solved?
I'd like to answer, but I've got a sudoku to solve.
1d
comment HMAC_DRBG Generate Process: requesting N bytes at once different from requesting N bytes in total?
Whoops, waited a bit too long for other possible answers, sorry about that :)
1d
comment What are the advantages of Certificate Authority and Key Distribution Center over each other?
It depends on what you want to achieve I guess. Wikipedia defines "In cryptography, a key distribution center (KDC) is part of a cryptosystem intended to reduce the risks inherent in exchanging keys. KDCs often operate in systems within which some users may have permission to use certain services at some times and not at others." That's different from a CA, which simply signs certificate requests, giving certificates with public keys that are available for (usually) a longer period of time. So there are differences, what is unclear?
2d
comment Secure way to derive separate encryption and MAC keys from a single master key?
Yes that's kind of possible, but scrypt was created to do key stretching using a work factor (and, in the case of scrypt, a large internal state). Usually it is possible to use a Password Based Key Derivation Function (PBKDF) instead of a Key Based Key Derivation Function (KBKDF), which is what is required.
2d
comment Secure way to derive separate encryption and MAC keys from a single master key?
@RichieFrame That's likely secure and likely the fastest method as well, but it doesn't scale with the size of the keys, hash or number of keys that required. Using a well defined KDF should be preferred IMHO.
2d
comment How to guess the encoding of a string?
Oh, toons in PNG format. Hint: first concatenate all the stings, then split on =. Then decode and save. There is an additional header that you may want to cut away. And it could be that there is no = delimiter. In that case you may get multiple files after each other. Good luck.
2d
comment Rijndael performance
@otus I think it means operations, but that does not make much sense over operations per second. So I'll leave it to the user to explain.
Oct
21
comment The security of an encrypt-and-MAC
A few remarks: the ciphertext itself is not protected, so this scheme could be vulnerable to padding oracle attacks - they are not prevented by this protocol in itself. Furthermore, having a HMAC over just the plaintext is a bit dangerous, usually you want to at least include the IV in the MAC calculation - if it is used and send with the ciphertext. If other protocol information and the IV is included in the MAC calculation then I guess you can alleviate the requirement to separate keys per transaction.
Oct
21
comment Verify signed file using GPG by passing in signature hosted online rather than stored locally (i.e. in keyring)?
What about wget or a similar cli utility?
Oct
20
comment Protection of Elliptic Curve Implementations against side-channel attacks
@CodesInChaos You are probably right, but does it invalidate the question enough to close it?
Oct
20
comment Cryptography system that limits the length of the encypted message
Thank you for telling me all that, Tianren Lu, I never would have guessed.
Oct
19
comment Cryptography system that limits the length of the encypted message
Sorry, but a one time pad is basically a theoretical construct. Using it for a practical application such as SMS encryption is not a good idea. Using a stream cipher could work, but you would make sure that both sides stay in sync somehow.
Oct
19
comment Implementation of garbled circuits using RSA
@ThomasM.DuBuisson Maybe change that into an answer? Negative answers are answers just as well.
Oct
19
comment problem with “one time pad”
This is pretty well explained by - for instance - Boneh, isn't it? The idea of such practice is that you learn to do this yourself.
Oct
19
comment SHA-1 collision resistance
Anything missing from the given answer, dear new user? It's been a while.