2,552 reputation
622
bio website
location Netherlands
age 40
visits member for 2 years, 4 months
seen 2 hours ago

Java and security expert with over 10 years of experience with the language and with the practical application of cryptographic protocols - including the design of protocols within international standardization bodies. Creator of a heavily used common criteria certified product. Over 30 years of experience with computers. Likes kids, cats, reading, movies and several sports.


2h
comment Security of KDF1 and KDF2 (hash based KDF's)
@CodesInChaos Yeah, I figured as much. Otherwise HMAC did not need to have additional passes. But most (if not all) of the time the input is just a key seed or an actual key, so length extensions are generally not applicable, at least not as far as I can see...
1d
comment Cryptographic library quality
Because it takes a lot of resources away from actually developing the library. They are paper procedures mostly. Furthermore, FIPS and CC (CC much more so) have the nasty side effect that they do not promote updates to libraries.
1d
comment Relation between key size and PRNG state size
Then again, generating a 1024 key in itself is not fine, that key size should no longer be used.
1d
comment Cryptographic library quality
There is no answer here that is not at least opinionated. After the last debacle using a non-managed language (read: one that not intrinsically protects against buffer overflows), I would not consider anything in C. As Botan is object oriented C++ it would come slightly closer. FIPS certification is clearly not enough; it may even be detrimental to perform certification.
1d
comment Security of KDF1 and KDF2 (hash based KDF's)
Hopefully it does not matter if $c$ is signed or unsigned, of course :P. Maybe the security of the KDF can be directly mapped to a hash vs HMAC comparison?
1d
comment Questions about Key Derivation Functions
I think you should use HKDF (or a KDF from NIST SP 800-108) if you require a KBKDF (key based KDF) and PBKDF2 if you require a PBKDF (password based KDF) that performs key stretching. You don't need a PBKDF2 (or salt nor iterations) if you already have a key / secret with enough entropy.
Mar
31
comment How can I convert a DER ECDSA signature to ASN.1?
Note that for Java, you can simply perform new BigInteger(1, byte[] r).toByteArray() as the default Java encoding of a BigInteger is identical to the ASN.1 encoding of INTEGER.
Mar
18
comment Why is H(k||x) not a secure MAC construction?
Thanks I knew by now how Keccak behaves of course, but I forgot to add the information myself.
Mar
17
comment Modular protocol design
I would pass on that last question as well, it would be highly debatable - you cannot prove if something has a modular design or not. E.g. "has a clear goal" is highly subjective. If this question is asked for a test you should give your own opinion and reasons why you think it is or is not modular instead. Then the given reasoning behind your decission could be evaluated.
Mar
17
comment Elliptic Curves of different forms
In your openssl example you use "binary curve" twice. Is that intended or a typo?
Mar
17
comment Hash Based Encryption (fast & simple), how well would this compare to AES?
In general, hash functions are not fast compared to block ciphers. So at least the fast part is incorrect, and I'm not sure this is more simple than e.g. AES-CTR, which does approximately the same thing while using a block cipher.
Mar
17
comment Hash Based Encryption (fast & simple), how well would this compare to AES?
@fgrieu That's the answer, not a comment :)
Mar
3
comment How do process calculi, CSP, Promela, … compare?
I've marked this as not an answer PulpSpy. Probably you did not have enough rep. back in the day. You may want to delete this brand spanking old post :)'
Mar
2
comment Would it be secure to use random numbers from random.org in a cryptographic solution?
OK, but we cannot be assured either that random.org does not repeat its random stream on a reboot etc. That would preclude a lot of the above use cases. Basically, we can only hope that random.org is valid from what is pronounced at the front page. That's simply not enough.
Feb
25
comment Using ECDSA keys for encryption
@tylo Setting up an additional PKI structure is not irrelevant though. Of course, if you start up fresh you should definitely create a separation between the two.
Feb
17
comment GCM encryption for 256-bit and 512-bit block ciphers
@CodesInChaos The question becomes: what use is a larger block size and if we need a larger block size for security, shouldn't we also increase the security of the authentication tag?
Feb
15
comment How unsafe is to share parts of a password
If a salt is being used, I would say that a hash or a "professional" PBKDF is very likely to be used, yes.
Feb
14
comment Why is a 2048-bit public RSA key represented by 540 hexadecimal characters in X.509 Certificates?
You'll be surprised if you see the PKCS#1 version of a private key. Normally that one has the modulus, the private exponent, the public exponent and normally all CRT parameters as well. Plus DER overhead of course. And - if used - the overhead of the various container formats.
Feb
12
comment Is this approach to generating a “random” number from a sha512 hash effective?
Cross posted to stackoverflow.com/questions/21695256/… where I've given a more PHP/programming related answer. Please do not cross-post.
Feb
12
comment Current standard for hash function security parameter?
I'm feeling like one of these small clean up fishes swimming after the shark now :)