5,070 reputation
1734
bio website
location Netherlands
age 40
visits member for 2 years, 11 months
seen 4 hours ago

Java and security expert with over 10 years of experience with the language and with the practical application of cryptographic protocols - including the design of protocols within international standardization bodies. Creator of a heavily used common criteria certified product. Over 30 years of experience with computers. Likes kids, cats, reading, movies and several sports.


1d
comment Encryption algorithm designed to be easy to decrypt by machine but impractical to decrypt by hand
I would have no problem encrypting and afterwards decrypting the byte value 01 by hand. You need padding for RSA. Downvoting until this is resolved.
2d
comment Encrypting twice with same key gives back plain text
@squeamishossifrage OK, I was still wrong footed. This is not going to answer the question, $E_k$ itself must be a block cipher that is involutional.
2d
comment Encrypting twice with same key gives back plain text
Does involutional (SPN) cipher fit your bill?
2d
comment Encryption algorithm designed to be easy to decrypt by machine but impractical to decrypt by hand
@DmitryKhovratovich "...does not use variable keys..." Monty, do you mean that you want to use a fixed key value or a fixed key format?
2d
comment Encryption algorithm designed to be easy to decrypt by machine but impractical to decrypt by hand
@Thomas Don't see why you cannot use full RSA encryption that includes cryptographically safe padding (PCKS#1 v1.5 or even better OAEP) that contains a random element to it. In that case it is impossible to create meaningful tables. Note that just concatenating RSA does not protect against replay attacks nor does it provide integrity.
Oct
28
comment What is a vanishing trapdoor?
I wonder if there is a explain-like-I-am-five on quantum mechanics as well.
Oct
28
comment RSA CRT modulo reduction
@fgrieu Is that a possible answer?
Oct
27
comment ANSI X9.31 standards for generating random numbers
NIST now explicitly documents that you have to use an RNG from SP800-90A (in FIPS 186-4 for RSA signature generation).
Oct
27
comment Advantages of combined PRNGs
@maaartinus That particular issue would be avoided by adding real entropy to the stream as well. But I agree, it could also be avoided by mixing in a PRNG that was seeded with such entropy. Theoretically speaking, the PRNG wasn't the issue.
Oct
26
comment Is it safe to salt a MAC?
I don't think this is a problem when you use two separate keys and encrypt-than-MAC. If unsure, rely on HMAC instead.
Oct
26
comment Is it safe to salt a MAC?
You shouldn't be using CBC-MAC at all. Use the derived CMAC algorithm instead.
Oct
26
comment Is it safe to salt a MAC?
No, it doesn't. You may as well use a zero nonce. If, as you suggest, the salt changes for each encryption then the key changes for each encryption. If that's true, even a zero IV is already unique for the key. If the salt doesn't change, then the salt is not unique for the generated key as the same key is derived from the same salt and password.
Oct
26
comment Is it safe to salt a MAC?
If an IV is used for an underlying block cipher mode then it makes sense to MAC the IV along with the ciphertext. I agree with Travis that MAC'ing the salt doesn't seem to add any security.
Oct
25
comment Use case of RSA CRT
@fgrieu I've seen the same validation requirement for straight RSA as well. In general it makes sense as signature verification is relatively fast.
Oct
25
comment What do you call one time pad where pseudo-random numbers are used?
I like this question. It's simple, but seeing the number of questions on SO that confuse a OTP and stream cipher, it can be a good reference to use within comments and answers.
Oct
24
comment Secure way to derive separate encryption and MAC keys from a single master key?
@RickyDemer Hmm, hard to put in words, tried "if larger input is allowed".
Oct
24
comment Does the size of a SSH ECDSA key determine the hash algorithm?
@otus I was wondering, so I provided the answer myself and flagged it for transfer to IT security.
Oct
24
comment Secure way to derive separate encryption and MAC keys from a single master key?
@RichieFrame Let us agree that it is fast (especially on 64 bit) and secure, but that it doesn't scale well :)
Oct
24
comment Secure way to derive separate encryption and MAC keys from a single master key?
I toned that down somewhat and expanded the answer. I based that assumption on that of Ilmari who supplied the other answer. Nevertheless, KDF1/2 are used in practice and I've not seen any attacks on it either.
Oct
24
comment Operation which needs much computing power to be created, but just a little to be solved?
I'd like to answer, but I've got a sudoku to solve.