Reputation
4,176
Next tag badge:
98/100 score
16/20 answers
Badges
1 9 30
Newest
 Pundit
Impact
~92k people reached

Aug
30
comment Meet-in-the-middle with checking complexity
Keywords are "asymptotic complexity" and "order of magnitude".
Aug
27
comment Why restricting SHA3 to have only two possible capacities?
Simplicity, perhaps.. a standardized algorithm needs to be simple, have few configuration options so that it can't be "used wrong", and to minimize support and transition costs. Applications which want more can always use the full version.. it doesn't just disappear because NIST chose to make some changes.
Aug
27
comment RC2, RC4, RC5 key length
Perhaps you should reformulate the "even number of bytes" statement into, for instance, "integral number of bytes". When I read it I initially thought you meant RC4 needed a key length multiple of 16 bits and was confused.
Aug
27
comment Should I delete cryptographic data from memory?
Number 2 is particularly important. For instance you can look at how OpenSSL does it, by doing strange operations on the data to overwrite to trick the compiler into randomizing it even though it will never be used later on (for higher level languages this may well be impossible to achieve). There is indeed no generic solution.
Aug
25
comment Would this simple encrypted chat program be feasible using One Time Pads?
Please do not deface your own question, it makes the whole thread incomprehensible for readers and wastes everyone's time. If you want to delete your question, please cleanly flag it for moderator attention indicating you want it deleted.
Aug
23
comment Keepass Twofish plugin security
Looking at the code again, I think this actually isn't a problem. I am not familiar with how Keepass handles plugins but I would expect it to pass its own generated key/IV's to the underlying plugin rather than let it generate them itself (see the EncryptStream() method, public and hence exported from the plugin, taking pbKey and pbIV as arguments). In that case the dummy implementations above exist only to satisfy the contract of the C# SymmetricAlgorithm interface. Though it would be better to properly implement them to be able to reuse the Twofish implementation elsewhere....
Aug
22
comment Is it theoretically possible to construct a string that contain its own hash value?
Are you asking about whether for any such string, there exists one (or more) possible "hash values" satisfying this condition, or whether for an arbitrary "hash value" you can find a string of a given length satisfying the condition? Or both?
Aug
19
comment Am I insecurely implementing AES in Python?
@Alex Hardly...
Aug
16
comment One Time Pad Question
You may want to reread the question, which was how to find the key (pad) which will map a given ciphertext to a given plaintext (or a given ciphertext to meaningful plaintext for some definition of "meaningful", not sure how best to interpret it).
Aug
11
comment How does DES decryption work? Is it the same as encryption or the reverse?
@fgrieu No, it does not apply directly to DES, but it applies directly to the question at hand, which is "why is it not necessary to invert the one-way function to invert a DES round".
Aug
11
answered How does DES decryption work? Is it the same as encryption or the reverse?
Aug
9
comment why AKS is so slow in practice?
@nightcracker Yes, on second thought that would make sense. Still I think I agree more with poncho, that the error rate is lower-bounded by the probability of a hardware failure, so Miller-Rabin with a theoretical failure probability lower than that bound is in a practical sense "as accurate" as AKS (in other words, optimal). Both are not mutually exclusive, of course, but the running time of AKS would seem to not really be a strong argument given that nobody really uses it in practice anyway.
Aug
9
comment why AKS is so slow in practice?
I think it runs in $O(n^6)$ which while polynomial, is still horribly slow for even reasonably sized inputs, say $n = 2048$ (bits). Being polynomial time isn't the whole story, consider an algorithm with running time $O(n^{10^{1000}})$, sure it's polynomial time but is it really of any use? I have no idea what hardware errors have to do with this. No algorithm is immune to hardware failure.
Aug
7
comment Allowing the user to choose the hashing formula at the registration
In addition this leaves open the possibility of social engineering where someone goes around saying "hey, use "MD5/nosalt" on [the website]", it's much better than the alternatives, decreasing overall security (because most users are gullible).
Aug
6
comment How secure would this code be against cryptanalysis?
@rath Ah, that makes sense, thanks.
Aug
6
comment How secure would this code be against cryptanalysis?
@rath Are you saying side-channel attacks are off-topic?!
Aug
6
comment Achieving 256-bit encryption strength with PBKDF2 - HMAC-SHA1
@Ninveh As an addendum - you cannot increase the entropy of your input by feeding it through a deterministic function. You can only keep it the same (if your function is bijective) or decrease it (if your function isn't). It's kind of like the laws of thermodynamics, you can't break even, you can never win, and you must play the game :p (that's also why it's called entropy ^^)
Aug
1
comment What exactly is the base for the KECCAK (SHA3) claim that a security strength of 256 bits is “post-quantum sufficient”?
I guess they meant "post-quantum sufficient with our immediate understanding of quantum technology", which, when you think of it, is pretty reasonable, contrasted with how classical algorithms are deemed "secure" when they really are "secure against current known cryptanalytic techniques". But it's hard not to speculate when it comes to quantum cryptography - nobody knows for sure, and nobody is using quantum crypto anyway, so it looks good to add that to the list. I suppose that was the rationale, anyway.
Jul
30
comment Algorithm/Technique for Steganography
There's also a lot more to steganography, including: it needs to be resistant to statistical analysis on the carrier (your alpha value scheme would instantly fail here), and it needs to be resistant to transformations, meaning the payload should be able to be preserved to some extent if the image ends up compressed, resized, or otherwise altered on a reasonable scale (probably via redundancy). But it depends how much secrecy you really need. Ultimately, given enough samples and a specific carrier distribution, any steganographic scheme can be detected, you want to make it very hard to do so.
Jul
30
reviewed Approve Abstracting primitives and modes of operation