Reputation
4,243
Next tag badge:
101/100 score
17/20 answers
Badges
1 9 31
Newest
 Caucus
Impact
~97k people reached

Feb
18
revised Why is RSA encryption significantly faster than decryption?
fixed timing; edited tags
Feb
17
comment AES encryption with shared IV
Point taken. Using a message counter as IV with independent session keys is probably the best solution overall.
Feb
17
comment AES encryption with shared IV
I said "if it's initialized with random bits" (not known to the attacker, i.e. derived from the shared secret obtained upon connection). Of course the zero counter case is a flaw.
Feb
17
comment AES encryption with shared IV
The IV becoming public wouldn't be a security flaw if it's initialized with random bits, since they are all unique and unpredictable (though there is no reason to disclose it).
Feb
16
revised lfsr wiki excerpt
added 79 characters in body
Feb
16
comment Berlekamp-Massey algorithm: case when sequence length is less than double the length of the LFSR
Agreed, LFSR's probably merit a tag for themselves since there's a lot to be said about them. I added it.
Feb
16
wiki created lfsr excerpt
Feb
16
suggested approved edit on lfsr tag wiki excerpt
Feb
16
revised Berlekamp-Massey algorithm: case when sequence length is less than double the length of the LFSR
edited tags
Feb
16
comment AES encryption with shared IV
What are you using as integrity checks? A MAC every packet or every "message" (is there a difference? I suppose you are using TCP so is a "message" defined by your application?) and are the client and server authenticated upon handshake?
Feb
16
comment AES encryption with shared IV
Why do you need to send an IV with every packet to begin with? If you are trying to defend against replay attacks, there are better ways to go about that.
Feb
15
comment Low complexity implementation of a small blocksize cipher (< 64 bit)
@D.W. Thank you, that makes sense.
Feb
15
comment Low complexity implementation of a small blocksize cipher (< 64 bit)
I would consider the $2^{22}$ block limit as a deal breaker, to be honest. That means you can barely encrypt 20MB of data before having to change IV's. But of course it depends on usage. Also, isn't the probability of "problem" more like $1 - e^{- b^2 / 2^{45}}$? I'm thinking of the birthday paradox and probability of a collision, though that doesn't apply for all modes of operation.
Feb
14
comment Use of CBC-AES-256 to encrypt usernames
@amaterasu Doesn't that mean he can brute-force every username if you are reusing key+IV?
Feb
11
comment PBKDF2 for key diversification
How much entropy does your master key have? Whether or not you need a PBKDF depends on that.
Feb
9
answered brute force attack on KDF vs KEY
Feb
9
comment Name for identical operations for encryption and decryption
This is not worth an answer, but the closest mathematical term I can think of would be an involution. I am not sure if there is a cryptographic term for primitives which satisfy this property.
Feb
8
comment AES implementation in java that allows key of 320-bit length
Key derivation function.
Feb
7
reviewed Reject Are there two known strings which have the same MD5 hash value?
Feb
7
comment How to best obtain bit sequences from throwing normal dice?
@PaŭloEbermann To be fair the term "subcritical" is usually used in the context of probability distributions and not events, but I like to use it to highlight a particular asymptotic behaviour at probability 1.