5,070 reputation
1723
bio website
location
age
visits member for 2 years, 5 months
seen Jul 26 at 2:10

Aug
31
comment How terribly flawed is this design for key storage?
@TerisRiel: If you can't practically and realistically require strong pass phrases, you really shouldn't be storing the key file in an untrusted location. Using a weaker pass phrase and a PBKDF with a high iteration count, is a good solution if you store the key file locally, and want additional protection in the presumably unlikely event the key file gets into the wrong hands. That is however not an unlikely event, should you store it remotely rather than locally.
Aug
31
comment How terribly flawed is this design for key storage?
@TerisRiel: I agree that it is unrealistic to expect people to change all of their password on each rotation. I also think it is unrealistic to expect the average user to be able to pick a pass phrase with 80-128 bits of entropy. However, the logical consequence isn't that there is anything wrong with the usage policy I outlined. The correct conclusion is that your scheme requires exceptionally strong pass phrases for the key file.
Aug
27
comment Perfect zero knowledge for the Schnorr protocol?
There is a distinction between Perfect ZKPs and ZKPs that "only" rely on computationally hard problems. The title of your question includes the term "perfect", but the body of your question doesn't. Please clarify.
Aug
27
comment Should I delete cryptographic data from memory?
Excellent answer, although technically, it answers the question "how do I erase sensitive data I used in my programmed" and not the question "should I erase sensitive data I used in my program".
Aug
25
comment Do ciphertexts leak information about their algorithmic creators?
@Ninveh: The problem I pointed out is human choices have low entropy. Giving a human a choice between $n$ options, will not correspond to $log_2(n)$ bits of entropy, but far less. Also, the argument that one of the ciphers might be broken, is a completely different one. This is the usual reason why encryption software includes multiple versions - not to increase security, but to make it possible for users to use a different cipher, if their first choice gets broken.
Aug
25
comment Do ciphertexts leak information about their algorithmic creators?
@Ninveh: If an attacker has software that carries out a dictionary attack, modifying it so that it tests words with a constant letter substitution is trivial, and the modified attack will run in the exact same time as the generic attack.
Aug
23
comment Is a 1024-bit DSA key considered safe?
I don't know if the PGP software you use supports this, but given that the trust system conforms to the "web of trust" model, the best way to replace your key would probably be to first generate a new key, then use your existing key to authenticate your new key to your contacts, before you revoke the old one.
Aug
22
comment Will our app be FIPS 140-2 compliant if we use our own AES algorithm implementation?
There is a potential gotcha in the terminology: If you are a software project coordinator and hire someone to deliver a FIPS 140-2 compliant/conformant module, then the cost of validation and certification is not included, but it would be if you ordered a FIPS 140-2 certified module. The same distinction might apply to cryptographic libraries, depending on if the cryptographic boundary is expected to end up inside the library or inside your software that consumes the library.
Aug
22
comment Will our app be FIPS 140-2 compliant if we use our own AES algorithm implementation?
Actually I don't think NIST ever defines "compliance" the way you indicate. Rather, they talk of compliance/conformance as what is being tested as part of the validation process, in order to achieve certification.
Aug
17
comment Voting scheme where the votes become public when a threshold is reached
@mikeazo: Most e-voting schemes are based on the premise that the individual votes should be kept secret even after counting has ended, but this is not how this question has been put: The votes are supposed to become public once the threshold has been reached. This is of course an unusual requirement for public elections, but not for e.g. board meetings.
Aug
16
comment Voting scheme where the votes become public when a threshold is reached
@e-sushi: I think the key phrase in the question is "authority free", which rules out a central server that has to be explicitly trusted by the participants. Electronic voting is a topic in cryptography crypto.stanford.edu/pbc/notes/crypto/voting.xhtml. However, I do agree that the question should be edited by the OP to include more details about the exact requirements.
Aug
16
comment Voting scheme where the votes become public when a threshold is reached
@e-sushi: You might be mistaken. The OP asks for an authority free scheme, and your solution would require an authority to count the votes and keep them secret until the threshold has been reached.
Aug
16
comment Could this be a valid variation of the Schnorr protocol?
@LRM: No, it doesn't. It just means that it is essential that $P$ chooses $r$ uniformly at random each time the protocol is played out.
Aug
16
comment Could this be a valid variation of the Schnorr protocol?
@LRM: I think it is better that I edit my answer, to avoid too many comments.
Aug
16
comment MIT says: mathematical theory behind encryption is wrong. What are the consequences?
As far as I can tell, the paper contains nothing that hasn't already been accounted for in modern cryptography, since, well, at least the 1970's.
Aug
15
comment Could this be a valid variation of the Schnorr protocol?
@Perseid: If $s \neq rc + x = log_g(t)c + log_g(y)$, then $g^s \neq t^cy$ as well, presuming only that $t$ and $y$ belong to the same cyclic subgroup that is generated by $g$, which is something $V$ might test.
Aug
15
comment Could this be a valid variation of the Schnorr protocol?
@Perseids: $r = log_g(t)$ and $x = log_g(x)$. There is no assumption in my answer that the adversary $A$ knows either of these value, just that the arithmetic relation is objectively true.
Aug
15
comment Could this be a valid variation of the Schnorr protocol?
@Perseids: Yes, that is the whole point, isn't it?
Aug
15
comment Could this be a valid variation of the Schnorr protocol?
@Perseids: Your comment is a bit unclear. It doesn't matter if $A$ actually knows $r$ and $x$ or not. The logical requirement such an adversary can be turned into an adversary $A'$ that impersonates $P$ using the original formula, is that the challenge $c$ provided by $V$ is invertible. The law of distributivity under addition and multiplication works regardless if you actually know the value of the terms.
Aug
13
comment How to use salt when there is only one user
@Gilles: Quite right, I'll edit my answer.