Henrick Hellström

2,521 reputation

1311

bio	website
	location
	age
visits	member for	1 year, 3 months
	seen	2 hours ago
stats	profile views	29

	2,521 reputation	bio	website		visits	member for	1 year, 3 months
1311 badges		location			seen	2 hours ago

summary answers questions tags badges favorites bounties reputation activity

177 Comments

suggestions reviews revisions comments badges posts accepts all

Apr 8	comment	Does the IV need to be known by AES (CBC mode)? The only problem with using a null IV and and random value for the first block of plain text, if done consistently, is that you get one extra unnecessary block cipher operation. The end result is indistinguishable from using a random block as the first cipher text block.
Apr 7	comment	Do I need to know the “mode of operation” to decrypt a message encrypted with a block cipher? let us continue this discussion in chat
Apr 7	comment	Do I need to know the “mode of operation” to decrypt a message encrypted with a block cipher? Nothing is going on except that I think your use of the work "most" is a bit too casual for me to cast an upvote.
Apr 7	comment	Do I need to know the “mode of operation” to decrypt a message encrypted with a block cipher? Per software, per server deployment or per MB of total Internet traffic?
Apr 7	comment	Do I need to know the “mode of operation” to decrypt a message encrypted with a block cipher? How do you quantify "most systems"? I would guess most encrypted traffic is transmitted in systems that at least have version dependent algorithms and modes, but perhaps you use a different measure.
Apr 5	comment	DSA signatures with related k and unknown payloads I can see that might require some additional explanation, yes.
Apr 5	comment	DSA signatures with related k and unknown payloads @D.W.: I agree this is not a very realistic scenario if the signatures are used in a properly designed protocol, but then again, in a properly designed protocol the randomizers wouldn't be generated this way either.
Apr 4	comment	Attack on DSA with signatures made with k, k+1, k+2 I don't think your question is entirely clear, but let me clarify that these are mathematical equations in $\mathbb Z_q$. $\pmod q$ is not an operation, but specifies the scope of the congruence.
Apr 4	comment	DSA signatures with related k and unknown payloads If we know the plain text messages $m_1$ and $m_2$, we know the hash values $h_1$ and $h_2$. Since the signed message is normally known, you might have to expand on exactly what kind of scenario you are considering.
Apr 4	comment	Attack on DSA with signatures made with k, k+1, k+2 All operations are performed in the field $\mathbb Z_q$, which is why $(\mod q)$ is there all the way. For instance, division means multiplying the numerator by the multiplicative modular inverse of the denominator.
Apr 4	comment	RSA digital signature vs authenticated cipher That is AES-CBC-then-HMAC-SHA-256. AES-GCM is technically AES-CTR-then-GHASH.
Apr 3	comment	RSA digital signature vs authenticated cipher AES-GCM does not use a SHA256 hash, as has been told in both answers and some comments. However, you might for some reason need to pass your key material through a KDF to generate the actual AES-GCM key before you instantiate AES-GCM, and that KDF might be based on SHA256. Is that what you mean?
Apr 2	comment	RSA digital signature vs authenticated cipher By AES-GCM-SHA256, do you mean a scheme that uses a SHA256 based KDF, as in RFC 5288 specifying AES-GCM cipher suites for TLS?
Apr 1	comment	Voice Call Safety This question might be better asked in security.SE. From a cryptographic POV the answer is negative, for the reasons you state, but banks are known to take calculated risks for various reasons. That is rather a general security question than a cryptographic question.
Mar 29	comment	What does the expression $1^n$ mean as a function argument? @PaŭloEbermann: Thanks, the link wasn't available when I wrote my first reply. FWIW the definitions only mention that the same security parameter is also an implicit parameter of the set of attributes and set of predicates. On what page did you find the reference to polynomial time setup?
Mar 27	comment	one-time pad key related attack Very related to this question crypto.stackexchange.com/questions/2264/…
Mar 27	comment	How to use HMAC for large ciphertexts over TLS @PaŭloEbermann: Yes, if datatracker.ietf.org/doc/rfc4366 is implemented. It specifies mechanisms for negotiating both the maximum fragment length and the mac length.
Mar 26	comment	How to use HMAC for large ciphertexts over TLS @rsa: That sounds like a hardware specific or API specific question.
Mar 26	comment	*Solving hard problems in $\mathbb Z_{p}^{}$ when $\mathbb p$ is close to $\mathbb 2^{n}$** @fgrieu: I suspect you interpreted $n$ as the magnitude of the modulus. $n$ is the actual modulus, so for a 1024 bit modulus, $\log n = 1024 \log 2$ etc.
Mar 26	comment	How to use HMAC for large ciphertexts over TLS The records Poncho and Thomas Pornin mention are up to 2^14 bytes in length. There is one MAC for each such record. The length of the MAC is typically equal to the length of the underlying hash, if a cipher suite with a HMAC is selected during the handshake. However, this might depend on which cipher suites and which handshake extensions are implemented and in effect as a result of the handshake.