Henrick Hellström

2,521 reputation

1311

bio	website
	location
	age
visits	member for	1 year, 3 months
	seen	1 hour ago
stats	profile views	29

	2,521 reputation	bio	website		visits	member for	1 year, 3 months
1311 badges		location			seen	1 hour ago

summary answers questions tags badges favorites bounties reputation activity

177 Comments

suggestions reviews revisions comments badges posts accepts all

Mar 12	comment	Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy I guess you meant to describe a repeated adaptive attack that would reduce the security bounds, rather than an immediate break? Choosing 2048/256 bit DH parameters and a properly designed HMAC-SHA256 based KDF, seeding AES-GCM, would seem to be adequate for at least 100 bits of CCA2 security. Would anything be gained by changing the key derivation step 4, in such way that the server hello message includes a random nonce that is mixed in with the Diffie-Hellman shared secret $M^1_{tmp}$ when $k_{tmp}$ is derived?
Mar 11	comment	Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy Thank you for you comments. Regarding step 4, Diffie-Hellman works like this: Client calculates $M^1_{tmp} \leftarrow (S^0_{publ})^{C^1_{priv}}$ and server calculates $Mî_{tmp} \leftarrow (C^1_{publ})^{S^0_{priv}}$
Mar 11	comment	Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy I think you might have to spell out the steps involved in this attack. The presumption is that $Adversary$ might see $C^1_{publ}$, but not $C^1_{priv}$. How does $Adversary$ make $Client$ perform step 4 based on $S^0_{publ}$ and $Adv^1_{priv}$, which seems to be necessary in order for the client to perform step 7 without failure, given that the step 6 has been injected by $Adversary$ in the way you describe?
Mar 11	comment	Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy Well, fwiw, I have already done that. (Read it, analyzed it, implemented it.) But that is largely beside the point, since TLS 1.2 clearly isn't the protocol with the least overhead that meets the requirements listed in the question. Even if you fix the cipher suite (and possibly invent a new one for a DH_DHE key agreement), you will have to send and process redundant negotiation messages. Hence my question.
Mar 11	comment	Method and explanation for calculating difference in speed between DES and RSA You have not provided sufficient information. Firstly, different implementations of both algorithms have different speed. Secondly, what RSA padding is used? Thirdly, what size of the RSA modulus is assumed? Fourthly, what is the length of the plain text to be encrypted?
Mar 10	comment	Where to store the private key and the public key in a communication protocol Secure protocols are designed to be secure even if they are known. Security through obscurity is not real security, at least not in the cryptographic sense. However, you are right that the flexibility of SSL/TLS is a valid security concern (in the sense that it complicates both the protocol and the implementations). Many existing SSL/TLS implementations will allow you to restrict the set of allowed protocol versions and cipher suites. Do that, and ISTM you will have accomplished what you want.
Mar 8	comment	How difficult is it to check if a group element is in a sub group? @Poncho: Thanks, fixed.
Mar 7	comment	Timing attack on modular exponentiation @SmitJohnth: The second part of my answer concerns the case where the attacker doesn't only vary the input to the function, but also varies other external factors. In this case it is possible to not only count the bits of the exponent, but determine their position.
Mar 7	comment	Equivalents to a physical hat+shaking? en.wikipedia.org/wiki/Electronic_voting
Mar 6	comment	Timing attack on modular exponentiation @SmitJohnth: The purpose of the side channel attack I describe is to determine the position of the 1 bits with arbitrary precision.
Mar 6	comment	Timing attack on modular exponentiation @SmitJohnth: Well, presumably you implemented the critical parts, such as multiplication, in assembler. If you don't, it will be hard to avoid input dependent conditional branches when dealing with carries.
Mar 5	comment	is AES secure for java application licensing Running the application in a debugger will reveal enough information to calculate every possible key that will unlock your software.
Mar 4	comment	Are there any secure commutative ciphers? This question probably has to be rephrased. Commutativity is, by itself, more of a security vulnerability than a security feature. If you really need this commutativity, you probably have to build an entire protocol around it, to make sure it can't be exploited by an attacker. Just asking for the security of the commutative cipher itself doesn't make much sense.
Mar 3	comment	In RSA, how to make sure that $p-1$ and $q-1$ are still hard to factorize? Ah, no, I was comparing apples to oranges: The algorithms I was timing were too different to make sense of comparing them.
Mar 3	comment	In RSA, how to make sure that $p-1$ and $q-1$ are still hard to factorize? @Poncho: If you look closely at FIPS 186 prime generation, it contains a counter that makes the search for $p$ break and generate a new $q$. If you don't have that step, you might end up with a subprime for which finding a prime is infeasible.
Mar 2	comment	In RSA, how to make sure that $p-1$ and $q-1$ are still hard to factorize? @Poncho: Well, our results show that finding primes $p$ with $p-1$ having large prime factors might take about 10 times longer. Another possibility is that Rabin-Miller is more likely to return false positive in the first iterations for $p = rk + 1$, which would also cause a slow down.
Mar 2	comment	In RSA, how to make sure that $p-1$ and $q-1$ are still hard to factorize? IME step 2 is more expensive in the sense that it is less likely, given a fixed prime $r$ and a randomly selected $k$ of a fixed size, a number of the form $rk + 1$ is a prime, compared to a completely random odd integer of the same size. I only have experimental evidence to support this conjecture, though.
Mar 2	comment	What is “Blinding” used for in cryptography? I describe it informally in my answer to this question: crypto.stackexchange.com/questions/6538/…. Basically, if you are targeting e.g. a server that performs the private key operation using CPU operations, you make it (or observe it) perform other tasks at different relative timing offsets to the start of the private key operation to be attacked. For most exponentiation implementations this will reveal each bit of the private exponent with an accuracy that depends only on how accurate the timing is.
Mar 2	comment	Timing attack on modular exponentiation Then again, some of that info doesn't necessarily help in common scenarios.
Mar 2	comment	What is “Blinding” used for in cryptography? Then again, it is usually not the value $x$ to-be-raised that has to be blinded, but the private exponent $d$. Your method does not blind $d$, so if the timing attack works independently of the value-to-be-raised, it has no effect at all.