10,247 reputation
12452
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 5 months
seen 14 mins ago

40m
revised Finding a collision for a hash function
added 1 character in body
56m
comment Dancing confusion with Daniel J. Bernstein's stream ciphers
If you have a per session key, you still need a counter to distinguish messages. If you have a per message key (like noise) you don't need a nonce at all. If your protocol fits random nonces, use ciphers which support that. Choosing or designing a good protocol is the important part, choosing between Salsa20 and ChaCha a minor detail.
1h
comment Dancing confusion with Daniel J. Bernstein's stream ciphers
For a random nonce you need XChaCha or XSalsa20. Finding an XChaCha implementation and making sure it's correct will be harder than finding a correct XSalsa20 implementation. So if you need long/random nonces, Salsa20 might be preferable over ChaCha.
1h
comment Dancing confusion with Daniel J. Bernstein's stream ciphers
Deciding between Salsa20 and ChaCha is a matter of preference. Salsa20 has the advantage of having competed in eStream, being part of the NaCl library and a (rather limited) proof of security against differential cryptoanalyis. ChaCha has slightly better security per round, a bit more elegant and it's used in a TLS suite. Personally I'd choose ChaCha if either is equally practical to use but might prefer Salsa20 if I'm already using a library where it's implemented.
1h
comment Dancing confusion with Daniel J. Bernstein's stream ciphers
How to handle nonces should mainly be decided by the requirements of the application. I would avoid keeping nonces between runs of an application, so if you reuse a key beyond application restarts a counter doesn't work well. But if you encrypt a sequence of messages in a communication protocol the key is typically per-connection and a counter works well.
20h
revised Dancing confusion with Daniel J. Bernstein's stream ciphers
added 446 characters in body
20h
answered Dancing confusion with Daniel J. Bernstein's stream ciphers
1d
revised one time pad regarding
added 51 characters in body
1d
comment What would be the best plain text Cryptography method without the use of a computer?
@tylo I don't know any secure hand cipher that's less terrible than the OTP from a usage point of view. RC4, solitaire etc. have the same key reuse problems.
2d
comment Recovering El Gamal secret key from signatures
@Kairos Since this is a duplicate it has been closed and your bounty refunded. If you want to, you can offer a bounty on the duplicate.
2d
comment Is cm signed signature verification considered “slow”
Which algorithm are you using for signatures? How long are the messages?
2d
comment request for data to test deterministic ecdsa signature algorithm for secp256k1
Thread on bitcointalk that has several test vectors: Deterministic Usage of DSA and ECDSA Digital Signature Algorithms (RFC 6979)
Dec
12
comment Decrypt all RSA ciphertexts if you can break 1% of them
I didn't mean your cross-post, but some older question.
Dec
12
comment Decrypt all RSA ciphertexts if you can break 1% of them
Do we have a duplicate of this question? I thought I already read an equivalent question, but couldn't find it.
Dec
12
answered Decrypt all RSA ciphertexts if you can break 1% of them
Dec
11
comment Probability of factoring keys as a function of bit length
Similar question: How many RSA keys before a collision?
Dec
11
revised rotational cryptanalysis on modulo multiplication?
edited tags
Dec
11
comment RSA or Paillier is good?
I suspect you have a misunderstanding about what homomorphic encryption with RSA or Paillier achieves. Encrypting files like that is almost certainly not useful.
Dec
11
revised 2048-bit RSA Decryption
rolled back to a previous revision
Dec
9
comment RSA question, I'm lost
Have you read the wikipedia article on RSA?