10,529 reputation
12455
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 6 months
seen 1 hour ago

1d
revised How hard is it to find plaintexts whose hashes satisfy $h(a)\oplus h(b)=h(c)$?
edited tags
1d
reviewed Looks OK How hard is it to find plaintexts whose hashes satisfy $h(a)\oplus h(b)=h(c)$?
1d
reviewed Looks OK Is there any existing cipher capable of scaling from a 1 bit key up to a one-time-pad?
1d
reviewed Looks OK How to use GCM mode and associated-data properly
1d
comment How to use GCM mode and associated-data properly
Authenticated encryption by itself doesn't protect against deleted or replayed messages. It only prevents modifications of the message itself. A protocol can use a nonce together with authenticated encryption to achieve these properties, but if mean that, you should say it clearly.
1d
awarded  Custodian
1d
reviewed Looks OK Negative exponents in Shoup's threshold RSA?
1d
reviewed Reviewed Why should the RSA private exponent have the same size as the modulus?
1d
reviewed Reviewed State of the art RSA key generation
1d
reviewed Leave Open Merkle hash tree updates
1d
revised Many time pad attack
edited tags
1d
comment How secure is it to use password as AES key?
At minimum it's bad style, since AES expects a uniformly random key. It also means that the password needs to be much stronger than what you'd need if you used a proper password based KDF.
1d
comment Merkle hash tree updates
The basic variant of merkle trees is only efficient for leaf replacements and appending to the end of the dat, but not efficient insertions/deletions in the middle. But there are other hash tree constructions that allow efficient insertions.
2d
comment How do I communicate the value of the initialization vector to the end user? Should it be part of the encrypted message?
Standard practice is using a random per message IV and sending it alongside the message, typically as a prefix. So in principle you got the IV handling right.
2d
comment Why isn't CTR mode (counter mode) used more often?
@MaartenBodewes In that case I couldn't use what Microsoft built into .NET either. In fact whenever I needed raw CTR (not authenticated encryption like GCM), I needed random read access, which the .NET API doesn't provide.
Jan
28
comment Why isn't CTR mode (counter mode) used more often?
@Anthony Luckily implementing CTR on top of ECB is pretty easy. Perhaps 10 lines of code.
Jan
28
comment Why isn't CTR mode (counter mode) used more often?
One problem with CTR mode is that there isn't just a single way of turning counter and nonce into input for the block cipher core.
Jan
27
comment Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit?
I'm talking about using a message counter as nonce. That way you can have a collision between (k, n_1, c_1) and (k, n_2, c_2).
Jan
27
comment Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit?
For GCM to be secure the inputs to AES must be unique. With concatenation having a unique nonce (responsibility of the caller) and a unique block counter (part of GCM itself) is enough to guarantee unique inputs to AES. With XOR the caller must make sure that the 128 bit nonces are spaced far enough from each other so that xor-ing the counter doesn't cause a collision. That's annoying.
Jan
27
answered Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit?