9,824 reputation
12450
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 3 months
seen 5 hours ago

Jun
18
answered Why are there $ signs in my passwd file?
Jun
18
comment Is ECB mode secure if plaintexts guaranteed to be unique?
I just want to emphasize that people often underestimate the severity of attacks against unauthenticated modes. A 16 bit checksum is nice to protect against random errors, but not enough to protect against malicious modifications.
Jun
17
comment Is this password migration strategy secure?
Looks perfectly fine to me.
Jun
15
comment Why is ciphertext from low entropy plaintext not compressible?
Compressing a ciphertext implies breaking the encryption. Since the best known algorithms for breaking AES are very expensive (about 2^128 operations), the best known algorithms for compressing the ciphertext are at least as expensive.
Jun
11
comment Is this streamable combination of encryption and MAC secure?
With CTR mode, you don't need to include $IV_i$, but you still need to include the block number. Else the reordering is still possible, and will result in corrupted plaintext. At least if you use a encrypt then MAC mode.
Jun
11
comment Encryption vs. decryption of same plaintext
That depends on the mode. Most secure modes use an IV to prevent both of them.
Jun
11
comment How did LinkedIn “salt” all their passwords?
I'd go with the second unless your website regularly deletes inactive users. For a typical website I'd expect most users to be inactive.
Jun
11
comment Is this streamable combination of encryption and MAC secure?
If you don't include $ IV_i $, random read access becomes much harder, since you still need to verify the IV somehow. Else the attacker can modify the IV, allowing him to modify your first plaintext block without you noticing. This assumes that the last block of the previous part serves as IV for the current part. If you use a different method for deriving the IV, this might not be necessary.
Jun
10
comment Okay to use OpenSSL to encrypt then sign a message?
Everybody sees who signed the message.
Jun
10
revised What's the reason for applying the hash twice when hashing with salt?
added 323 characters in body
Jun
9
comment What's the reason for applying the hash twice when hashing with salt?
right. Thanks..
Jun
9
answered What's the reason for applying the hash twice when hashing with salt?
Jun
8
comment Idea for secure password hash-likes, is this feasible/usable/workable?
1) The way MD5 is broken is not relevant to password hashing. 2) We typically other hashes. For example PBKDF2 with SHA1 is a common choice, or bcrypt.
Jun
7
comment Attack vectors introduced by compilers
That's a completely unrealistic model. Not even handcoded assembly conforms to that in the general case. Duration of memory access depends on CPU caches, different operations cost a different number of clocks, there are CPU specific rules like "After an addition you get a bitshift for free". On some CPUs even the cost of simple things like integer arithmetic is data dependent.
Jun
7
answered Idea for secure password hash-likes, is this feasible/usable/workable?
Jun
7
comment Idea for secure password hash-likes, is this feasible/usable/workable?
The limitation is always the entropy of the password. There is no way around that.
Jun
7
comment Why do block ciphers need a non-linear component (like an S-box)?
It's important to note that combining two operations which are linear in different fields, can be non linear. For example addition in GF(2^32) aka 32 bit integer addition and addition in GF(2) aka XOR is a common choice.
Jun
6
comment SHA-512 hash collisions
It's highly probable that they exist, they're just hard to find.
Jun
6
comment Attack vectors introduced by compilers
"that are not possible w.r.t. the semantics of the source language?" What do you mean by that?
Jun
6
comment File Encryption/Decryption in ECB mode
@JohnPaulParreño Why create your own? There are more than enough padding methods already.