Reputation
12,018
Next tag badge:
98/100 score
18/20 answers
Badges
1 29 60
Newest
 Revival
Impact
~199k people reached

Feb
20
comment Validating successful decryption in AES
I'd use a MAC instead. For example use HMAC-SHA-2 on the ciphertext. Derive the MAC key and the AES key from a master key.
Feb
19
comment Could use an explanation of the notation for an oracle adversary
Asymptotic security definitions ARGHHH
Feb
19
revised AES key/ciphertext space sizes
added 40 characters in body
Feb
19
comment AES key/ciphertext space sizes
possible duplicate of AES Key Length vs Block Length
Feb
16
revised Is sharing the modulus for multiple RSA key pairs secure?
edited body
Feb
15
answered Scrypt as a KDF with one-time high-entropy input
Feb
14
comment Why is OCB-AES mode not becoming a standard for authenticated encryption?
It's not clear to me that you can do much better given AES-NI hardware. Wouldn't be surprised if we needed new instructions for that, which will take a decade or so. 2) Most security proofs assume PRPness of AES, which related key attacks don't affect, and biclique attacks are just a minor speedup. So I don't think there should be many affected proofs. | I also don't think any of these answer why AES-OCB isn't used. People are fine with using AES, and it seems clearly better than other AES based modes.
Feb
14
comment Why is OCB-AES mode not becoming a standard for authenticated encryption?
1) With AES-NI the performance of AES-OCB is great, even ChaCha12 can't compete. It's just without AES-NI that it's slow. 2) What attacks against AES are you talking about? I'm not aware of any real attacks when AES is used with a random key. 3) How is the cost of forgeries unclear? It's simply the cost of decryption. I also think forgery flood isn't that big an issue.
Feb
14
comment Why is triple-DES using three different keys vulnerable to a meet-in-the-middle-attack?
@malexmave There is no way to split either of them into two halves in a way where the more expensive half has less than 2^114 keys.
Feb
14
answered Why is triple-DES using three different keys vulnerable to a meet-in-the-middle-attack?
Feb
12
comment Measuring Shannon's diffusion
Measuring the number of rounds a full diffusion takes is common.
Feb
12
reviewed Approve Why does the SRP-6 calculation of B include a multiplier k = 3?
Feb
12
comment Why does the SRP-6 calculation of B include a multiplier k = 3?
Are you talking about SRP-6 or SRP-6a? It seems like 6a doesn't use k=3 like you claim.
Feb
12
comment Why does the SRP-6 calculation of B include a multiplier k = 3?
related: Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6?
Feb
11
comment PBKDF2 for key diversification
If the master key has high entropy, I'd prefer HKDF over PBKDF2
Feb
11
comment brute force attack on KDF vs KEY
@hunter 20 bits fits a million iterations of PBKDF2, and scrypt is a bit costlier due to the high RAM requirement, so I guessed 40. I was too lazy to do any actual math.
Feb
10
comment Can we replace the XOR operation in DES with some other operation?
What do you want to achieve with that change? There are many ways to change DES, but most of them are not a good idea.
Feb
10
comment Is AES reducible to an NP-complete problem?
We know no such reductions for any cryptosystem we use in practice. Not AES, nor RSA. Such reduction isn't too useful in the first place, since complexity classes talk about asymptotic cost, whereas we want to know if a certain concrete key-size is secure.
Feb
10
revised ElGamal signature: Forging a signature of a specific form
added 3 characters in body; edited title
Feb
10
comment Request for 1024-bit primes $p$ , subgroup $q$ and subgroup generator $g$
@Barack You should merge your accounts. See crypto.stackexchange.com/help/user-merge