Reputation
13,631
Next tag badge:
98/100 score
17/20 answers
Badges
1 34 70
Impact
~259k people reached

Jan
29
comment Is H'(M)=5*M + 9*H(M) mod 2^n a secure hash?
@MeysamGhahramani I don't see how $\pmod {2^n}$ poses any problems. It just means that you need to compute $9^{-1}$ as the Modular multiplicative inverse, but that can be done efficiently using the Extended Euclidean algorithm. The inverse exists since $\operatorname{GCD}(9, 2^n)=1$.
Jan
29
comment Is this DIY remote lock protocol secure?
Your MAC $H(M+K)$ relies on the collision resistance of the hash, which is broken for MD5. $H(K+M)$ would be even worse. HMAC does not rely on collision resistance and is explicitly designed to be used as a MAC. So using HMAC is essential for such a protocol.
Jan
29
comment Is this DIY remote lock protocol secure?
Use HMAC not a silly ad-hoc MAC.
Jan
29
comment Parallel-resistant proof-of-work scheme?
@E.Rose It's a comment by Marinus (written in his now deleted answer) to you. He seems to be worried that your scheme requires a trusted party to create the puzzle, instead of using a hash as seed, like it's required by bitcoin's proof-of-work.
Jan
28
comment Parallel-resistant proof-of-work scheme?
Marinus Freund wrote: Admittedly, what I don't really get about puzzles that are created for the solvers, is that the solution could be transmitted instead of solved. With e.g. Bitcoin afaik no part of the protocol does create or transmit a puzzle, throw away a secret solution or anything like that. If it did, the system wouldn't work for long. This property seems always to go along with parallelism, sadly. Am I missing something?
Jan
28
revised Is H'(M)=5*M + 9*H(M) mod 2^n a secure hash?
deleted 1 character in body
Jan
28
comment Single-algorithm authenticated encryption
@RichieFrame If you use a naturally tweakable block-cipher as primitive (like Threefish) OCB is clearly just a mode-of-operation.
Jan
28
answered Is H'(M)=5*M + 9*H(M) mod 2^n a secure hash?
Jan
28
revised Is H'(M)=5*M + 9*H(M) mod 2^n a secure hash?
edited title
Jan
28
comment Is H'(M)=5*M + 9*H(M) mod 2^n a secure hash?
Doesn't the extended euclidean algorithm solve your supposedly NP hard problem in polynomial time?
Jan
28
comment Is H'(M)=5*M + 9*H(M) mod 2^n a secure hash?
I don't think it's safe in general - the feed-forward of your hash (based on a variant of Matyas–Meyer–Oseas) could be constructed just so that it gets cancelled out.
Jan
28
comment RSA-OAEP: How does it work?
WTF! OAEP only uses a two round Feistel network?! That's not even enough to be a random permutation (requires 3 rounds) let alone a strong random permutation (requires 4 rounds).
Jan
28
comment Single-algorithm authenticated encryption
Is Helix really broken? Wasn't its problem just that it failed under nonce reuse?
Jan
28
comment Single-algorithm authenticated encryption
OCB and CCM mode only use a block-cipher.
Jan
28
comment Compressing AES
Compress before encrypting, not after. The only way to encrypt a ciphertext at all is by breaking the encryption. (But that might cause some security issues, the CRIME attack against TLS was due to compression.
Jan
28
comment Security issues with self encryption?
Relevant: Drew Perttula and Attacks on Convergent Encryption
Jan
28
comment Security issues with self encryption?
Known as convergent-encryption or message-locked-encryption.
Jan
25
comment help with cryptanalysis of a sponge permutation
The reason you can't invert your permutation is because it is no permutation. The approach is similar to an unbalanced Feistel, but you made the mistake of including the half you want to modify in the F function you xor into it.
Jan
25
comment Is there any more information on this RSA backdoor?
The backdoor you describe is detectable (Compressed ECC points are distinguishable from random data), but it can be made undetectable with minor modifications (e.g. randomly picking a point from the curve or its twist). The size of the fixed data can be halved by deriving the seed from the shared secret instead of encrypting it.
Jan
24
comment Recommendation for lightweight algorithm for partial message encryption
I'd rather use ChaCha over BLAKE2 in CTR mode. ChaCha is faster and is build from some kind of hash function in CTR mode already.