9,506 reputation
12347
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 1 month
seen 6 hours ago

2d
revised How HOTP values are validated according to RFC 4226
edited tags
2d
revised Using HMAC-SHA256 with short passwords and sliced outputs for short-lived secure hashing
edited tags
2d
comment What's the advantage of using OFB/CFB/CTR modes over a stream cipher
CTR has one big advantage: It allows random access
2d
comment Parallel variant of Carter-Wegman MAC with incremental property
You can always interleave several MACs
Aug
13
comment Is it possible to find plaintext from ciphertext if (n) and (a) are known for RSA?
@user3728778 Boneh wrote a paper listing most know attacks on RSA
Aug
13
comment Is it possible to find plaintext from ciphertext if (n) and (a) are known for RSA?
Your claim that these are the easiest way of breaking RSA.
Aug
13
comment Is it possible to find plaintext from ciphertext if (n) and (a) are known for RSA?
Note that this only applies to properly padded RSA. Textbook RSA has weaknesses a plenty.
Aug
12
comment Security issues of a MAC-then-Encrypt-then-MAC approach?
Your topic didn't fit your algorithm. MAC(m) || Enc(m) is known as MAC-and-Encrypt. MAC-then-encrypt is Enc(m || MAC(m)). Using MAC-and-encrypt you scheme is possibly insecure, using MAC-then-encrypt it's just silly.
Aug
12
revised Security issues of a MAC-then-Encrypt-then-MAC approach?
edited title
Aug
12
comment Is XORing a SHA256 better than truncating it?
1) Just take the first 16 bytes. Simple and secure if SHA256 is. 2) Any unkeyed 128 bit hash has at most 64 bits of collision resistance. That's generally not considered secure. Either increase the size or introduce a key not known to the attacker (using HMAC-SHA-2).
Aug
12
comment Is XORing a SHA256 better than truncating it?
1) Using a cryptographic hash doesn't gain anything if SHA256 is already a secure hash 2) Length extensions are not applicable and don't work if you truncate the output of SHA256 to 128 bits.
Aug
12
comment Security issues of a MAC-then-Encrypt-then-MAC approach?
I don't think "plaintext integrity" is useful in the context of of MACs since a mismatch between MAC and cipher key can only happen if you messed up your protocol. I'd only use a similar approach if the inner authentication is a signature, not a MAC.
Aug
12
comment Hash or compression function in Merkle tree nodes?
In principle you can use compression functions if you know what you're doing. But the devil is in the details. Skein and Blake2 only pad to a full block, never adding an additional compression.
Aug
12
comment CTR mode encryption using PRG
Using Salsa20Core in CTR mode certainly results in a secure stream cipher -- that's precisely the way Salsa20 is defined in the first place.
Aug
12
revised pkcs11 wiki excerpt
added 56 characters in body
Aug
12
revised Currently i am doing decryption for RSA encoding and i face some problem with it
edited tags; edited tags
Aug
12
revised RSA encoding problem help
deleted 3 characters in body; edited tags
Aug
12
reviewed Approve suggested edit on Entropy of two concatenated random values
Aug
12
comment Are there any cryptographic flaws in my webhook signing process?
Why sign webhooks at all? I prefer a pattern where the recipient doesn't assume that the webhook is authentic and simply uses it as a trigger to fetch the relevant information. That fetch is authenticated and protected against replay attacks since it uses HTTPS with your server as target.
Aug
11
comment Computational Complexity - When is it really exponential time?
You wrote $n=2^{log_2 n}$ which makes no sense. DL has polynomial cost in the order of the group and exponential cost in the bitlength of the group order. If you want to be precise you can't say "this algorithm has exponential cost", you need to specify in which variable it is exponential. Colloquially we omit that specification if everybody knows which variable we're talking about.