9,834 reputation
12450
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 3 months
seen 1 hour ago

Feb
27
answered Non-standard signature security definition conforming ed25519 malleability
Feb
27
comment Non-standard signature security definition conforming ed25519 malleability
@DrLecter I suspect Gracchus wants to be sure EdDSA is not malleable, to avoid issues like the one that recently owned MtGox.
Feb
26
comment Can a properly implemented ed25519 private key with public underlying data be cracked?
@Gracchus No, don't pre-hash the message before passing it to Ed25519. Ed25519 already hashes the message, but in a way that's stronger than a normal hash. My example of additional signatures weakening the scheme is rather theoretical. My point is just that you can't make a generalized statement like ultraman's, you need to consider the specific scheme.
Feb
25
comment pbkdf2 password validation
For password hashes a constant time validation isn't that important, especially for attackers who don't know the salt. It's merely good style to use it. For MAC validation it's far more important, since a timing leak would allow construction of a valid MAC.
Feb
25
comment Strange Password Hashing
The technique for avoiding timing attacks doesn't work. So if the salt is known, it's just as vulnerable to side channel attacks as scrypt with known salt. At a glance this looks like a badly done variant of scrypt.
Feb
25
wiki created multi-prime-rsa description
Feb
25
wiki created multi-prime-rsa excerpt
Feb
24
comment Using ECDSA keys for encryption
Very similar to Using same keypair for Diffie-Hellman and signing
Feb
23
comment How has the “power” of cryptography evolved from its beginnings till today?
Nowadays crypto is all about designing higher level protocols, avoiding implementation mistakes, usability etc. Primitives like AES are pretty strong.
Feb
23
comment AES CBC Security
SSL still provides authentication even with CBC based modes. The real problem is that SSL combines AES-CBC with a MAC in a MAC-then-authenticate scheme, which is pretty hard to implement. Older SSL versions also don't choose unpredictable IVs, which CBC requires. So these problems are not inherent in CBC, they result from the way SSL uses CBC.
Feb
23
comment Digital Signature using symmetric key cryptography
I don't get your question. What do you mean by symmetric key digital signature? A MAC? Or are you talking about an asymmetric scheme built from symmetric primitives (like hash signatures?)
Feb
22
comment AES CBC Security
I wouldn't care too much about key-size. 128 bits is already quite strong.
Feb
22
comment AES CBC Security
SSL made an unfortunate choice when combining AES-CBC with MACs. This means that it's quite hard to implement CBC correctly. It isn't easy to implement GCM in a way that resists timing attacks on a CPU without AES-NI, so it's not perfect either.
Feb
22
comment Burmester-Desmedt (BD) key agreement protocols
I'd use \pmod {11} instead of \bmod in this context. $\pmod{11}$
Feb
22
revised Burmester-Desmedt (BD) key agreement protocols
added 42 characters in body
Feb
21
comment Is script execution time a decent source of pseudorandom number generation?
I would not use an entropy generation algorithm at all. Just leave it to the OS.
Feb
21
comment Is script execution time a decent source of pseudorandom number generation?
Why do you want to try dangerous things like that, instead of simply using mcrypt_create_iv(size, MCRYPT_DEV_URANDOM)?
Feb
20
comment Hashing SHA-512 1000 times
Collisions in a 512 bit hash are extremely improbable. So even if you try trillions of times you still have a negligible chance.
Feb
19
comment Which gives better deterministic encryption SIV or Plain ECB mode?
For a single block, ECB is perfectly fine.
Feb
19
revised RSA with composite numbers
edited tags