10,257 reputation
12452
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 5 months
seen 23 hours ago

Mar
13
comment How do I convert the definition of E-521 into a curve definition a la Bouncy Castle?
I'd rather start with a Curve25519/Ed25519 and replace the field arithmetic operations. Converting to weierstrass misses the point of edwards/montgomery curves. Montgomery addition is differential, so you can't simply reuse the BC code for weierstrass scalar multiplication. Finding a $F_{521}$ implementation shouldn't be too hard, considering it's also used in NIST-P521.
Mar
13
revised Why does SHA-1 have 80 rounds?
added 11 characters in body; edited tags; edited title
Mar
13
answered Why does SHA-1 have 80 rounds?
Mar
13
comment How does the key size per data bit influence the security?
@Marste 1) TLS in its typical use doesn't bother changing the key during the lifetime of a connection 2) Changing the key within a connection strengthens forward secrecy 3) More samples don't help brute-force, but might aid cryptoanalysis. There is also a block size dependent limit, which is only a couple of GB for 64 bit blocks. Older protocols worry about these issues since we didn't have AES yet. Nowadays it's less of a concern.
Mar
12
comment How do I convert the definition of E-521 into a curve definition a la Bouncy Castle?
I suspect this library only supports weierstrass form, so you'd need to either convert (bad idea IMO) or implement a custom EccPoint class with edwards arithmetic. But last time I checked BC C# had quite bas ECC implementations. Not resistant to side channel attacks and slow as hell (using affine coordinates).
Mar
12
comment How do I convert the definition of E-521 into a curve definition a la Bouncy Castle?
FpCurve is for prime fields, F2mCurve for binary fields. This field is prime, so you need to choose FpCurve.
Mar
12
revised Where did Martin Hellman acknowledge Ralph Merkle's contribution to public-key cryptography?
added 62 characters in body; edited tags
Mar
12
awarded  Nice Question
Mar
11
comment Is there a flaw in whole disk encryption vs volume or folder encryption?
Yes, you're wrong. Modern cryptography doesn't allow an attacker to learn the key given (plaintext, ciphertext) pairs. This is a "known plaintext" attack.
Mar
10
comment I need a 64-bit cryptographic hash for 96 bits of data
But you can't really get "very high" collision resistance with a 64 bit hash. For example if you have 4 billion entries, collisions become likely, but you can't neglect them with only a few million entries.
Mar
10
comment I need a 64-bit cryptographic hash for 96 bits of data
Just take the first 64 bits of SHA-256 output. It's as good as 64 bit hashes get.
Mar
10
comment Sane implementations of Bitcoin cryptography routines w.r.t. side-channel attacks
Most operations don't need side channel resistance - they operate on public data. ECDSA signing is the major one, but even it is relatively hard to attack since you can't easily get high precision timing information.
Mar
10
comment Where can I download a database of RSA keys?
You probably could extract a bunch from the public SSL Observatory data dump.
Mar
10
comment Non-standard signature security definition conforming ed25519 malleability
@Gracchus There hasn't been a new version of SUPERCOP and most people wouldn't consider malleability a vulnerability of the signature scheme in the first place.
Mar
7
comment How to calculate the maximum output size for data encrypted with a RSA Private Key?
I've seen RSA/ECB/PKCS1Padding used in java contexts pretty often. But I'm not sure what it actually does. It might be equivalent to none, or perhaps it splits the message if it's too long.
Mar
7
comment 64 bit Elliptic Curve key?
Apart from being broken in a few minutes on a standard computer, there is nothing wrong with using a 64 bit field. The bigger problem is that you need to find curve parameters which requires understanding the mathematics behind ECC (Unless there are some standard SAGE scripts which do it for you).
Mar
7
comment Will non-ECC algorithms like RSA eventually become too inefficient?
A 128 bit security level is already pretty high. It seems unlikely to be that we'll get classical computers which can break that security level before we get quantum computers which kill all of ECC, finite field DH/DSA and RSA.
Mar
6
comment Key expiration policy for 3DES / TDES / Triple DES
1) Which MAC construction are you use? 2) Why choose 3DES over HMAC or even AES? 3) Attacks become likely as you approach 2^32 blocks, you should stay significantly below that value.
Mar
6
comment How to calculate the maximum output size for data encrypted with a RSA Private Key?
Oh I missed that you're using encrypting a hash with the private key, that's a bad idea. Use a standard signature algorithm instead. Either with the newer PSS padding or the PKCS1v1.5 signature padding, which unlike its encryption equivalent has no known weaknesses.
Mar
6
comment How to calculate the maximum output size for data encrypted with a RSA Private Key?
I also strongly recommend using OAEP padding over PBKS#1v1.5 padding for RSA encryption. The latter has weaknesses which can be exploited in many use cases and are annoying to work around.