Reputation
12,198
Next tag badge:
89/100 score
20/20 answers
Badges
1 30 60
Newest
 Yearling
Impact
~206k people reached

Feb
10
answered Why does NaCL have different keys for signing and encryption?
Feb
10
comment Strategies for securing public key storage on software
Obfuscation isn't enough, but that doesn't mean there is something better either. Software DRM inherently relies on security through obscurity.
Feb
10
revised Diffie-Hellman Application
deleted 8 characters in body
Feb
10
reviewed No Action Needed Testing the Fortuna random number generator?
Feb
9
comment Remove padding (CBC) from decrypted text
The IV generation code makes no sense. 32 Base64 characters would correspond to a cipher with 192 bit blocks, which is highly unusual.
Feb
8
comment Hash function as secure as one-time pad?
The identity function is collision resistant. Preimage resistance is obviously impossible against a computationally unbounded attacker if the cost of each hash xomputation is bounded.
Feb
3
comment Python implementation of a blind signature scheme which doesn't involve RSA
RSA based blind signatures are relatively easy to understand and IMO have less room for mistakes than group based blind signatures. If you want simpler padding, use FDH instead of PSS. I trust them significantly more, the only major downside is performance. One pitfall is that you should make sure that GCD(m, N) = 1, not only GCD(r, N) = 1.
Feb
2
reviewed No Action Needed Multiple encryption of part of block
Feb
2
comment Multiple encryption of part of block
1) This technique is known as Ciphertext stealing. It's secure in principle, but as @mikeazo already pointed out using ECB and using 64 bit block ciphers is generally a bad idea. 2) There are fancier length preserving encryption schemes. 3) I strongly recommend adding a nonce/IV and a MAC. While these increase the size of the message, the security implications of not having them can be severe.
Jan
30
revised How hard is it to find plaintexts whose hashes satisfy $h(a)\oplus h(b)=h(c)$?
edited tags
Jan
30
reviewed Looks OK How hard is it to find plaintexts whose hashes satisfy $h(a)\oplus h(b)=h(c)$?
Jan
30
reviewed Looks OK Is there any existing cipher capable of scaling from a 1 bit key up to a one-time-pad?
Jan
30
awarded  Custodian
Jan
30
reviewed Looks OK Negative exponents in Shoup's threshold RSA?
Jan
30
reviewed Reviewed Why should the RSA private exponent have the same size as the modulus?
Jan
30
reviewed Reviewed State of the art RSA key generation
Jan
30
reviewed Leave Open Merkle hash tree updates
Jan
30
revised Many time pad attack
edited tags
Jan
30
comment How secure is it to use password as AES key?
At minimum it's bad style, since AES expects a uniformly random key. It also means that the password needs to be much stronger than what you'd need if you used a proper password based KDF.
Jan
30
comment Merkle hash tree updates
The basic variant of merkle trees is only efficient for leaf replacements and appending to the end of the dat, but not efficient insertions/deletions in the middle. But there are other hash tree constructions that allow efficient insertions.