9,506 reputation
12347
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 1 month
seen 2 hours ago

Dec
15
comment Difference between implicit signature and explicit signature
What exactly do you mean by an implicit signature? I couldn't find a good definition.
Dec
15
comment measurable proof of works
If it's no problem that the verifier creates the challenge and can cheat, you can use Rivest's timelock puzzle.
Dec
15
comment Game traffic encryption AES CTR + HMAC
@Reid GCM needs 16 byte tags. If you truncate the tag, its security crumbles.
Dec
15
comment Game traffic encryption AES CTR + HMAC
Your main problem is that you don't want security, only obfuscation. Any moderately talented reverser will be able to extract the AES key with standard AES implementations.
Dec
13
comment Generate random in secure message transfer
don't use nanoTime
Dec
13
comment When do I need to renew keys for Salsa20 or HMAC?
Key renewal is useful for forward secrecy or recovery from key compromise.
Dec
13
comment When do I need to renew keys for Salsa20 or HMAC?
Letting the Salsa20 counter roll over would be a fatal flaw, but I doubt you'll be willing to wait for it (It'd take around 10000 years with typical computers).
Dec
13
comment So what is quantum cryptography anyway?
The track record of QKD is pretty bad for something "perfectly secure". It's just that many implementations are flawed, just like implementation of traditional crypto is a far bigger threat than traditional crypto itself.
Dec
13
revised Public-key cryptosystems without poly-time quantum attacks
edited tags
Dec
13
revised Did NIST verify “post-quantum” claims in the SHA3 proposal papers?
edited tags
Dec
13
comment So what is quantum cryptography anyway?
Nothing is wrong with traditional symmetric crypto. The popular asymmetric schemes (RSA, DH, Elliptic curves) will be broken by large quantum computers, but we have alternatives (McElise, NTRU,...) which are believed to resist quantum computers. => IMO quantum crypto is useless
Dec
11
comment Do test vectors ensure a cipher is free of backdoors?
Use code review and test vectors. But even if you do a bug may slip by. For example there were recent bugs in popular GCM which caused a total security breakdown for certain message lengths.
Dec
11
comment Do test vectors ensure a cipher is free of backdoors?
If an attacker can affect keys that much you probably have a problem even without backdoors. At minimum it's bad protocol design. AES (unlike e.g. Threefish) is not designed to handle attacker controlled keys. For example it suffers related key attacks.
Dec
11
comment Do test vectors ensure a cipher is free of backdoors?
I'd rather define it as if m=CONST return k. Attacker controlled plaintexts or ciphertexts are more common and leaking the key is more useful. (or as DrLecter suggests a bijection of k to reduce the detection risk)
Dec
11
comment Could someone reuse client certificates?
A leak of the server side key only compromises past traffic if the RSA key exchange was used, not if (EC)DHE_RSA was used.
Dec
11
comment Diffie-Hellman Secret Exponent Size and Shared Secret Usage
A weird choice. 2048 bit modulus has about 112 bits of security, a 512 bit exponent 256 bits of security. A 3000 bit modulus with a 256 bit exponent would have a higher security level and similar performance. Or use ECC which is about 10x as fast.
Dec
11
comment In RSA, why is it important choosing e so that it is coprime to φ(n)?
Your last paragraph only works for prime $e$.
Dec
11
comment In RSA, why is it important choosing e so that it is coprime to φ(n)?
The Rabin cryptosystem is similar to RSA but uses e=2, which trivially divides $\phi(n)$. It needs to do extra work since this makes decryption ambiguous.
Dec
11
comment Is it possible to modify SSL handshakes to enable PFS while still using RSA during the handshake?
Creating a new DH key is cheap: One modular exponentiation with fixed base (or the even cheaper elliptic curve equivalent). With RSA you need to create two large primes. Creating an RSA key costs only a fraction of a second, but you don't want to create a new one for each and every connection.
Dec
11
comment Is it possible to modify SSL handshakes to enable PFS while still using RSA during the handshake?
To achieve forward secrecy you need to throw away the keys you used in the handshake so your future self won't be able to decrypt the handshake anymore. Both sides need to use an ephemeral key (With RSA key-exchange the client's ephemeral key is a symmetric secret). As long as the server keeps its RSA key used in a plain RSA key-exchange, you haven't achieved forward secrecy.