9,834 reputation
12450
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 3 months
seen 5 mins ago

Jan
31
comment Why does a perfect secrecy can be achieved when decryption correctness is not totally required?
You can omit part of the information from the output and guess them. Those guesses will be incorrect sometimes. This boils down to using lossy compression before encrypting.
Jan
31
comment How do institutions like banks do RSA with big primes?
1) CRT is only a factor 4 speedup. The OP has trouble understanding why modular exponentiation has anywhere near acceptable performance, a factor 4 is irrelevant in this context. 2) Larger devices will use CRT as well. It's just as nice on a large x86/AMD64 as it is on a constrained device.
Jan
31
comment Is it ok to send part of digital signature if we have bandwidth constraints?
What's the difference between this question, and your other one? How to specify last t bits are only sent when a signature is sent?
Jan
31
revised implication of tweak on bruteforcing a block cipher
added 23 characters in body
Jan
31
comment How to specify last $t$ bits are only sent when a signature is sent?
There are short MACs (but even they need 64 bits for a decent level of securiy), but even BLS signatures need 2x the security level. One can use proof-of-work to shave of a 20 bits or so.
Jan
30
comment Random numbers for Rabin-Miller primality tests
@PnD You should use a well seeded CSPRNG, not a mersenne twiser. The seeding part is essential, /dev/urandom is the minimum quality you should accept as seed.
Jan
30
comment How do institutions like banks do RSA with big primes?
You reduce modulo n after each multiplication. You only need about 1000 squaring and 1000 multiplications (on 1000 bit numbers) when you use square-and-multiply to compute the exponentiation. So the whole thing takes about 1ms total.
Jan
30
comment How do institutions like banks do RSA with big primes?
A computer can do a few billion multiplications per second. So them being able to multiply 1000 bit numbers quickly shouldn't be a big surprise. One 1000 bit multiplication takes ~1000 32 bit multiplications or ~250 64 bit multiplications. Not that much.
Jan
30
comment How is HKDF-Expand better than a simple hash?
It's more flexible. Allows longer outputs and different strings to identify different outputs.
Jan
30
comment Derive both MAC and AES keys from same PBKDF2?
Actually they do help you. Simply use PRK, info and L as input and check if OKM matches. But extract is a one liner, simply call HMAC(salt, ikm).
Jan
30
comment Derive both MAC and AES keys from same PBKDF2?
I just remembered that I actually implemented HKDF in C# a couple of months ago: gist.github.com/CodesInChaos/8710228
Jan
30
comment Best way to get 32 bytes from PBKDF2
One simple workaround is deriving a 20 byte master key with expensive PBKDF2, and then applying PBKDF2 with 1 iteration and long output to it. As another simple technique applicable when you only need 32-64 bytes, you can simply hash the output of PBKDF2 once with SHA256 or SHA512 to expand it.
Jan
30
comment Best way to get 32 bytes from PBKDF2
I prefer something similar to the former, but following the HKDF-Expand spec. Second one is no better than calling PBKDF2.GetBytes(32) directly.
Jan
30
revised Block cipher with key longer than block size
added 251 characters in body
Jan
30
comment Block cipher with key longer than block size
@sashank Apart from using "size" instead of "cardinality" this answer looks correct to me. It only argues that there are multiple keys which encrypt one particular $x$ to the same value. It doesn't argue that there are equivalent keys, which encrypt all $x$ to the same value. This fits the question, which is about that particular property, not about equivalent keys, like the question you linked.
Jan
30
awarded  Cleanup
Jan
30
revised Block cipher with key longer than block size
rolled back to a previous revision
Jan
29
comment Derive both MAC and AES keys from same PBKDF2?
Implementing HKDF-Expand on top of HMAC is pretty easy.
Jan
29
reviewed Close ElGamal encryption with private key
Jan
29
comment Derive both MAC and AES keys from same PBKDF2?
It can, but when you do it might be possible for the attacker to compute it more cheaply than for the defender, since the defender needs the whole output, whereas the attacker might be able to confirm it with only part of the output. This shouldn't happen with well designed password based key derivation functions, but PBKDF2 is not one of those.