9,834 reputation
12450
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 3 months
seen 5 hours ago

Jan
29
comment Derive both MAC and AES keys from same PBKDF2?
You should avoid deriving more than the natural output size direclty PBKDF2. With PBKDF2-HMAC-SHA512 that's enough for two keys, with *-SHA1 it isn't. If you need more key material, use HKDF-Expand on the output of PBKDF2.
Jan
29
comment Usage of Fermat primes in RSA
@rath We're talking about primes with this format. There are infinitely many Fermat numbers, but only these few are prime
Jan
29
comment Does re-iterate AES128 with different keys gives any benefict?
It's weaker than AES-256 against generic attacks. There is a meet in the middle attack which can break it with cost 2^128 (not sure how applicable the attack is with realistic cost models). See Attacking 2DES efficiently. Search for DES meet-in-the-middle for several related question.
Jan
29
answered Usage of Fermat primes in RSA
Jan
29
comment How to specify last $t$ bits are only sent when a signature is sent?
If you want shorter signatures you should consider BLS
Jan
29
revised What is the padding scheme for the original Tiger hash?
added 1805 characters in body
Jan
29
answered What is the padding scheme for the original Tiger hash?
Jan
29
comment How can i predict the next number of a long sequence of seemingly random numbers?
@figlesquidge They only have a reduction to the primitive which isn't really a meaningful proof. You still can't prove that SalsaCore is a secure PRF or that AES is a secure PRP. In general with symmetric encryption primitives don't have a meaningful proof, but modes of operation do.
Jan
29
comment Why not the one-time pad with pseudo-number generator
1) Any decent stream cipher will only repeat after more than 2^60 output bytes, so this limitation is not of practical concern 2) The number of different streams and the length of one stream is unrelated. Typical stream ciphers will have at least 2^128 different streams. 3) It's far more important to use a good stream cipher than combining multiple. Very little reason to modify the constants yourself, just choose a random key and IV as seed.
Jan
28
comment How is CipherCloud doing homomorphic encryption?
Not even CipherCloud itself claims to use homomorphic encryption. That's just a misunderstanding the OP had.
Jan
28
comment Is it feasible to break an encrypted and later encoded message?
When analyzing modern crypto we observe Kerckhoffs's principle i.e. we assume algorithms are known, only keys are secret. Ciphertext-only analysis isn't considered much either, known plaintext is one of the weakest attacks considered. Typical schemes must be secure against much stronger attacks where an attacker can choose the message to encrypt/decrypt. Nobody will take a scheme serious that's so weak that the designer insists on ciphertext only analysis.
Jan
28
comment Is it feasible to break an encrypted and later encoded message?
In a known plaintext scenario with known algorithms(but unknown substitution table) this is barely harder to break than plain DES.
Jan
26
comment What does $\Pi$ represents in cryptography?
Wikipedia: Multiplication - Capital Pi notation
Jan
26
comment Cryptographic Primitive Method
It's important to note that constructing a hash from a block-cipher isn't possible for any block-cipher. The standard assumption of the cipher being a PRP (pseudo-random-permutation) isn't enough for a secure hash. It needs large blocks (256 bits for a 128 bit sec level) and must resist related key attacks (at least for Davies-Meyer). These mean that it's difficult to construct a hash from AES.
Jan
26
comment A fast non-cryptographic hash function that is “strong enough”?
@e-sushi The OP obviously needs first pre-image resistance, those don't offer it.
Jan
26
comment Factorization or discrete logarithm is difficult for an attacker?
I know no secure signature scheme within your constraints. But if both signer and verifier share a secret, they can use a MAC instead of a signature. MACs fit your constraints, but the verifier can forge them, so it doesn't work well with more than two parties.
Jan
25
comment A fast non-cryptographic hash function that is “strong enough”?
AES with a fixed key could be used as one-way function: $H^{i+1}=AES(H^i) \oplus H^i$. But it's not a recommended mode.
Jan
24
comment Question about SHA-2 (and potentially similar hashing algorithms)
The idea of a hash is that anybody can compute the same hash without having to know a secret. When you have a secret, you can use a MAC which is stronger than an unkeyed hash. The random prefix keys used in for example HMAC are very similar to random IVs.
Jan
24
comment How to protect against ephemeral key reuse in some signature schemes?
There is one risk worth guarding against though: A failing PRNG. That's why I recommend deterministic nonce generation like EdDSA or RFC6979 - Deterministic Usage of the Digital Signature Algorithm.
Jan
24
comment How to protect against ephemeral key reuse in some signature schemes?
The risk of your counter measure having a bug that causes trouble is bigger than the change of repeated nonces with a perfect PRNG. Even the risk of random hardware errors is much bigger. $2^{-200}$ is really really small.