Reputation
12,198
Next tag badge:
89/100 score
20/20 answers
Badges
1 30 60
Newest
 Yearling
Impact
~206k people reached

Jan
12
revised Base64 with shuffled alphabet
deleted 38 characters in body; edited tags; edited title
Jan
9
comment Which block cipher mode does the experts use?
They use the mode that fits the requirements. Padding not working correctly is not a good reason to ditch CBC, you need to fix the code. Apart from padding there are several other things you'll need to get right, such as authentication/integrity checking and proper IV generation. Adding and removing padding is the easiest of these.
Jan
9
comment How secure is file header encryption for large files?
@Erode Then why do you need such a high performance? A 2GB file will contain a video far longer than 15s or even 3m, so decryption cost should be negligible compared to the video decoding cost.
Jan
9
comment How secure is file header encryption for large files?
What are you trying to achieve? That only your application can play these video files?
Jan
9
comment How secure is file header encryption for large files?
1) On my computer C#'s AesCryptoService provider takes about 15s for 2GB when using AES128. If you're willing to use native interop you should be able to speed that up a lot, especially if it uses AES-NI. 2) If performance matters, use AES-128 not AES-256. It's still very secure and about 1.4 times faster.
Jan
9
comment How secure is file header encryption for large files?
1) What are your security goals? Encrypting only part of the file will not be acceptable under most security goals. 2) A desktop computer should be able to get under 15s as long as IO keeps up.
Jan
9
comment Discrepancy with reported key size for EDE ciphers in Qualys SSL Labs
I don't think an attacker would implement the meet-in-the-middle like that. Cycle finding should be applicable, reducing the memory to around $2^{56/2}$ pairs and you need to do far fewer memory lookups.
Jan
9
revised Discrepancy with reported key size for EDE ciphers in Qualys SSL Labs
added 279 characters in body
Jan
9
answered Discrepancy with reported key size for EDE ciphers in Qualys SSL Labs
Jan
8
comment curve25519 weak points for contributory behaviour
If you reject points based on their bitstrings, one pitfall is that different implementations treat the last bit differently. NaCl treats the input as a 256 bit integer, most other implementations ignore the bit. The strings you need to reject differ between the encodings.
Jan
8
comment CBC with a fixed or random IV
1) With a fixed IV you leak if the first 16 bytes of two messages are identical. 2) The IV is usually send alongside the ciphertext, typically as a prefix. The IV is not secret, but needs to be different for each message.
Jan
7
answered What is the keyspace of ROT-13?
Jan
7
comment What is a good way to demonstrate elliptic curve cryptography?
@fkraiem It's silly to encrypt actual messages with ElGamal. Every sane protocol uses some kind of hybrid encryption, such as ECIES. IMO the only reason to use ElGamal encryption is needing its special properties (such as homomorphic encryption).
Jan
7
comment Sophie Germain primes and safe primes
1) Why don't you simply generate a random number of the desired size, check if it's a safe prime and repeat if it's not? 2) I think there are some RFC documents that define standard primes for use with Diffie-Hellman, these are often safeprimes.
Jan
7
comment Are there any Secp256k1 ECDSA test examples available?
Both answers don't include any ECDSA test vectors, only testvectors for scalar multiplication of the base point.
Jan
6
comment NTRU key generation
Where does that 1.5 come from? Is just an arbitrary choice that compensates for multi target attacks?
Jan
6
comment Share encrypted files without giving master key
The standard solution would be to store the random value (which acts similar to an IV) at the beginning of the ciphertext. I would avoid coupling to external meta data, especially since filenames aren't unique.
Jan
6
comment Share encrypted files without giving master key
Why use the filename instead of a random per-file value?
Jan
5
comment How many bits of entropy would I get from 300 coin tosses?
If it's an unbiased coin, you get one bit per toss. Since Shannon entropy is additive for independent events, you get 300 bits total. (This assumes that you toss 300 times, not that you toss 300 indistinguishable coins together)
Jan
4
reviewed Leave Open Why are there no MACs inspired by block cipher modes other than CBC and CFB?