Reputation
12,269
Next tag badge:
90/100 score
20/20 answers
Badges
1 31 61
Newest
 Enlightened
Impact
~211k people reached

Jan
15
comment Public key encryption and big files with NaCL
1) Salsa20 is a stream cipher, so nonce reuse behaves like one-time-pad key-reuse. crypto.stackexchange.com/… 2) The Poly1305 MAC is a one-time MAC (wegman-carter), so nonce reuse leaks the MAC key for that nonce.
Jan
15
comment Public key encryption and big files with NaCL
1) Do you use a two part nonce, so you can use a different counter as nonce input for each chunk? Reusing the full nonce is fatal. 2) It's essential to use a special counter/nonce for the chunk containing the hash 3) I'd replace the hash by the file size
Jan
15
reviewed Leave Open Entropy in relation to computer security
Jan
15
reviewed Reviewed Simplifying the zero-knowledge proof example?
Jan
15
reviewed Reviewed Unbreakable code and mathematical impossibility
Jan
14
comment Programming language for modular arithmetic over large numbers
Most major languages either ship with built in bigintegers or have third party implementations. I've heard good things about NTL and it has the additional advantage that it's not merely a biginteger library but contains support for a lot of advanced mathematical features that are useful for cryptography.
Jan
14
comment Programming language for modular arithmetic over large numbers
This question appears to be off-topic because it is about 1) a programming problem, not a crypto problem. 2) A recommendation question with many possible answers, and thus not suitable for stackoverflow either.
Jan
14
comment What is a tweakable block cipher?
@figlesquidge That construction is trivially distinguishable from a proper tweakable cipher. There is a reason that XTS and OCB are more complex.
Jan
12
comment Using hash of plaintext as nonce in NaCl secretbox- bad idea?
An unkeyed hash of the plaintext leaks a lot of information about the plaintext.
Jan
12
comment Where are the ChaCha20 test vectors/examples?
Note that this is no RFC yet, it's only a draft.
Jan
12
revised Base64 with shuffled alphabet
deleted 38 characters in body; edited tags; edited title
Jan
9
comment Which block cipher mode does the experts use?
They use the mode that fits the requirements. Padding not working correctly is not a good reason to ditch CBC, you need to fix the code. Apart from padding there are several other things you'll need to get right, such as authentication/integrity checking and proper IV generation. Adding and removing padding is the easiest of these.
Jan
9
comment How secure is file header encryption for large files?
@Erode Then why do you need such a high performance? A 2GB file will contain a video far longer than 15s or even 3m, so decryption cost should be negligible compared to the video decoding cost.
Jan
9
comment How secure is file header encryption for large files?
What are you trying to achieve? That only your application can play these video files?
Jan
9
comment How secure is file header encryption for large files?
1) On my computer C#'s AesCryptoService provider takes about 15s for 2GB when using AES128. If you're willing to use native interop you should be able to speed that up a lot, especially if it uses AES-NI. 2) If performance matters, use AES-128 not AES-256. It's still very secure and about 1.4 times faster.
Jan
9
comment How secure is file header encryption for large files?
1) What are your security goals? Encrypting only part of the file will not be acceptable under most security goals. 2) A desktop computer should be able to get under 15s as long as IO keeps up.
Jan
9
comment Discrepancy with reported key size for EDE ciphers in Qualys SSL Labs
I don't think an attacker would implement the meet-in-the-middle like that. Cycle finding should be applicable, reducing the memory to around $2^{56/2}$ pairs and you need to do far fewer memory lookups.
Jan
9
revised Discrepancy with reported key size for EDE ciphers in Qualys SSL Labs
added 279 characters in body
Jan
9
answered Discrepancy with reported key size for EDE ciphers in Qualys SSL Labs
Jan
8
comment curve25519 weak points for contributory behaviour
If you reject points based on their bitstrings, one pitfall is that different implementations treat the last bit differently. NaCl treats the input as a 256 bit integer, most other implementations ignore the bit. The strings you need to reject differ between the encodings.