9,834 reputation
12450
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 3 months
seen 2 hours ago

Jan
22
comment Can curve25519 keys be used with ed25519 keys?
The problem is that you don't get the y part of the coordinate when using a montgomery ladder to compute the public key.
Jan
22
comment Encrypting or HMACing password digests
This question is about encrypting/MACing a salted password hash.
Jan
22
comment How can i predict the next number of a long sequence of seemingly random numbers?
@figlesquidge Typical stream ciphers don't come with a meaningful proof of security. Security of symmetric primitives generally comes down to "many smart cryptographers tried to break it, but none succeeded".
Jan
22
comment inverse of scalar multiplier in ECC
My mistake. You're right. A simple modular inverse should do the trick. Computing a modular inverse costs about 10% of a scalar multiplication $aQ$. So computing $a^{-1}Q$ is dominated by the cost of multiplying $Q$ with $a$.
Jan
21
comment TLS: Is Integrity assured when using NULL cipher
1) How much data do you send per connection? For short connections the handshake cost will dominate. Switching to ECDHE-ECDSA should reduce the cost of the initial handshake. 2) Do both server and client support some form of session resumption? Session resumption allows you to omit the handshake when establishing multiple connections. 3) What CPU are you using? On CPUs with AES-NI, AES is very fast, consider using TLS 1.2 with AES-GCM on those CPUs.
Jan
21
comment How to ensure that a “received value” is not altered?
Sounds like a standard unsolvable DRM problem. Only thing you can do is throwing obfuscation at it and praying.
Jan
20
comment In what way is XXTEA really vulnerable?
I'd agree with you if this question were about actual security. But since this question is about DRM (a licensing scheme) it almost certainly relies on security-through-obscurity. Compared to the attacker simply extracting the key or patching the software, the risk arising from a weak blockcipher like XXTEA is probably negligible.
Jan
20
comment Are there groups where the computational Diffie Hellman problem is easy but the discrete log problem is hard?
AFAIK there are no know groups where this is the case, but we know no proof that shows they don't exist either.
Jan
20
comment In what way is XXTEA really vulnerable?
"there are other, simpler ways to defeat the licensing mechanism than launching a cryptographic attack on the license file data." I completely agree with that statement. But it's not clear to me that you actually want encryption in the first place. A MAC or a digital signature might fit your needs better.
Jan
20
comment Which is better ECDHE with TLS 1.0
@fgrieu 1) Most browsers mitigate BEAST, even on TLS 1.0 2) BEAST (like all other attacks based on TLS using MtE instead of EtM) is inherently an active attack. RC4 has some weaknesses even against passive attacks. 3) BEAST seems to be tricky to exploit in practice. The original attack needed browser features/bugs no longer present.
Jan
17
comment Which is better ECDHE with TLS 1.0
@GiovanniNervi Some clients are vulnerable to BEAST. The rest have implemented workarounds even on TLS 1.0. I consider BEAST to be a smaller issue than RC4 sucking.
Jan
17
comment Which is better ECDHE with TLS 1.0
At minimum you can eliminate 3DES, it's strictly worse than AES. And NULL is obviously not useful either when you're interested in confidentiality.
Jan
17
comment what's the advantages of identity-based systems over certificate-based ones?
You don't need to be able to be able to obtain the public key of the recipient before you can encrypt a message to them since you can compute it. That's pretty much the only advantage over certificated based PKI and comes at the steep price of the central authority being able to decrypt everything.
Jan
16
comment Distributed integer factorization?
How large are the semi primes you want to factor? AFAIK the most expensive subprocess for 512 bit and 1024 moduli is a different one, and one of them is hard to distribute.
Jan
15
comment Ephemeral Diffie-Hellman generator selection
Why don't you simply hardcode a default group?
Jan
15
comment Decryption honeypots
TrueCrypt hidden volumes
Jan
15
comment FIPS 140-2 compliant algorithms in Enhanced RSA and AES Cryptographic Provider (Windows XP)
@RX_DID_RX 1) Do you need to use that particular implementation? There are plenty of SHA-2 implementations that work on XP. 2) Do you need a FIPS certified implementation, or just a compliant algorithm?
Jan
15
comment FIPS 140-2 compliant algorithms in Enhanced RSA and AES Cryptographic Provider (Windows XP)
@RX_DID_RX I believe it's approved for some, but not all uses. But even if it's allowed, why use an old and broken function in new code?
Jan
15
comment FIPS 140-2 compliant algorithms in Enhanced RSA and AES Cryptographic Provider (Windows XP)
cross posted on stackoverflow
Jan
14
revised how do you calculate the private exponent in asymmetric key encryption
added 25 characters in body; edited tags