10,532 reputation
12454
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 6 months
seen 6 hours ago

Mar
19
answered Why is Serpent faster than AES in this benchmark?
Mar
19
comment Why is Serpent faster than AES in this benchmark?
What CPU do you have? Intel? AMD? How fast? Which architecture?
Mar
19
comment Does a dynamic accumulator exist yet?
@DrLecter You still need a trusted party who promises to forget the factorization. While you can generate RSA moduli without knowing their factorization they're very big.
Mar
18
comment What is the importance of the $r$ and $c$ values for the Sponge Construction?
C=128 has a security level of 64 bits against certain attacks, but the output size is still unlimited.
Mar
18
comment Elliptic Curves of different forms
If you assume that the weierstrass implementation is safe, you only lose performance. Rigidness is the only property that directly relates to the security of the curve, all the other safety properties are about making it easier to write a fast and secure implementation. For example BouncyCastle C# is neither fast nor secure.
Mar
18
comment Is this a secure (and correct) sign-then-encrypt technique for transferring messages?
RSA is very fast for encryption and signature verification (public key operations) and slow for decryption and signing (private key operations). ECC has decent performance for all operations. If you sum the cost of encryption and decryption, RSA is certainly much slower than than its ECC equivalent (by a factor 10 or so).
Mar
18
comment Is this a secure (and correct) sign-then-encrypt technique for transferring messages?
IMO it's a silly design. 1280 bit RSA sucks for confidentiality but might be good enough for authentication. ECDSA on the other hand is trickier to use than RSA encryption, since it needs good randomness for each signature (unless you use an uncommon deterministic variant). Using EC-DH (256 bit) for key-exchange (and thus encryption) and RSA for signing would be a far better choice. Or just one algorithm for both.
Mar
18
comment Is the term “Elliptic Curve Discrete Logarithm Problem” a misnomer?
Mathematicians don't care how you call the basic operation. We commonly call it addition, but calling it multiplication is just as valid.
Mar
18
comment How do the following new (2013) ECC curves compare in security or efficiency?
The larger the curves the slower (but stronger) they are.
Mar
17
comment Is this an acceptable implementation of ARC4 encryption for my system?
@traxonja If you want authentication and encryption you could consider AES-CCM.
Mar
16
comment Elliptic Curves of different forms
Why do you want to use a montgomery/edwards curve if you then proceed to perform weierstrass form operations on them? To take advantage of montgomery form you need to use differential addition with an appropriate ladder. The whole point of supporting montgomery ladders is that you use them.
Mar
14
awarded  Nice Answer
Mar
13
comment Which eliptic curves in OpenSSL 1.0.1f meet all / most of the SafeCurves requirements?
Apart from rigidness those "weaknesses" are features of montgomery/edwards curves. Those features don't gain you anything if you use weierstrass form in your implementation.
Mar
13
comment Are there use cases where a signature itself needs to be signed?
@JohannesErnst I'd rather encapsulate it, like {data={...}, sigs=[{sig1}, {sig2}]}. If one signature needs to be signed, the outer signature can encapsulate the previous one, else add them to the array.
Mar
13
comment Are there use cases where a signature itself needs to be signed?
You should take a look at JSON Web Signature (JWS). I didn't read it myself, so I can't vouch for its quality.
Mar
13
revised Why does SHA-1 have 80 rounds?
added 149 characters in body
Mar
13
comment counter to indicate hotp count
@RichieFrame Shouldn't matter.
Mar
13
comment How do I convert the definition of E-521 into a curve definition a la Bouncy Castle?
I'd rather start with a Curve25519/Ed25519 and replace the field arithmetic operations. Converting to weierstrass misses the point of edwards/montgomery curves. Montgomery addition is differential, so you can't simply reuse the BC code for weierstrass scalar multiplication. Finding a $F_{521}$ implementation shouldn't be too hard, considering it's also used in NIST-P521.
Mar
13
revised Why does SHA-1 have 80 rounds?
added 11 characters in body; edited tags; edited title
Mar
13
answered Why does SHA-1 have 80 rounds?