Reputation
13,641
Next tag badge:
99/100 score
17/20 answers
Badges
1 34 70
Impact
~260k people reached

Jan
28
comment Security issues with self encryption?
Known as convergent-encryption or message-locked-encryption.
Jan
25
comment help with cryptanalysis of a sponge permutation
The reason you can't invert your permutation is because it is no permutation. The approach is similar to an unbalanced Feistel, but you made the mistake of including the half you want to modify in the F function you xor into it.
Jan
25
comment Is there any more information on this RSA backdoor?
The backdoor you describe is detectable (Compressed ECC points are distinguishable from random data), but it can be made undetectable with minor modifications (e.g. randomly picking a point from the curve or its twist). The size of the fixed data can be halved by deriving the seed from the shared secret instead of encrypting it.
Jan
24
comment Recommendation for lightweight algorithm for partial message encryption
I'd rather use ChaCha over BLAKE2 in CTR mode. ChaCha is faster and is build from some kind of hash function in CTR mode already.
Jan
24
comment Why do we implement a protocol?
@LightnessRacesinOrbit If you're an academic, publishing a paper about your castle in the air might be enough.
Jan
23
comment Best attack on double DES followed by XOR with third key
@MaartenBodewes 1) The MitM against 3DES is more complicated and might require a lot of memory. 2) The security decrease given many plaintext/ciphertext pairs might be much bigger than what 3DES loses. 3) This is essentially a hybrid of DES-X conceptually and 3DES.
Jan
23
comment Best attack on double DES followed by XOR with third key
The best attack I see is brute-forcing $k_1$ and $k_2$ at the same time and xor-ing out $k_3$, for a total cost of $2^{112}$ with little memory. But that's pretty far from your 2DES claim.
Jan
19
comment Recommendation for lightweight algorithm for partial message encryption
1) Why only encrypt such a small part? If it's for performance reasons, most CPUs can encrypt faster than your network connection. 2) Relative performance of ciphers varies greatly across platforms. A Desktop with AES NI, a mobile phone and an embedded system are quite different.
Jan
18
comment Could we share a secret key using the Birthday problem?
You might be interested in Merkle's puzzles
Jan
18
reviewed No Action Needed Determining if Server/Client's TLS configuration is Vulnerable to SLOTH
Jan
16
revised Zero Knowledge Argument for Subset Sum
added 108 characters in body; edited tags
Jan
16
comment Are there any advantages in using proprietary encryption?
I only see it as an advantage of a commercial implementation over an open source one.
Jan
16
comment Are there any advantages in using proprietary encryption?
I read the question as being about secret algorithms, not just about being a commercial implementation that doesn't come with source code.
Jan
16
reviewed Approve Guarding against cryptanalytic breakthroughs: combining multiple hash functions
Jan
15
comment Are there any simple and yet secure encryption algorithms?
But AFAIK even weaker than RC4.
Jan
15
comment Are there any advantages in using proprietary encryption?
If you have the internal expertise to evaluate a cipher, perhaps. But apart from the NSA, who does?
Jan
13
comment Are low security curves for ECDSA not supported?
If signature size is a problem, consider using BLS signatures which have half the size of ECDSA signatures.
Jan
13
comment What is difference between meet in the middle attack and man in the middle attack?
"halving the effort" is misleading as well. Typically it reduces the effort to the square-root of the original effort, halving the strength of the encryption in bits (which scaled like the logarithm of the effort).
Jan
13
comment What is difference between meet in the middle attack and man in the middle attack?
I don't think that meet-in-the-middle necessarily involves a space-time trade-off. For example collision finding or computing ECDLP require little memory yet are a meet-in-the-middle attack.
Jan
13
comment Difference between AES CMAC and AES HMAC?
Where did you read about AES HMAC? Perhaps you misunderstood and the source was talking about authenticated encryption that encrypts using AES (e.g. in CTR mode) and adds HMAC-SHA-* for integrity?