8,789 reputation
12041
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 2 years, 9 months
seen yesterday

Mar
28
comment Does repeated hashing create a PRF?
Your suggestion is trivially distinguishable from random data: just look at two consecutive blocks and check if the latter is the hash of the former. If you replace the hash by a keyed hash (like HMAC) this becomes the hash based equivalent of OFB mode, which is secure.
Mar
27
comment Is Curve25519-java secure?
I just looked at the NXT coin crypto implementation. They generate the nonce by reducing a 256 bit value modulo the order. Such a reduction causes a bias, which can be exploited for some curves (Bleicherbacher described an attack on DSA based on this). Ed25519 reduces a 512 bit number instead of a 256 bit number to avoid these biases. But NXT coin got lucky that the order of Curve25519 is very close to a power-of-two decreasing the bias, so as far as I can tell it can't actually be exploited.
Mar
27
comment Is Curve25519-java secure?
@Gracchus The API of Curve25519-java is so awkward that few people will be able to use it correctly. It doesn't matter if your crypto works in theory if nobody is able to use it.
Mar
27
comment Is Curve25519-java secure?
I just checked: It simply pushes the responsibility onto the caller. Since it's pretty hard to generate a good enough nonce, any caller who isn't a crypto expert will almost certainly get it wrong.
Mar
27
comment Use cases for “online” authenticated encryption?
Personally I think the "online" feature isn't very important for authenticated encryption. It might be useful for large files downloaded from an untrusted but rarely actually malicious source. But usually I'd prefer a (tree)hash or signed (tree)hash over a MAC in those scenarios.
Mar
26
revised Is substitution with random prefix codes secure?
added 66 characters in body
Mar
26
comment Defending hybrid encryption schemes against padding oracle attacks
@RickyDemer I don't think you can call it insecure per-se since the sender's private key is assumed to be secret. What you expect is a form of forward secrecy for the sender's side. Noise boxes on the other hand provide the property you want: "Noise boxes are "one-way" - they can be decrypted by the receiver, but not the sender."
Mar
26
comment Defending hybrid encryption schemes against padding oracle attacks
@nadavwr NaCl's crypto_box simply computes the shared DH key of the two input keys and encrypts the message with authenticated encryption. Quite similar to the scheme you describe. Knowledge of the sender's private key can encrypt messages sent from/to them. Protocol designers are expected to address this at a higher level, typically by using an ephemeral key to encrypt actual data and a separate DH exchange to authenticate with the sender's long term key.
Mar
26
comment Questions about hash functions
@PaŭloEbermann I don't think that this directly contradicts the basic security definitions. Indirectly it might do so, since it enables a MitM attack so you probably can only achieve $2^{n/2}$ pre-image resistance.
Mar
26
revised Lamport signature: How many signatures are need to forge a signature?
added 160 characters in body
Mar
26
comment Lamport signature: How many signatures are need to forge a signature?
@mephisto I was thinking about signing a hash (preferably a with an unpredictable prefix, as in Ed25519), but you're right that the OP didn't specify such hash-then-sign step. I've edited my answer to clarify that.
Mar
25
comment Is PBKDF2-HMAC-SHA1 really broken?
It might have one effect: The designers of entries to the password hashing competition will avoid these collisions.
Mar
25
answered Is PBKDF2-HMAC-SHA1 really broken?
Mar
25
comment Is PBKDF2-HMAC-SHA1 really broken?
Collision resistance isn't considered a required property for password hashes. So this is generally just a curiosity, not a vulnerability.
Mar
25
comment Challenge–response authentication which can be done in head?
1) The scenario you described is symmetric, since you and the doorman have a shared secret. 2) You need authentication, not encryption
Mar
22
comment Questions about hash functions
Even with Merkle-Damgard hashes like SHA-256 (which are vulnerable to length extensions attacks) are not vulnerable to length reduction attacks.
Mar
22
comment Rock-paper-scissors over network, how to protect from cheating server?
If the server pretends that it didn't receive Alice's plaintext, Alice will notice and avoid that server in the future.
Mar
20
comment Current standard security level for a hash function?
I prefer at least 128 bits of security for everything ( => use 256 bit hashes if you want collision resistance). If you care less or only need short term security you can go down to about 80 bits.
Mar
20
answered McEliece key size
Mar
20
awarded  Enlightened