9,417 reputation
12345
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years
seen 11 hours ago

Jun
19
comment Is a 1024-bit DSA key considered safe?
AFAIK a DSA cracker requires a few hundred times the RAM of an RSA cracker, so I'd assume that cracking a DSA key is a few hundred times more expensive than cracking an RSA key of the same size. Further evidence towards DSA being stronger is that the largest solved discrete logarithms over prime fields are smaller than the largest factored semi-primes.
Jun
19
comment Is a 1024-bit DSA key considered safe?
What's the size of the subgroup q? If it's only 160 bits, this is probably a weaker point than the 1024 bit modulus. If it's 224 bits it's clearly strong enough.
Jun
17
comment curve25519 weak points for contributory behaviour
Discussion of the effect of weak points on Ed25519 signatures It's possible to forge messages that crypto_sign_open verifies if the public key is zero
Jun
17
comment What are good combinations of public key algorithms or primitives for long term security?
Combining public key encryption schemes is easy: just do independent key exchanges and then hash the shared secret to produce a combined shared secret. Encrypt the actual message with symmetric crypto as usual.
Jun
17
comment Is HMAC needed for a SHA-3 based MAC?
This question is pretty similar to Can Skein be used as a secure MAC in format H(k || m)?
Jun
17
comment Is HMAC needed for a SHA-3 based MAC?
Use the key as prefix not as suffix. Key as suffix is secure as well as long as SHA-3 remains unbroken, but falls once a collision attack is found. If you don't care about the performance cost, still using HMAC is a good choice as well.
Jun
16
comment Functions that are only second-preimage resistant?
@fgrieu I don't see how proving that helps.
Jun
16
reviewed Edit What does it mean that a protocol realizes “strong mutual authentication”?
Jun
16
revised What does it mean that a protocol realizes “strong mutual authentication”?
added 5 characters in body
Jun
16
reviewed Leave Open What are the consequences of not checking the server mac in a TLS connection?
Jun
13
comment RSA decrypting of a huge file by parts
With the edit things get even more confused since RSA private keys aren't used for encryption.
Jun
11
comment Given $n$ bits, how many “truly random” sequences/numbers can be constructed?
@RickyDemer Kolmogorov is cute, but unfortunately very theoretical. Only useful for long messages and cannot be computed. Even simplifications are exponentially expensive.
Jun
11
comment Given $n$ bits, how many “truly random” sequences/numbers can be constructed?
Shannon entropy is only defined for a generation process, not for an individual sequence. If a good generator produces an all zero sequence, that's still perfectly random even if it doesn't look like it.
Jun
7
comment What differences between Menezes–Vanstone ECC and ElGamal ECC?
If you want practical ECC encryption, use ECIES. It's simple and offers strong security.
Jun
6
comment Pick faster private exponent
You could consider multi-prime RSA if your implementation supports it.
Jun
4
comment Padding to increase entropy and size of (otherwise) small JSON objects
If you're using proper encryption (with a per-message IV) you don't need to pad the message.
Jun
4
comment Comparing two values without revealing them
This may be usable as fallback solution, but generally order preserving encryption leaks a bit much. If there is an efficient ZKP, it will be much stronger than OPE.
Jun
4
comment Comparing two values without revealing them
This seems to be a combination of a commitment and a zero knowledge proof. Your hashes solve the commitment part, but make the ZKP part impossible. There is a similar problem called Yao's Millionaires' Problem but there alice knowns one value and bob the other. You should search for "Zero knowledge proof" or perhaps "secure multi party computation".
Jun
3
comment Montgomery Ladder vs Double-and-Add
On montgomery curves montgomery ladders enable cheap addition via differential addition in x/z form. In most other situations I'd rather create a lookup table with 32 or so entries and then double 5 times followed by one lookup and one addition.
Jun
2
revised Is the first version of the Message-Digest algorithm by Ronald Rivest publically available?
edited body