9,586 reputation
12347
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 1 month
seen 28 mins ago

Aug
13
comment Is it possible to find plaintext from ciphertext if (n) and (a) are known for RSA?
Your claim that these are the easiest way of breaking RSA.
Aug
13
comment Is it possible to find plaintext from ciphertext if (n) and (a) are known for RSA?
Note that this only applies to properly padded RSA. Textbook RSA has weaknesses a plenty.
Aug
12
revised Security issues of a MAC-then-Encrypt-then-MAC approach?
edited title
Aug
12
comment Is XORing a SHA256 better than truncating it?
1) Just take the first 16 bytes. Simple and secure if SHA256 is. 2) Any unkeyed 128 bit hash has at most 64 bits of collision resistance. That's generally not considered secure. Either increase the size or introduce a key not known to the attacker (using HMAC-SHA-2).
Aug
12
comment Is XORing a SHA256 better than truncating it?
1) Using a cryptographic hash doesn't gain anything if SHA256 is already a secure hash 2) Length extensions are not applicable and don't work if you truncate the output of SHA256 to 128 bits.
Aug
12
comment Security issues of a MAC-then-Encrypt-then-MAC approach?
I don't think "plaintext integrity" is useful in the context of of MACs since a mismatch between MAC and cipher key can only happen if you messed up your protocol. I'd only use a similar approach if the inner authentication is a signature, not a MAC.
Aug
12
comment Hash or compression function in Merkle tree nodes?
In principle you can use compression functions if you know what you're doing. But the devil is in the details. Skein and Blake2 only pad to a full block, never adding an additional compression.
Aug
12
comment CTR mode encryption using PRG
Using Salsa20Core in CTR mode certainly results in a secure stream cipher -- that's precisely the way Salsa20 is defined in the first place.
Aug
12
revised pkcs11 wiki excerpt
added 56 characters in body
Aug
12
revised Currently i am doing decryption for RSA encoding and i face some problem with it
edited tags; edited tags
Aug
12
revised RSA encoding problem help
deleted 3 characters in body; edited tags
Aug
12
reviewed Approve suggested edit on Entropy of two concatenated random values
Aug
12
comment Are there any cryptographic flaws in my webhook signing process?
Why sign webhooks at all? I prefer a pattern where the recipient doesn't assume that the webhook is authentic and simply uses it as a trigger to fetch the relevant information. That fetch is authenticated and protected against replay attacks since it uses HTTPS with your server as target.
Aug
11
comment Computational Complexity - When is it really exponential time?
You wrote $n=2^{log_2 n}$ which makes no sense. DL has polynomial cost in the order of the group and exponential cost in the bitlength of the group order. If you want to be precise you can't say "this algorithm has exponential cost", you need to specify in which variable it is exponential. Colloquially we omit that specification if everybody knows which variable we're talking about.
Aug
11
comment Computational Complexity - When is it really exponential time?
You can't use $n$ to refer both the order of the group and its bitlength. Rename one of them, e.g. use $n = \log_2 N$
Aug
10
comment Help deciphering caesar cipher
1) Define the alphabet as string and use the indexOf function to simplify your code. 2) You can use a for loop for the rotation 3) Use alphabet.length instead of hardcoding the 27.
Aug
10
comment Streaming mode of operation that is more resistant against nonce reuse
A blockcipher in CFB mode only leaks the xor of the first block that differs and not the xor of the whole message. I think keccak's duplex mode has similar properties.
Aug
9
reviewed No Action Needed RSA Blind Signature Attack
Aug
8
comment Implementation and Testing of SRP-6a
@Andrey Slow hashes have the same purpose as with any other protocol - to protect the passwords if the database containing the hashes leaks.
Aug
8
comment Implementation and Testing of SRP-6a
Note that both SHA-1 and SHA-2 are bad as password hashes even when used in SRP (since they're fast). The modular exponentiation improves the situation somewhat since it's not as cheap as SHA1/2, but it's still cheaper than a proper password hash.