Reputation
14,430
Next tag badge:
102/100 score
17/20 answers
Badges
1 36 76
Newest
 Nice Answer
Impact
~288k people reached

Apr
9
comment Is there a German word for computationally secure?
I'd say "sicher gegen Angreifer mit beschränkter Rechenleistung".
Apr
9
comment What's the reasoning behind the design of the TLS 1.2 PRF?
If TLS were designed today, we'd probably use HKDF instead.
Apr
8
comment Encrypt-then-HMAC implementation - am I doing it right?
@RalphP The attacker doesn't need the full 640 bits to confirm the password. Either the MAC or the encryption key is enough. So if you're using PBKDF2-HMAC-SHA-256 they can run the derivation once whereas the defender has to run it thrice.
Apr
8
comment Encrypt-then-HMAC implementation - am I doing it right?
A 640 bit salt is seriously overkill. 128 bits should be enough, 256 if you want to be generous.
Apr
7
comment Possible problems in using a hash algorithm to construct a stream cipher
HMAC halves the performance (in CTR mode at least) and the security improvement is rather dubious. Just make sure to use the key as first input and always use the same message length and a plain hash should be fine.
Apr
7
comment Is there any IND-CPA secure stream cipher with a “standard” hardness assumption?
I wonder if DualEC-DRBG fits the bill.
Apr
7
comment How strong is the ECDSA algorithm?
I suspect that the weird ECC sizes in those tables are simply the sizes of standardized curves and don't reflect security differences between binary and prime fields.
Apr
7
comment If we should not reuse primes in DH, shouldn't we not reuse ECDH elliptic curve properties?
I think DJB published a paper about reducing DL computation time or cost to $n^{1/3}$ for ECC, but it requires ridiculous precomputations and I don't even think it reduces the DL cost in realistic cost models (that properly handle memory).
Apr
7
answered What info should be signed with a digital signature to provide entity authenticaton for DH?
Apr
6
comment Do I need to use a MAC with asymmetric encryption?
Using the same key for encryption and authentication is discouraged.
Apr
6
comment Can XTS + checksum be used for authenticated encryption?
You might want to take a look at OCB mode, it uses simple xor as checksum.
Apr
5
revised Why is CRC said to be linear?
added 70 characters in body
Apr
5
comment A block cipher whose key changes after each block
Related: XTS
Apr
3
revised The state in RC4-128
edited title
Apr
3
comment The state in RC4-128
1) The state is always 256+2 bytes. 2) What do you mean by a 4x3 bit key? RC4 operates on bytes and your talking about RC4-128 suggests that you're using a 128 bit key.
Apr
2
awarded  Nice Answer
Apr
2
comment What asymmetric key exchange algorithms are known besides DH?
I think there is some super singular elliptic curve isomorphism thingy. No idea how practical it is.
Apr
2
comment If we should not reuse primes in DH, shouldn't we not reuse ECDH elliptic curve properties?
You can (and IMO should) hardcode primes for classical Diffie-Hellman. Just make sure they're big enough.
Mar
31
comment How is this for security?
Requests for analyzing or reviewing full cryptographic schemes/algos are off-topic. Try to break it down into specifics, such as "under condition A, does structure B have desired property C?"
Mar
30
comment Can an analog of ChaCha with 64-bit words be defined, and would it be secure?
@otus Since ChaCha runs in CTR mode, you can operate on as many blocks at the same time as you want. Typical SIMD ChaCha implementations work on two or three blocks. Hashing is different, because one block depends on the output of the previous block and parallelizable modes come with extra overhead.