9,834 reputation
12450
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 3 months
seen 40 mins ago

Jan
15
comment FIPS 140-2 compliant algorithms in Enhanced RSA and AES Cryptographic Provider (Windows XP)
@RX_DID_RX I believe it's approved for some, but not all uses. But even if it's allowed, why use an old and broken function in new code?
Jan
15
comment FIPS 140-2 compliant algorithms in Enhanced RSA and AES Cryptographic Provider (Windows XP)
cross posted on stackoverflow
Jan
14
revised how do you calculate the private exponent in asymmetric key encryption
added 25 characters in body; edited tags
Jan
12
comment Why use Needham-Schroeder if we have Diffie-Hellman?
Needham-Schroeder was published in 1978, Diffie-Hellman in 1976. So DH was new and unproven back then, so based a protocol purely on symmetrical primitives might have been a good idea. Now DH is over 30 years old and has seen a lot of analysis, so it's far more trustworthy now. CPU power has grown a lot as well, which is important since asymmetric crypto is more expensive than symmetric crypto.
Jan
12
comment Why use Needham-Schroeder if we have Diffie-Hellman?
Which Needham-Schroeder are you referring to? The symmetric or the asymmetric? But I'd assume the main reason for choosing either of them is historical. I doubt anybody would design a new protocol based on NS.
Jan
12
comment Methods of making ASIC/GPU resistant encryption?
For most primitives we can simply choose keys large enough to resist brute-force, even with ASIC. Larger keys are cheap for the defender, but exponentially expensive for the attacker. For example a 256 bit AES key is $2^{128}$ times to break as expensive as a 128 bit AES key, but only 1.4 times as expensive to use. Only a few cases we're desperate enough to use expensive operations, usually to compensate for the limits of humans (e.g. users not being willing to memorize secure passwords).
Jan
10
comment ECC - Point Addition/Point Multiplication
An important alternative to euclid is exponentiation. Since you can reduce exponents modulo $\phi(p)=p-1$, computing $x^{-1}$ is equivalent to computing $x^{p-2}$. The big advantage of this technique is that the code has no branches depending on $x$, so it can be implemented in constant time, avoiding side channel attacks.
Jan
9
comment Can I use HMAC-SHA1 in counter mode to make a stream cipher?
A PRF is a keyed primitive, a hash isn't. So the terminology doesn't apply directly. But pretty much all symmetric crypto relies on belief.
Jan
9
comment How is the AEScrypt password related to the underlying AES key
@StephenTouset Most ad-hoc password hashing schemes will have the same security as PBKDF2. Possibly even a bit more, since PBKDF2 invites low performance implementations. Specification wise PBKDF2 is pretty silly as well.
Jan
9
comment Can I use HMAC-SHA1 in counter mode to make a stream cipher?
Yes, CTR mode works with any PRF. HMAC-SHA1 is a decent PRF.
Jan
9
answered implication of tweak on bruteforcing a block cipher
Jan
9
comment implication of tweak on bruteforcing a block cipher
Your definition of tweak is weird. It's closer to an IV than to a tweakable blockcipher.
Jan
9
comment Why do I need to add the original salt to each hash iteration of a password?
There is essentially no security difference between your two suggestions (or PBKDF2) as long as the hash function is good and has a large enough output size (SHA-512 fulfills both requirements). One ugly property is that you don't cleanly separate salt and password. And of course it can't compete with the current generation of memory hard password hashes like scrypt.
Jan
9
comment RSA key length choice for TLS when confidentiality not important?
Have you considered ECC? It has a better security/performance trade-off for most applications. For example a 225 bit curve has security comparable to RSA-2048.
Jan
9
comment Can you show how that RSA does/doesn't provide anonymity?
Take a look at the paper Hans-Joachim Knobloch - Breaking Public Keys - How to Determine an Unknown RSA Public Modulus and this related discussion on a crypto mailing list: Why using asymmetric crypto like symmetric crypto isn't secure
Jan
9
comment Can you show how that RSA does/doesn't provide anonymity?
The attack fgrieu hinted at isn't possible if both $N$ are close together. For example one could choose the 128 most significant bits of $N$ to be 1.
Jan
8
comment Why encrypting with private and public keys produce the same result?
"all modulo $N$", modulo $\lambda(N)$ or modulo $\phi(N)$ not, modulo $N$.
Jan
8
comment Why is the security of block cipher not a function of key and tweak?
With most modes the tweak isn't secret. It's typically known by the adversary and sometimes even chosen by them. For example with disk encrytion, you often use a tweakable blockcipher in an ECB like mode where the tweak is the block index. (AES-XTS is essentially a tweakable blockcipher).
Jan
8
comment Distinguishing attack on CBC-MAC
Random functions have collisions, random permutations (block ciphers) don't. See Is it possible to distinguish a securely-encrypted ciphertext from random noise? I'd guess the paper describes a variant of that, but I didn't look at it.
Jan
7
comment Why use CBC-MAC? Why not just apply hash function on the whole message?
CBC-MAC is secure for prefix free messages. Fixed length is a sufficient condition, but not necessary.