Reputation
12,269
Next tag badge:
90/100 score
20/20 answers
Badges
1 31 61
Newest
 Enlightened
Impact
~212k people reached

Dec
21
comment The purpose of the final xor in Davies–Meyer scheme
The key size does not affect the cost of the MitM attack against a Davies-Meyer without Feed-Forward hash. It's the block size that determines the attack. A naive MitM against AES-256 in DM without FF would cost 2^64 memory and 2^64 AES invocations (parallelizable). But I believe the standard memory reduction techniques (distinguished points, cycle finding,...) apply, so the memory use should be much lower
Dec
21
comment The purpose of the final xor in Davies–Meyer scheme
I don't get your point. The cost of the MitM depends on the size of the chaining value (block size of the cipher) and works if the message consists of two blocks (where the block size of the hash function is the key size of the underlying blockcipher). To avoid the attack you need to have a chaining value which is at least twice the size of the desired pre-image resistance.
Dec
21
comment Find private exponent in RSA
Do you know the prime factors of the modulus?
Dec
21
answered Best hash-algorithm
Dec
21
comment Alternative encryption algorithm
What properties do you need? ChaCha is enjoying increased popularity, but being a stream cipher it's not suitable for every application. Depending on the application, authenticated encryption may be a better choice than plain encryption.
Dec
19
comment The purpose of the final xor in Davies–Meyer scheme
It enables a meet-in-the-middle attack, reducing pre-image resistance. Keccak suffers from this attack, which is why its preimage resistance is only half the capacity.
Dec
18
comment What would be the best plain text Cryptography method without the use of a computer?
See Is there any strong enough pen-and-paper or mind cipher?
Dec
18
revised Polynomial division hardware implementation
added 46 characters in body
Dec
18
revised Finding a collision for a hash function
added 1 character in body
Dec
18
comment Dancing confusion with Daniel J. Bernstein's stream ciphers
If you have a per session key, you still need a counter to distinguish messages. If you have a per message key (like noise) you don't need a nonce at all. If your protocol fits random nonces, use ciphers which support that. Choosing or designing a good protocol is the important part, choosing between Salsa20 and ChaCha a minor detail.
Dec
18
comment Dancing confusion with Daniel J. Bernstein's stream ciphers
For a random nonce you need XChaCha or XSalsa20. Finding an XChaCha implementation and making sure it's correct will be harder than finding a correct XSalsa20 implementation. So if you need long/random nonces, Salsa20 might be preferable over ChaCha.
Dec
18
comment Dancing confusion with Daniel J. Bernstein's stream ciphers
Deciding between Salsa20 and ChaCha is a matter of preference. Salsa20 has the advantage of having competed in eStream, being part of the NaCl library and a (rather limited) proof of security against differential cryptoanalyis. ChaCha has slightly better security per round, a bit more elegant and it's used in a TLS suite. Personally I'd choose ChaCha if either is equally practical to use but might prefer Salsa20 if I'm already using a library where it's implemented.
Dec
18
comment Dancing confusion with Daniel J. Bernstein's stream ciphers
How to handle nonces should mainly be decided by the requirements of the application. I would avoid keeping nonces between runs of an application, so if you reuse a key beyond application restarts a counter doesn't work well. But if you encrypt a sequence of messages in a communication protocol the key is typically per-connection and a counter works well.
Dec
17
revised Dancing confusion with Daniel J. Bernstein's stream ciphers
added 446 characters in body
Dec
17
answered Dancing confusion with Daniel J. Bernstein's stream ciphers
Dec
17
revised one time pad regarding
added 51 characters in body
Dec
16
comment What would be the best plain text Cryptography method without the use of a computer?
@tylo I don't know any secure hand cipher that's less terrible than the OTP from a usage point of view. RC4, solitaire etc. have the same key reuse problems.
Dec
15
comment Recovering El Gamal secret key from signatures
@Kairos Since this is a duplicate it has been closed and your bounty refunded. If you want to, you can offer a bounty on the duplicate.
Dec
15
comment request for data to test deterministic ecdsa signature algorithm for secp256k1
Thread on bitcointalk that has several test vectors: Deterministic Usage of DSA and ECDSA Digital Signature Algorithms (RFC 6979)
Dec
12
comment Decrypt all RSA ciphertexts if you can break 1% of them
I didn't mean your cross-post, but some older question.