10,282 reputation
12452
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 5 months
seen 7 mins ago

Jan
22
comment How can i predict the next number of a long sequence of seemingly random numbers?
@figlesquidge Typical stream ciphers don't come with a meaningful proof of security. Security of symmetric primitives generally comes down to "many smart cryptographers tried to break it, but none succeeded".
Jan
22
comment inverse of scalar multiplier in ECC
My mistake. You're right. A simple modular inverse should do the trick. Computing a modular inverse costs about 10% of a scalar multiplication $aQ$. So computing $a^{-1}Q$ is dominated by the cost of multiplying $Q$ with $a$.
Jan
21
comment TLS: Is Integrity assured when using NULL cipher
1) How much data do you send per connection? For short connections the handshake cost will dominate. Switching to ECDHE-ECDSA should reduce the cost of the initial handshake. 2) Do both server and client support some form of session resumption? Session resumption allows you to omit the handshake when establishing multiple connections. 3) What CPU are you using? On CPUs with AES-NI, AES is very fast, consider using TLS 1.2 with AES-GCM on those CPUs.
Jan
21
comment How to ensure that a “received value” is not altered?
Sounds like a standard unsolvable DRM problem. Only thing you can do is throwing obfuscation at it and praying.
Jan
20
comment In what way is XXTEA really vulnerable?
I'd agree with you if this question were about actual security. But since this question is about DRM (a licensing scheme) it almost certainly relies on security-through-obscurity. Compared to the attacker simply extracting the key or patching the software, the risk arising from a weak blockcipher like XXTEA is probably negligible.
Jan
20
comment Are there groups where the computational Diffie Hellman problem is easy but the discrete log problem is hard?
AFAIK there are no know groups where this is the case, but we know no proof that shows they don't exist either.
Jan
20
comment In what way is XXTEA really vulnerable?
"there are other, simpler ways to defeat the licensing mechanism than launching a cryptographic attack on the license file data." I completely agree with that statement. But it's not clear to me that you actually want encryption in the first place. A MAC or a digital signature might fit your needs better.
Jan
20
comment Which is better ECDHE with TLS 1.0
@fgrieu 1) Most browsers mitigate BEAST, even on TLS 1.0 2) BEAST (like all other attacks based on TLS using MtE instead of EtM) is inherently an active attack. RC4 has some weaknesses even against passive attacks. 3) BEAST seems to be tricky to exploit in practice. The original attack needed browser features/bugs no longer present.
Jan
17
comment Which is better ECDHE with TLS 1.0
@GiovanniNervi Some clients are vulnerable to BEAST. The rest have implemented workarounds even on TLS 1.0. I consider BEAST to be a smaller issue than RC4 sucking.
Jan
17
comment Which is better ECDHE with TLS 1.0
At minimum you can eliminate 3DES, it's strictly worse than AES. And NULL is obviously not useful either when you're interested in confidentiality.
Jan
17
comment what's the advantages of identity-based systems over certificate-based ones?
You don't need to be able to be able to obtain the public key of the recipient before you can encrypt a message to them since you can compute it. That's pretty much the only advantage over certificated based PKI and comes at the steep price of the central authority being able to decrypt everything.
Jan
16
comment Distributed integer factorization?
How large are the semi primes you want to factor? AFAIK the most expensive subprocess for 512 bit and 1024 moduli is a different one, and one of them is hard to distribute.
Jan
15
comment Ephemeral Diffie-Hellman generator selection
Why don't you simply hardcode a default group?
Jan
15
comment Decryption honeypots
TrueCrypt hidden volumes
Jan
15
comment FIPS 140-2 compliant algorithms in Enhanced RSA and AES Cryptographic Provider (Windows XP)
@RX_DID_RX 1) Do you need to use that particular implementation? There are plenty of SHA-2 implementations that work on XP. 2) Do you need a FIPS certified implementation, or just a compliant algorithm?
Jan
15
comment FIPS 140-2 compliant algorithms in Enhanced RSA and AES Cryptographic Provider (Windows XP)
@RX_DID_RX I believe it's approved for some, but not all uses. But even if it's allowed, why use an old and broken function in new code?
Jan
15
comment FIPS 140-2 compliant algorithms in Enhanced RSA and AES Cryptographic Provider (Windows XP)
cross posted on stackoverflow
Jan
14
revised how do you calculate the private exponent in asymmetric key encryption
added 25 characters in body; edited tags
Jan
12
comment Why use Needham-Schroeder if we have Diffie-Hellman?
Needham-Schroeder was published in 1978, Diffie-Hellman in 1976. So DH was new and unproven back then, so based a protocol purely on symmetrical primitives might have been a good idea. Now DH is over 30 years old and has seen a lot of analysis, so it's far more trustworthy now. CPU power has grown a lot as well, which is important since asymmetric crypto is more expensive than symmetric crypto.
Jan
12
comment Why use Needham-Schroeder if we have Diffie-Hellman?
Which Needham-Schroeder are you referring to? The symmetric or the asymmetric? But I'd assume the main reason for choosing either of them is historical. I doubt anybody would design a new protocol based on NS.