10,257 reputation
12452
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 5 months
seen 25 mins ago

Jan
9
comment Can I use HMAC-SHA1 in counter mode to make a stream cipher?
Yes, CTR mode works with any PRF. HMAC-SHA1 is a decent PRF.
Jan
9
answered implication of tweak on bruteforcing a block cipher
Jan
9
comment implication of tweak on bruteforcing a block cipher
Your definition of tweak is weird. It's closer to an IV than to a tweakable blockcipher.
Jan
9
comment Why do I need to add the original salt to each hash iteration of a password?
There is essentially no security difference between your two suggestions (or PBKDF2) as long as the hash function is good and has a large enough output size (SHA-512 fulfills both requirements). One ugly property is that you don't cleanly separate salt and password. And of course it can't compete with the current generation of memory hard password hashes like scrypt.
Jan
9
comment RSA key length choice for TLS when confidentiality not important?
Have you considered ECC? It has a better security/performance trade-off for most applications. For example a 225 bit curve has security comparable to RSA-2048.
Jan
9
comment Can you show how that RSA does/doesn't provide anonymity?
Take a look at the paper Hans-Joachim Knobloch - Breaking Public Keys - How to Determine an Unknown RSA Public Modulus and this related discussion on a crypto mailing list: Why using asymmetric crypto like symmetric crypto isn't secure
Jan
9
comment Can you show how that RSA does/doesn't provide anonymity?
The attack fgrieu hinted at isn't possible if both $N$ are close together. For example one could choose the 128 most significant bits of $N$ to be 1.
Jan
8
comment Why encrypting with private and public keys produce the same result?
"all modulo $N$", modulo $\lambda(N)$ or modulo $\phi(N)$ not, modulo $N$.
Jan
8
comment Why is the security of block cipher not a function of key and tweak?
With most modes the tweak isn't secret. It's typically known by the adversary and sometimes even chosen by them. For example with disk encrytion, you often use a tweakable blockcipher in an ECB like mode where the tweak is the block index. (AES-XTS is essentially a tweakable blockcipher).
Jan
8
comment Distinguishing attack on CBC-MAC
Random functions have collisions, random permutations (block ciphers) don't. See Is it possible to distinguish a securely-encrypted ciphertext from random noise? I'd guess the paper describes a variant of that, but I didn't look at it.
Jan
7
comment Why use CBC-MAC? Why not just apply hash function on the whole message?
CBC-MAC is secure for prefix free messages. Fixed length is a sufficient condition, but not necessary.
Jan
7
comment Why use CBC-MAC? Why not just apply hash function on the whole message?
@evening CBC-MAC is based on a block cipher. In practice it's usually a better idea to use HMAC-SHA-2 instead of CBC-MAC with AES.
Jan
7
comment Why use CBC-MAC? Why not just apply hash function on the whole message?
1) Hash != MAC 2) Most hash functions divide the message into blocks internally 3) MACs don't need to be collision resistant, and CBC-MAC isn't. 4) I don't get your questions
Jan
7
comment is there an algorithm to encrypt all the datatypes?
Typical encryption algorithms operate on sequences of bytes. All of those data-types can be serialized to bytes, so the all can be encrypted with any common algorithm. The ciphertext won't conform to typical video/audio/... formats. It's just a bunch of bytes.
Jan
6
comment Is Curve25519-java secure?
That Ed25519 implementation is glacially slow. Both the Curve25519-java implementation and the ed25519-java you linked aren't constant time, and thus potentially open to timing attacks (probably not a practical issue in this context).
Jan
6
comment Is Curve25519-java secure?
Curve25519-java supports signing, but that wasn't in the original code and thus hasn't seen much review. It's also missing the other Ed25519 goodies, such as deterministic signatures, batch verification, or the faster fixed base multiplication.
Jan
6
comment Is Curve25519-java secure?
As far as we know, Curve25519 itself is secure. But Curve25519 as specified by Bernstein only supports key-exchange, not signing. For signing I recommend using the related Ed25519 instead.
Jan
6
revised In this example, which is a premaster secret, and which is a master secret?
[Edit removed during grace period]
Jan
4
comment Deterministically combine more than one source of entropy
can't you just hash them and map the hash to 0..1?
Jan
4
revised Can we ensure the security of a crypto-algorithm and -implementaton against acoustic cryptanalysis?
added 12 characters in body