10,847 reputation
12455
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 8 months
seen 4 hours ago

Mar
10
comment Sane implementations of Bitcoin cryptography routines w.r.t. side-channel attacks
Most operations don't need side channel resistance - they operate on public data. ECDSA signing is the major one, but even it is relatively hard to attack since you can't easily get high precision timing information.
Mar
10
comment Where can I download a database of RSA keys?
You probably could extract a bunch from the public SSL Observatory data dump.
Mar
10
comment Non-standard signature security definition conforming ed25519 malleability
@Gracchus There hasn't been a new version of SUPERCOP and most people wouldn't consider malleability a vulnerability of the signature scheme in the first place.
Mar
7
comment How to calculate the maximum output size for data encrypted with a RSA Private Key?
I've seen RSA/ECB/PKCS1Padding used in java contexts pretty often. But I'm not sure what it actually does. It might be equivalent to none, or perhaps it splits the message if it's too long.
Mar
7
comment 64 bit Elliptic Curve key?
Apart from being broken in a few minutes on a standard computer, there is nothing wrong with using a 64 bit field. The bigger problem is that you need to find curve parameters which requires understanding the mathematics behind ECC (Unless there are some standard SAGE scripts which do it for you).
Mar
7
comment Will non-ECC algorithms like RSA eventually become too inefficient?
A 128 bit security level is already pretty high. It seems unlikely to be that we'll get classical computers which can break that security level before we get quantum computers which kill all of ECC, finite field DH/DSA and RSA.
Mar
6
comment Key expiration policy for 3DES / TDES / Triple DES
1) Which MAC construction are you use? 2) Why choose 3DES over HMAC or even AES? 3) Attacks become likely as you approach 2^32 blocks, you should stay significantly below that value.
Mar
6
comment How to calculate the maximum output size for data encrypted with a RSA Private Key?
Oh I missed that you're using encrypting a hash with the private key, that's a bad idea. Use a standard signature algorithm instead. Either with the newer PSS padding or the PKCS1v1.5 signature padding, which unlike its encryption equivalent has no known weaknesses.
Mar
6
comment How to calculate the maximum output size for data encrypted with a RSA Private Key?
I also strongly recommend using OAEP padding over PBKS#1v1.5 padding for RSA encryption. The latter has weaknesses which can be exploited in many use cases and are annoying to work around.
Mar
6
comment How to calculate the maximum output size for data encrypted with a RSA Private Key?
Note that the input size will be smaller, since the padding will take some space.
Mar
6
comment Authenticated encryption without padding
To clarify: You want a transformation that detects modification but doesn't enlarge the ciphertext? That's impossible, since you need some form of redundancy to get detection. The closest you can get with length preserving encryption is that any change to the ciphertext will produce an unpredictable, random looking plaintext. But those transformations are not stream ciphers.
Mar
6
comment Is there a “brainwallet” for GPG keys?
@RobKohr If those were seven random independent words, this is a bit surprising, since I'd estimate that those have 80 bits of entropy or so, which should make it rather expensive to crack. If it was a quote from a book or movie, then they probably mined that source for quotes.
Mar
5
comment How fast can a wrong decryption key be detected using ECC?
@Sibbo bitmessage uses ECIES. This means that ECC is used to produce a shared key, which is then used for encryption (AES-CBC) and MAC (HMAC-SHA-256). A wrong key will lead to a MAC verification failure.
Mar
5
comment Fast modular reduction
@fgrieu I bet they want to do whatever Secp256k1 requires.
Mar
5
comment Long-term data protection, storage of old encrypted traffic and quantum cryptocalipse
@Thomas A big quantum speedup for travelling salesman would be a far bigger revelation than even breaking 4096 bit RSA, since QCs are not believed to solve NP complete problems quickly. D-Wave can solve one specific optimization problem which is closely related to their physical structure. They don't entangle many qubits at the same time, can't run shor, it's dubious that they even offer a quantum speedup for their one favourite optimization problem. In short, D-Wave is useless and not representative of real quantum computers.
Mar
5
comment Long-term data protection, storage of old encrypted traffic and quantum cryptocalipse
@Thomas Just because there are no large quantum computers yet,(don't remember the precise current state of the art, but it's around 5 qubits factoring huge semi-primes like 15) doesn't mean that there won't be such QCs twenty years from now. If you want long term confidentiality QCs resistance should be a consideration.
Mar
5
comment Prime factors of non-random keys
Another related article There’s no need to panic over factorable keys–just mind your Ps and Qs. @fgrieu That paper is pretty high on my list of "dumbest paper titles".
Mar
5
revised elgamal-encryption wiki description
deleted 76 characters in body
Mar
5
revised elgamal-encryption wiki excerpt
deleted 21 characters in body
Mar
3
comment Three-way hash collision
You get a $2^l$ way collision with cost $l \cdot 2^{64}$. So you get a 16-way collision with cost $2^{66} = 4 \cdot 2^{64}$ not just an eight-way collision.