9,457 reputation
12346
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years
seen 15 hours ago

Oct
16
comment Can we decrypt in this order when the message is encrypted twice?
It's important to note that xor isn't secure if the attacker can observe the intermediate values $E_{k_1}(i)$ and $E_{k_2}(i)$, so e.g. using xor with a three-pass-protocol is completely broken.
Oct
16
comment Can we decrypt in this order when the message is encrypted twice?
Search for commutative encryption. There are several related questions on stackoverflow, but you can't trust their answers for security.
Oct
16
comment Can we decrypt in this order when the message is encrypted twice?
You can do it with CTR or OFB. But depending on which intermediate steps an attacker can observe, it's not secure. You need to describe your model, at which points an attacker observes the data clearly. Else you'll end up with a scheme that works but isn't secure.
Oct
15
awarded  Enlightened
Oct
14
awarded  Nice Answer
Oct
14
reviewed Reviewed Encoding numbers that can be decoded mentally?
Oct
14
revised Encoding numbers that can be decoded mentally?
added 3 characters in body
Oct
14
reviewed Reviewed Can one build a one-way function from AES?
Oct
14
revised Can one build a one-way function from AES?
added 47 characters in body
Oct
14
reviewed No Action Needed Where could I submit my algorithm?
Oct
14
comment Using same keypairs for crypt and sign with elliptic curve
Even RSA might allow this, as long as the padding is designed with joint security for signing and encrypting in mind. With blind RSA signatures you can't use the same key for anything else, but you can still reuse the modulus with a different e.
Oct
14
comment Reuse of a DH / ECDH public key
IMO RSA is inferior for most applications. 1) Its private key operation is slower, especially at high security levels. 2) It's size overhead is bigger, both for the encrypted key and for the public key. (32 bytes vs ~300 bytes). 3) It can't authenticate to the recipient without signing (deniable authentication) => I'd only use RSA for legacy application, or when you need its special properties (e.g. blind signatures)
Oct
14
comment PGP encryption options
I'd avoid the old ones (Cast, 3DES, IDEA), and prefer AES or TwoFish. But for all of them, it's unlikely that the strength of symmetric encryption is the weakest point of your system. Spend your time creating a secure end-point and being careful about where you get public keys, rather than worrying about the strength of symmetric ciphers.
Oct
13
comment How long does it take a quantum computer to brute force AES?
@e-sushi If NSA isn't far ahead of D-Wave, then we'll be safe for decades.
Oct
12
comment How much is slower GCM AES-128 than one of the stream chipher eSTREAM?
The first place to go for performance checks is eBACS. Unfortunately it has its flaws. In particular I suspect that its AES implementations are far from optimal on some platforms.
Oct
12
comment How much is slower GCM AES-128 than one of the stream chipher eSTREAM?
1) That's an apples to oranges comparison. eSTREAM is about unauthenticated stream ciphers, you need to compare with AES-CTR. 2) Which CPU? With AES-NI it's really fast, faster than eSTREAM ciphers. On other CPUs it can it might be 5x slower,... 3) with or without side-channel protection? Implementations of GHASH on CPUs without specialized instructions uses large lookup tables, leading to low key agility and potential cache timing attacks.
Oct
12
revised ChaCha cipher + Poly1305
edited tags
Oct
12
answered Why does NaCl's crypto_secretbox for xsalsa20-poly1305 require the first 32 bytes to be zero?
Oct
12
comment How many messages needs to be send to server to get AES key in Cache-timing Attack
Depends a lot on how well you can measure the timing. Bernstein used a setup with pretty accurate timing information.
Oct
11
comment Key-size of encryption method
AES-256 uses a 256 bit or 32 byte key by definition. No more, no less.