Reputation
14,570
Next tag badge:
102/100 score
17/20 answers
Badges
1 36 76
Newest
 Nice Answer
Impact
~290k people reached

Apr
7
comment If we should not reuse primes in DH, shouldn't we not reuse ECDH elliptic curve properties?
I think DJB published a paper about reducing DL computation time or cost to $n^{1/3}$ for ECC, but it requires ridiculous precomputations and I don't even think it reduces the DL cost in realistic cost models (that properly handle memory).
Apr
7
answered What info should be signed with a digital signature to provide entity authenticaton for DH?
Apr
6
comment Do I need to use a MAC with asymmetric encryption?
Using the same key for encryption and authentication is discouraged.
Apr
6
comment Can XTS + checksum be used for authenticated encryption?
You might want to take a look at OCB mode, it uses simple xor as checksum.
Apr
5
revised Why is CRC said to be linear?
added 70 characters in body
Apr
5
comment A block cipher whose key changes after each block
Related: XTS
Apr
3
revised The state in RC4-128
edited title
Apr
3
comment The state in RC4-128
1) The state is always 256+2 bytes. 2) What do you mean by a 4x3 bit key? RC4 operates on bytes and your talking about RC4-128 suggests that you're using a 128 bit key.
Apr
2
awarded  Nice Answer
Apr
2
comment What asymmetric key exchange algorithms are known besides DH?
I think there is some super singular elliptic curve isomorphism thingy. No idea how practical it is.
Apr
2
comment If we should not reuse primes in DH, shouldn't we not reuse ECDH elliptic curve properties?
You can (and IMO should) hardcode primes for classical Diffie-Hellman. Just make sure they're big enough.
Mar
31
comment How is this for security?
Requests for analyzing or reviewing full cryptographic schemes/algos are off-topic. Try to break it down into specifics, such as "under condition A, does structure B have desired property C?"
Mar
30
comment Can an analog of ChaCha with 64-bit words be defined, and would it be secure?
@otus Since ChaCha runs in CTR mode, you can operate on as many blocks at the same time as you want. Typical SIMD ChaCha implementations work on two or three blocks. Hashing is different, because one block depends on the output of the previous block and parallelizable modes come with extra overhead.
Mar
30
comment Can an analog of ChaCha with 64-bit words be defined, and would it be secure?
@otus Using SIMD, two 32 bit operations have the same cost as one 64 bit operation. Thus using the same number of rounds for 32 and 64 bit ChaCha would result in the same performance. As far as I can tell, the 64 bit variant is only faster when you can't use SIMD on a 64 bit CPU.
Mar
30
reviewed Approve What are the applications of sha3 algorithm?
Mar
30
comment Can an analog of ChaCha with 64-bit words be defined, and would it be secure?
I see no reason why it shouldn't be secure with sufficient rounds. But if you have access to SIMD instructions, ChaCha should be just as fast, so I don't really see a reason to use 64-bit ChaCha.
Mar
30
comment About MAC and HMAC
Also the biggest issue with encypt-and-MAC is that it doesn't provide confidentiality.
Mar
30
comment Which is the longest CSPRNG?
You can easily design PRNGs with arbitrary long periods (or if you admit unbounded memory use even infinite periods), but like poncho said, longer periods offer no advantage once the period is long enough to never repeat in practice.
Mar
29
comment Authenticated encryption with Enc-Sign-Mac
I'd use sign-then-authenticated-encryption, where authenticated encryption may be built using encrypt-then-MAC.
Mar
28
comment Bitwise method of generating r for RSA-KEM
Since a CSPRNG seeded from a low/no entropy seed still produces a random looking sequence, that doesn't seem like a worthwhile protection to me. Also mapping 0 to 2 won't help you in that case, since you can guess it just as easily.