Reputation
11,225
Next tag badge:
97/100 score
18/20 answers
Badges
1 25 57
Newest
 Informed
Impact
~181k people reached

Apr
15
revised Use cases for “online” authenticated encryption?
added 24 characters in body
Apr
14
comment Are there equivalent IVs in DES/CBC?
The first block (8 bytes) should differ if you use another IV.
Apr
14
comment Weaker alternative to Ed25519?
@Chris Why use crypto at all, if its extremely weak? 56 bits of security is rather dubious. You should rather figure out how to comply with the export regulations of your country. Some countries (like Germany) don't care at all. In the US you need to jump through a couple of bureaucratic hoops, but shouldn't be too difficult.
Apr
12
comment CTR_DRBG versus OFB_DRBG
Since AES is a pseudo-random-permutation not a pseudo-random-function, you can't apply the birthday problem and the average cycle length is $2^{127}$ not $2^{64}$.
Apr
12
comment CTR_DRBG versus OFB_DRBG
Average cycle length of AES-OFB is expected to be $2^{127}$, too big to matter in practice.
Apr
12
reviewed Close algebraic attacks for mixed operations (mod 2 and mod 256)
Apr
12
comment AES-XTS: find key from ciphertext and plaintext
There is no known efficient key-recovery attack against AES, no matter the mode of operation.
Apr
12
comment AES file encryption with PBKDF2. Safe parameters?
I'd stay with PBKDF2, bcrypt and scrypt for several more years. I don't consider the review the candidates received during the PHC competition sufficient to be really confident in their security.
Apr
12
comment Use cases for “online” authenticated encryption?
If you encrypt a movie, you should split the file into segments and authenticate them. It's a bad idea to release unauthenticated data to your video player. Why use authenticated encryption if you don't verify the tag until it's too late?
Apr
12
answered Use cases for “online” authenticated encryption?
Apr
12
comment Randomness in generation of Virtual Machines from pre-built Image
It's a general security question, not a cryptography question. It might fit security.se.
Apr
9
comment Is it possible to combine true streaming with AEAD?
Splitting the message into segments and authenticating each segment separately is the standard approach.
Apr
7
comment Salsa20-GCM composition secure?
Strictly speaking GCM has been defined using a 128 bit block cipher, but it's easy to generalize it to any stream cipher that takes a nonce and it's be secure that way. But I see little reason to do so, since GCM only works well if you have specialized instructions, which are typically only available on CPUs which can also accelerate AES.
Apr
3
comment How to encypt/decrypt messages after ECDH key agreement
Why did you tag this with PQ-crypto? Diffie-Hellman is not PQ secure, neither on finite fields, not on elliptic curves.
Apr
3
revised How to encypt/decrypt messages after ECDH key agreement
edited tags
Apr
3
comment Required key size for an ideal cipher with a 32 bit block size
@fgrieu A 16 GiB lookup table could fit into RAM and should have acceptable performance. Efficient key expansion from a minimal-size key minimal size key might be a bit trickier though.
Apr
2
comment Will there always be 256 collisions for the output of the MD5 hashsum function for 17-byte inputs?
@coder543 The whole bitcoin miner network computes around $2^{80}$ SHA256d hashes per year (burning several hundred million USD on hardware and electricity). While MD5 is a slightly cheaper than that, it'd still take it several trillion years to compute $2^{128}$ MD5 hashes.
Apr
2
comment Is there a need to encrypt data when send over https?
@MaartenBodewes Apparently the OP has an unusually painful voice :) "Doctor, it hurts when I do this." -- "Don't do that."
Apr
2
comment Is there a need to encrypt data when send over https?
As long as you ensure that you're talking to the correct server (typically by properly validating the server's certificate), sending passwords in plain isn't a big issue. "just by installing my certificate" nobody stops you from shouting yourself in the foot. You could have "just installed a trojan horse", same thing really.
Apr
2
comment Will there always be 256 collisions for the output of the MD5 hashsum function for 17-byte inputs?
Concerning rainbow tables 1) they're much smaller than all 17 byte inputs. 2) Probably below to 8 bytes or 13 lowercase letters. 3) Even for the target range, they typically only contain most but not all values.