9,417 reputation
12345
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years
seen 1 hour ago

Sep
20
answered Can someone explain how this unpadded RSA formula works?
Sep
19
comment What is the lowest level of mathematics required in order to understand how encryption algorithms work?
Depends a lot of which parts of crypto you want to understand. For asymmetric crypto you need number theory, for symmetric crypto you need a combination of probability theory and cryptography specific knowledge. For cryptographic protocols you need very little math, mainly logical thinking and knowledge of the properties different primitives have.
Sep
19
comment Why not the one-time pad with pseudo-number generator
@MichaelKjörling The channel might be secure but high latency. For example consider a trusted courier who takes several hours to fly around the world. Or some conspirators who meet in person for the key-setup, and then later on exchange encrypted messages. A one-time-pad allows you to seperate the time of message exchange from the time you have the trusted channel.
Sep
19
comment Can we design a public-key infrastructure without certificate authorities?
@ddddavidee So you replace a trusted third party by an even more powerful trusted third party. The only advantage of IBE is that you don't need to be connected to the internet to encrypt a message with their private key. That advantage is obviously irrelevant for applications that inherently require internet connectivity.
Sep
19
reviewed Approve suggested edit on Why not the one-time pad with pseudo-number generator
Sep
19
comment Which encryption method supports random reads?
While CTR mode produces the key-stream in 16 byte blocks, that only affects performance. You only need to read and decrypt those ciphertext bits you're interested in. On a modern CPU you won't even notice the overhead of generating a few bytes too much.
Sep
19
comment Proper way of doing encryption and authentication (PBKDF2 + AES)
@Joey Since you're already using PBKDF2 with a salt, you can skip the first step of HKDF. Essentially you're using PBKDF2 as extract step. The expand step doesn't need a salt.
Sep
19
comment Which encryption method supports random reads?
I just want to emphasize that modes that are secure for random reads often aren't secure for random writes. For example CTR mode becomes extremely weak when you do random writes(two-time-pad).
Sep
19
comment Explaining weakness of Dual EC DRBG to wider audience?
Matt Green wrote a blog article about this: The Many Flaws of Dual_EC_DRBG
Sep
18
comment Estimating bits of entropy
There are two issues with Shannon entropy: 1) It's only defined for a probability distribution, not for an individual string 2) Shannon entropy and average key-strength aren't exactly the same thing if the probability distribution isn't uniform.
Sep
18
comment Can PBKDF2 be used to create an XOR cipher key to encrypt random plaintext?
You put OTP into the title of the question...
Sep
18
comment PKCS1 and blind RSA signatures
@neubert With blind signatures the blinder/padder pads and then blinds the message. The signer operates on the blinded signature. The blinder then unblinds the signature, giving them a properly padded signature that isn't blinded anymore. The verifier works with the unblinded signature and knows the signed message. So they can verify normal padding with hashes etc.
Sep
18
comment PKCS1 and blind RSA signatures
@neubert When you actually use blind signatures (e.g. to implement Chaumian E-Cash) then the padding is done by a different entity than the private key operation. One important consequence is that the padder wants to forge signatures, so it doesn't seem like a good idea to use a probabilistic padding scheme.
Sep
18
comment Can PBKDF2 be used to create an XOR cipher key to encrypt random plaintext?
At best you'll get a stream cipher, not a one-time-pad. An OTP needs to be truly random, not pseudorandom.
Sep
18
comment PKCS1 and blind RSA signatures
I'd certainly choose a deterministic padding for blind signatures. In the simplest case, full domain hash.
Sep
18
comment Encrypting 8 times with 8-bit key beneficial?
Meet-in-the-middle will break this with cost $2^{64/2}=2^{32}$, which is feasible with a single PC.
Sep
17
comment Proper way of doing encryption and authentication (PBKDF2 + AES)
Run the output of PBKDF2 through HKDF-Expand to produce different values for different purposes.
Sep
16
revised How is the key shared in symmetric key cryptography?
edited tags
Sep
16
comment How to protect from Silver–Pohlig–Hellman algorithm
"if $p−1$ is a smooth number", but if you choose a $p-1$ with large factors (e.g. twice a prime) then it's not smooth and the algo doesn't break it.
Sep
16
comment Security of (cryptographic) padding compared to other methods for blockcompletion for block ciphers
A proper MAC scheme rejects any modified message in constant time before any other code (such as decryption) runs. Oracle attacks rely on the decrypter leaking some information for attacker modified messages, so by only telling the attacker that the MAC was invalid the attacker doesn't learn anything new. In contract with unauthenticated encryption(or mac-then-encrypt) modiefied messages might be treated differently. For example different error messages, some are accepted, different timing,...