CodesInChaos

less info
meta site favicon meta user | stack exchange network profile network profile
5,964 reputation
1927
bio website github.com/CodesInChaos
location Munich, Germany
age
visits member for 1 year, 10 months
seen 14 mins ago
stats profile views 109

1,113 Actions

suggestions reviews revisions comments badges posts accepts all
Jun
2
 answered Is this streamable combination of encryption and MAC secure?
Jun
2
 comment Is this streamable combination of encryption and MAC secure?
What is possible is a BEAST style attack on the implicit IVs you're using. But only if an attacker can control part of the plaintext.
Jun
2
 comment Is this streamable combination of encryption and MAC secure?
I'm pretty sure this scheme is secure
Jun
1
 comment K out of N encryption
crypto.SE is a better fit, but please don't cross-post. I hope it gets migrated.
Jun
1
 comment Replay attack prevention under strict conditions
The solution I sketched allows 8000 outstanding requests without allowing a replay attack. That should be enough for most situations.
Jun
1
 comment Replay attack prevention under strict conditions
I'd use your idea 2 with a counter as nonce. Then you can add a rule that any counter that's smaller by 8000 or more than the largest counter received so far are invalid. Not sure if that falls under your "sequential" rule.
Jun
1
 comment Replay attack prevention under strict conditions
What exactly do you mean by not sequential? And why do you need that?
May
31
 comment When to prefer exchanging cryptographic certificates over exchanging only public keys?
Related en.wikipedia.org/wiki/Zooko's_triangle
May
30
 comment Is every output of a hash function possible?
Even H(H(m)) will likely not reach a lot of the output space.
May
30
 comment Attacks of the MAC construction $\mathcal{H}(m||k)$ for common hashes $\mathcal{H}$?
@fgrieu Skein uses a scheme similar to $H(k||m)$ as MAC, and I believe the paper contains some security proofs for this mode. You could compare that with the proof for HMAC, and check if they made any additional assumptions. I think most proofs in the Skein paper assume certain properties of the underlying block cipher.
May
30
 comment Google is using RC4, but isn't RC4 considered unsafe?
RC4 is easier to misuse than an ideal stream cipher. In particular its related key vulnerabilities make it easy to make a mistake while adding an IV.
May
28
 revised Algorithm to securely exchange identities
added 110 characters in body
May
28
 answered Algorithm to securely exchange identities
May
27
 comment Is quantum key distribution safe against MITM attacks too?
You can use certain provably secure MACs with quantum crypto, but they're still symmetric crypto. Using normal public key crypto defeats most of the point of quantum crypto, it's provable security. Symmetric encryption is one of the strongest building blocks we currently have, so quantum crypto is pretty useless, since we need to use weaker primitives to do anything interesting.
May
27
 comment Do Cryptographic Hashing Algorithms operate only on Integers?
Using double leads to funny effects like "Arithmetic on double variables is also required to be round-to-nearest; this means that, on computers that support global rounding modes, poly1305aes_53 will not work with programs that set rounding modes other than round-to-nearest", which sounds problematic to me, since some stupid libraries mess with rounding modes.
May
27
 comment Is quantum key distribution safe against MITM attacks too?
A short shared secret is similar to a symmetric key in conventional crypto: a couple of hundred bits. The long shared secret is similar to the keystream a stream cipher produces. It's as long as the message you want to send. Essentially quantum crypto acts like an online-only stream cipher.
May
25
 revised In which order are the round keys used during AES decryption?
added 46 characters in body
May
25
 comment Is it secure to use the hash of key as the IV in AES encryption?
@Polynomial and why do you want to prevent an attacker from knowing the IV?
May
25
 comment What is the harm if I publish an encrypted RSA private key publicly?
The assumption of a good password is pretty problematic. Even with strengthening techniques applied, a password should have 60 bits of entropy or more. Very few users will use a password that's so strong. And even with 60 bits(+10 to 20 bits for strengthening) it's one of the weakest cryptographic parts in an application.
May
25
 comment Standard symbol / notation for “x knows y”, or the inverse
But your example is problematic, since you did not restrict the cost of calculating $f$. If you make no such restriction, you need entropy exceeding the output size, i.e. a true RNG, and not a PRNG.
1 … 44 45 46 47 48 … 56