Reputation
Next tag badge:
102/100 score
17/20 answers
Badges
1 36 76
Newest
 Nice Answer
Impact
~289k people reached

Apr
25
revised SHACAL-2 vs. AES as underlying block cipher for Secure Hash (aka SHA-256)
added 121 characters in body
Apr
25
comment SHACAL-2 vs. AES as underlying block cipher for Secure Hash (aka SHA-256)
You can use AES to build a secure MAC (CBC MAC and its derivatives). Unlike your suggestion, these constructions use AES with a random key, which the attacker doesn't know.
Apr
25
answered SHACAL-2 vs. AES as underlying block cipher for Secure Hash (aka SHA-256)
Apr
25
comment Why can't I use ECB with some obfuscation for transient RAM?
Why not do it properly? XTS mode is similar to your idea (it combines the address with the data), but actually secure.
Apr
25
reviewed Reviewed Encryption of plain text using stream cipher algorithm
Apr
25
reviewed No Action Needed Does SRP reduce to DH key exchange when shared password is not secret?
Apr
24
comment Prime factorization
@tylo GNFS depends on the size of the number. But some other algorithms like ECM depend on the size of the smallest factor. If your factors are small enough so that ECM is faster, then the cost will depend on the size of the factors. If all the factors are big enough so that GNFS is faster, the size of the factors doesn't matter.
Apr
24
comment Prime factorization
Since factoring a 512 bit semiprime costs about $100, it's clearly more than a standard computer can do in a few hours. Your number has 392 bits, so factoring would be relatively cheap, but I don't know if it'd fall below your limit. If the number has small factors, ECM should be faster than GNFS.
Apr
23
comment Security aspects of using a global values as nonce and additional data for AES?
Strictly speaking, you must never reuse a (key, nonce) pair.
Apr
23
revised What is the “compression function” in Merkle-Damgård?
edited body
Apr
23
comment How are onetimepads distributed?
Both parties could meet in person and exchange a disk containing the pad. Or perhaps you send a diplomatic courier with the key material in a sealed bag. The annoying key-distribution is one of the reasons why one-time-pads aren't very popular.
Apr
22
comment Can Grover's algorithm be parallelized?
@mikeazo I think I was asking the wrong question. I've changed it a bit, to be closer to what matters for attacks on cryptography.
Apr
22
revised Can Grover's algorithm be parallelized?
added 300 characters in body
Apr
22
revised Can Grover's algorithm be parallelized?
deleted 1 character in body
Apr
22
asked Can Grover's algorithm be parallelized?
Apr
22
answered What is the “compression function” in Merkle-Damgård?
Apr
22
comment What is the “compression function” in Merkle-Damgård?
Yes. MD is a domain extender which turns a fixed input size hash into a variable input size hash.
Apr
22
comment Super-simple encryption of short strings
1) Why use encryption at all? I'd rather use a lookup table/tokenization. 2) If you want to use crypto, why use format-preserving-encryption? 2) Anonymizing data sets is hard. It's often possible to correlate data from different sources to deanonymize such data.
Apr
22
revised side channel attacks against TDES (compared to AES)
deleted 77 characters in body; edited tags
Apr
22
comment side channel attacks against TDES (compared to AES)
So it wasn't just a timing attack, but a power analysis attack? In that case you're pretty much doomed with any general purpose CPU. If you want to prevent attacks where the attacker has physical access to the device, you should use special purpose hardware designed to make these attacks harder. The choice of cipher matters far less compared to how much effort the hardware designer put into preventing those attacks.