9,854 reputation
12450
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 3 months
seen 11 hours ago

Oct
12
revised ChaCha cipher + Poly1305
edited tags
Oct
12
answered Why does NaCl's crypto_secretbox for xsalsa20-poly1305 require the first 32 bytes to be zero?
Oct
12
comment How many messages needs to be send to server to get AES key in Cache-timing Attack
Depends a lot on how well you can measure the timing. Bernstein used a setup with pretty accurate timing information.
Oct
11
comment Key-size of encryption method
AES-256 uses a 256 bit or 32 byte key by definition. No more, no less.
Oct
11
comment Which stream cipher can we replace the RC4 in the SSL?
There is AES-GCM (which is based on AES-CTR) in TLS 1.2, and AGL at google works on a ChaCha-Poly1305 suite. But there are no widely implemented streamciphers in TLS for now.
Oct
11
comment Is using Ed25519 parameters in ECDSA safe?
What should possible is using Weierstrass for the API, but converting to edwards for computation.
Oct
11
comment Which stream cipher can we replace the RC4 in the SSL?
AES-CTR and Salsa20/ChaCha are the most popular stream ciphers in my experience.
Oct
11
comment Which stream cipher can we replace the RC4 in the SSL?
Context? Future extensions in SSL? Or as a server operator who's limited to existing implementations?
Oct
10
comment Encrypting files with known headers
Personally I don't like using GPG for data at rest. I prefer a simple AEAD API.
Oct
10
comment 2 comparable hashes generated from one string
I would go with random tokens that are simply random values stored in a different database table.
Oct
10
comment 2 comparable hashes generated from one string
Quick observation: MD5 is not an appropriate password hash. See How to securely hash passwords? for how you should hash passwords.
Oct
10
comment Infinite depth BLAKE2b tree hashing
We did not consider unary trees when designing the tree mode and I still don't get their point. Where is the difference between a sequential hash and a unary tree?
Oct
10
comment Hash functions throughput performance
@StephenTouset One needs to be careful about such comparison. The devil is in the details. At least it's faster when comparing with sequential MD5 on 64 bit Intel CPUs, which is pretty much its optimum case. 32 bit, non intel (including AMD), or treeing MD5 will improve MD5s performance relatively to Blake2b. On the other hand you can cut the number of rounds by a factor 3 or so to get a version of Blake2 that's still much stronger than MD5.
Oct
10
comment Hash functions throughput performance
And finally if you don't care about security, you can simply decrease the security margin. For example if you decrease Blake2's number of rounds to prevent the best known attack, you'd get another factor 3 or so speedup.
Oct
10
comment Hash functions throughput performance
Then there are treed modes which will speed up some hashes more than others. For example I'd expect a much bigger speedup due to treeing+SIMD for MD5 than for Blake, since the latter already uses SIMD within a single instance.
Oct
10
comment Hash functions throughput performance
On what platform? And what kind of implementation? Some hashes need c with SIMD intrinsics to shine, some are okay with plain c. Some require 64 bit CPUs, some excel in hardware (ASIC or FPGA). There is no single fastest hash.
Oct
9
comment what are the uses of tweaks in block ciphers?
@sashank You can encrypt each block independently, similar to ECB mode. But the tweak ensures that the same data at different positions encrypts to different values, avoiding ECB's biggest weakness.
Oct
9
comment AES file encryption with PBKDF2. Safe parameters?
@hunter Not entirely sure what you mean by "only the final round". Do you want to run PBKDF2 with 1 iteration on the output of PBKDF2 with many iterations?
Oct
9
comment post-quantum threshold secret sharing
Hashes/one-way-functions are a completely different issue. As far as we can tell they still exist, you just need to use twice the size. A 512 bit hash will offer 256 bits of security against QCs, far from any realistic attack.
Oct
9
comment post-quantum threshold secret sharing
If by threshold secret sharing, you mean something like Shamir's secret sharing, you can continue to use it. It's secure against computationally unbounded attackers i.e. it offers information theoretic security. It's essentially a system with less equations than variables, so there are many equally likely solutions.