Reputation
11,963
Next tag badge:
98/100 score
18/20 answers
Badges
1 29 60
Newest
 Revival
Impact
~198k people reached

May
1
comment Accelerated hashing on consumer-grade CPU?
Are you hashing many short messages, or few long ones? In the latter case you must use a tree hash to have any hope of parallelization.
Apr
30
comment Why must IV be sent with each packet?
You need a new IV for each message. You can't reuse the last block of the previous message. Doing that caused the BEAST attack against SSL. The assumption behind CBC's chaining is that an attacker can't see part of the ciphertext and then influence later plaintext.
Apr
30
comment How do you test the security of your cipher?
Depends a lot on what you mean by cipher. You mix concerns touching primitives, modes of operation and implementation. Each of these is tested completely differently. Primitives need lots of analysis by as many experts as possible. Modes of operation ideally feature a security proof. Implementations mainly need to avoid side channels and need to match official test vectors.
Apr
30
comment Why must IV be sent with each packet?
The IV must be different for each message. If you can use an implicit IV, such as a counter you don't need to send it explicitly. (At least with a mode that only needs unique IVs like CTR. For random IVs as in CBC you need some modifications, but in principle this is still possible)
Apr
29
comment How to implement a Cryptographic Pseudo Random Function
I prefer a two phase function: 1) Extract - Hash the seed and the input to a fixed size (say 256 bits) 2) Expand - Use a stream cipher to expand that key to whatever size you want. | You can use HKDF for this.
Apr
29
comment How to argue to a paranoid that RSA is safe?
There is little to argue beyond "many bright mathematicians tried to break it and nobody in published an attack faster than GNFS"
Apr
29
comment Pseudocode for constant time modular exponentiation
@fgrieu GnuPG used the naive if e[i] then c *= M until 2013. This enables cross VM attacks: eprint.iacr.org/2013/448
Apr
28
comment How can k3d3/ed25519-java's performance be improved?
Using bitshifts for conditionals (select, conditional swap,...) is necessary since the code aims to be constant time. Branches/switch statements have variable runtime due to branch prediction.
Apr
28
revised Pseudocode for constant time modular exponentiation
added 60 characters in body
Apr
28
comment Pseudocode for constant time modular exponentiation
The exponentiation part is easy if you're willing to sacrifice performance. The modular reduction is harder, considering that even the modulus is secret.
Apr
28
comment Pseudocode for constant time modular exponentiation
But you cannot use an if for this. You need a constant time conditional swap for that.
Apr
28
comment Pseudocode for constant time modular exponentiation
Considering the beginner mistakes in GnuPG's RSA I'm beginning to have doubts about that.
Apr
27
comment How can k3d3/ed25519-java's performance be improved?
That's still relatively slow. I'd guess the biggest gains could come from switching to custom multiplications like in Ref10, followed by using pre-computation. My C# port of Ref10 (with its base $2^{25.5}$ integers) costs only 92µs for signing and 222µs for verification (2.9 GHz, 64 bit Intel). Even without pre-computation, signing should cost less than 300µs and verification shouldn't be affected at all. Switching from base $2^{25.5}$ to base $2^{51}$ results in about a factor 2 speedup, but isn't possible in C# (and probably neither in Java) due to the lack of 128 bit integers.
Apr
27
comment Are RSA or ECC vulnerable to an attack where the same (unknown) plaintext is encrypted with multiple public keys?
The "ECC" part is unanswerable without you specifying how precisely you use ECC. Usually we don't encrypt any data with ECC at all, we use it to generate a shared key which is then used to encrypt data.
Apr
27
comment Tiger Tree Hash vs generic Merkle Tree
The only reason is compatibility with existing protocols.
Apr
25
comment Are the RFC3526 MODP groups Schnorr groups?
I'd guess these are safe primes, so $r=2$, for Schnorr groups we generally select a much smaller $q$, only twice the security level.
Apr
25
answered Can Skein be used as a secure MAC in format H(k || m)?
Apr
23
comment Will hashing over and over eventually give the same hash?
You will end in circles. I believe the average circle length is $\sqrt{N}$ when there are $N$ possible values. There are many such circles, once again approximately $\sqrt{N}$.
Apr
23
comment HMAC definition by using only one key
See “Weaknesses” in SHA-256d? and Dodis, Y., Ristenpart, T., Steinberger, J., & Tessaro, S. (2012). To Hash or Not to Hash Again? (In) differentiability Results for H2 and HMAC
Apr
22
comment Compared to GCM or XTS modes, how secure is H xor R1, E (R2, R1, Message) for confidentiality and integrity?
Authenticating the plaintext is risky. You can easily suffer from padding oracles and similar attacks (via timing side channels, error messages, etc.). We prefer encrypt-then-mac algorithms nowdays to avoid these issues.