9,427 reputation
12345
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years
seen 4 hours ago

Aug
9
comment why AKS is so slow in practice?
@nightcracker While primality testing isn't cryptography per-se, it's close enough for me to consider it on-topic here.
Aug
9
comment Alice's forgetful banking
If the server successfully impersonates a legitimate server(the OP's assumption is that this is possible) they learn the public key of the client. Knowing the public key allows a password guessing attack, which is only partially mitigated by using a good password hash. With socialist millionaire only signup and not login are vulnerable to this.
Aug
9
comment Alice's forgetful banking
Problem with SRP is that an attacker who impersonates a server learns the password hash, enabling offline search. I'd look into socialist millionaire or something similar protocols.
Aug
9
comment Alice's forgetful banking
Can't you simply use the username for the lookup followed by a zero knowledge proof for the password hash?
Aug
9
revised How strong is the ECDSA algorithm?
deleted 51 characters in body
Aug
9
awarded  Enlightened
Aug
9
awarded  Nice Answer
Aug
8
comment why DES encryption uses different modes like ECB,OFB?
Without a mode you can encrypt exactly 8 bytes in a deterministic way. If you want to do anything more, you need a mode.
Aug
8
reviewed Approve suggested edit on Why is Merkle-Damgård construction insecure?
Aug
7
comment Any problems with this secure time synchronization scheme?
@Thomas Why? 1) Then nonce serves as a challenge, else an attacker could simply return an old signed time. The nonce is an essential part of this scheme. 2) A signature scheme may or may not be randomized. I don't see how that matters here.
Aug
7
comment Allowing the user to choose the hashing formula at the registration
@hunter The "no header" approach is an essential part of TrueCrypt's design. It aims at plausible deniability by making encrypted files indistinguishable from random data. AFAIK TrueCrypt needs to try all combinations of cipher and KDF, but it starts with the most common one.
Aug
7
comment Allowing the user to choose the hashing formula at the registration
@hunter No, TrueCrypt needs to try them all since its files have no unencrypted header. IMO it's a good example of what not to do. They could have simply hardcoded PBKDF-2-HMAC-SHA-512 with 100'000 iterations and it would have been far stronger that what they have ATM.
Aug
7
comment Allowing the user to choose the hashing formula at the registration
TrueCrypt is funny that way. It allows the user to pick from Whirlpool, SHA-2 and RIPEMD160, but uses far too few iterations of PBKDF2. A decent iteration count (or even scrypt) would have gained far more than the choice of hash function.
Aug
7
comment Allowing the user to choose the hashing formula at the registration
Just choose one secure scheme, such as scrypt with good parameters.
Aug
6
comment Swapping Key and IV in AES? Safe?
At what granularity do you need your irreversibility? 1 byte? 16 bytes? 1 KB? Larger blocks increase performance, but it's possible to go backwards to the beginning of the block.
Aug
6
comment salting with password hash to improve security?
@e-sushi The difference is that you used it as a close reason, whereas I just commented. Linking to similar questions on other se sites is fine, but it's generally not considered a valid close reason.
Aug
5
comment Is AES-XTS considered safe to encrypt multiple files with the same keys?
Encrypting the same plaintext block twice at the same position leads to identical ciphertext block. That's already quite a big leak.
Aug
5
revised Finite fields in elliptic curve
added 405 characters in body
Aug
5
comment salting with password hash to improve security?
Duplicate on security.stackexchange: When hashing passwords, is it ok to use the hashed password as the salt?
Aug
5
answered Finite fields in elliptic curve