Reputation
Next tag badge:
102/100 score
18/20 answers
Badges
1 36 76
Newest
 Nice Answer
Impact
~290k people reached

Mar
30
comment About MAC and HMAC
Also the biggest issue with encypt-and-MAC is that it doesn't provide confidentiality.
Mar
30
comment Which is the longest CSPRNG?
You can easily design PRNGs with arbitrary long periods (or if you admit unbounded memory use even infinite periods), but like poncho said, longer periods offer no advantage once the period is long enough to never repeat in practice.
Mar
29
comment Authenticated encryption with Enc-Sign-Mac
I'd use sign-then-authenticated-encryption, where authenticated encryption may be built using encrypt-then-MAC.
Mar
28
comment Bitwise method of generating r for RSA-KEM
Since a CSPRNG seeded from a low/no entropy seed still produces a random looking sequence, that doesn't seem like a worthwhile protection to me. Also mapping 0 to 2 won't help you in that case, since you can guess it just as easily.
Mar
28
comment Bitwise method of generating r for RSA-KEM
It should be straightforward to show that reducing the space of the message by 1 bit can't reduce security by more than 1 bit.
Mar
28
comment Bitwise method of generating r for RSA-KEM
Why do you require $1<m$? I see no issues with $0$ and $1$.
Mar
25
comment ChaCha20 core vs ideal unkeyed PRP
1) I think the ChaCha(0)=0 property generalizes to all words being identical. 2) ChaCha has obvious rotational symmetries.
Mar
25
comment ChaCha20 core vs ideal unkeyed PRP
I think the OP considers ChaCha without the final addition when they talk about the core.
Mar
25
comment What is the most common encoding of messages to polynomials?
My first guess would be using a random message and deriving a symmetric key from it by hashing (e.g. using HKDF).
Mar
24
comment How succeptible to accidental collision is the construct sha256(uuid4 + now) in Python?
It's at least not worse than a GUID by itself, which should be good enough even without any additional inputs. Personally I'd throw in an extra 32 bytes read from SystemRandom.
Mar
24
comment Parallel hashing function that always gives the same hash despite a variable number of cpus
Polynomial hashes (GHash, Poly1305) would work. Such hashes are only collision resistant against attackers who don't know the key, and 128 bits is a bit on the small side, even without attackers. A Xor-MAC like (the patented) OCB mode uses for its authenticated data has similar properties.
Mar
24
comment Parallel hashing function that always gives the same hash despite a variable number of cpus
"now there's overhead for making 100 1Gb chunks, hashing chunks, concatenating hashes, hashing again" -- the overhead is negligible.
Mar
24
comment Exposed raw RSA private key operation
As far as I know blind RSA signatures are secure (e.g. for untraceable money) and they expose the raw private key operation.
Mar
23
comment Length-preserving all-or-nothing transform
Interesting mismatch between 6 rounds from that paper and the 4 rounds to build a strong PRP from the Luby-Rackoff paper.
Mar
23
comment Can two files/strings have the same SHA-256 value?
The argument in your question proves the existence of collisions, using the Pigeonhole principle.
Mar
23
revised ECIES is must with Symmetric?(ECIES-AES or ECIES-TDES)
added 42 characters in body
Mar
23
comment ECIES is must with Symmetric?(ECIES-AES or ECIES-TDES)
Do you have a source for the claim that the above algorithm is ECIES?
Mar
23
revised ECIES is must with Symmetric?(ECIES-AES or ECIES-TDES)
added 89 characters in body
Mar
23
comment ECIES is must with Symmetric?(ECIES-AES or ECIES-TDES)
The first one looks like ElGamal encryption and not like ECIES to me.
Mar
23
comment Will changing the RSA Padding in OpenSSL cause issues?
To make matters worse, if you still support the old vulnerable algorithm, you'd probably still be vulnerable to padding oracles, even for data that was encrypted using the new algorithm as long as you use the same RSA key for both.