9,686 reputation
12347
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 1 month
seen 8 hours ago

Aug
12
comment Are there any cryptographic flaws in my webhook signing process?
Why sign webhooks at all? I prefer a pattern where the recipient doesn't assume that the webhook is authentic and simply uses it as a trigger to fetch the relevant information. That fetch is authenticated and protected against replay attacks since it uses HTTPS with your server as target.
Aug
11
comment Computational Complexity - When is it really exponential time?
You wrote $n=2^{log_2 n}$ which makes no sense. DL has polynomial cost in the order of the group and exponential cost in the bitlength of the group order. If you want to be precise you can't say "this algorithm has exponential cost", you need to specify in which variable it is exponential. Colloquially we omit that specification if everybody knows which variable we're talking about.
Aug
11
comment Computational Complexity - When is it really exponential time?
You can't use $n$ to refer both the order of the group and its bitlength. Rename one of them, e.g. use $n = \log_2 N$
Aug
10
comment Help deciphering caesar cipher
1) Define the alphabet as string and use the indexOf function to simplify your code. 2) You can use a for loop for the rotation 3) Use alphabet.length instead of hardcoding the 27.
Aug
10
comment Streaming mode of operation that is more resistant against nonce reuse
A blockcipher in CFB mode only leaks the xor of the first block that differs and not the xor of the whole message. I think keccak's duplex mode has similar properties.
Aug
9
reviewed No Action Needed RSA Blind Signature Attack
Aug
8
comment Implementation and Testing of SRP-6a
@Andrey Slow hashes have the same purpose as with any other protocol - to protect the passwords if the database containing the hashes leaks.
Aug
8
comment Implementation and Testing of SRP-6a
Note that both SHA-1 and SHA-2 are bad as password hashes even when used in SRP (since they're fast). The modular exponentiation improves the situation somewhat since it's not as cheap as SHA1/2, but it's still cheaper than a proper password hash.
Aug
5
comment Homogenous and heterogeneous Unbalanced Feistel Networks
One advantage of simple algorithms is that analyzing them is less work.
Aug
5
comment ECDSA with SHA256 and sepc192r1 curve: Impossible, or how to calculate $e$?
@Christian The security level is limited to half the curve size. So with a 192 bit curve you get 96 bits of security. This is still infeasible to break, but you should consider upgrading to a 224 or 256 bit curve.
Aug
5
comment Interleaving bytes to make an effectively larger block size
There are simple techniques to construct wide PRPs which are much faster than this and provably secure (reducing to the security of AES). So there is no reason to use your construction in practice.
Aug
5
comment Interleaving bytes to make an effectively larger block size
Looks very similar to the way the block-cipher underlying BLAKE works (it uses a 4x4 matrix of 32/64 bit words, not a 16x16 matrix of 8 bit words), so I believe it's possible to construct a secure cipher that way. But BLAKE has about 20 cheap rounds, not 3 expensive rounds. I have doubts that 3 rounds are enough, even with a secure PRP as building block.
Aug
5
comment Interleaving bytes to make an effectively larger block size
I'm reading the interleaving function differently from you. I think it's supposed to be a matrix transposition, i.e. $c_{16i+j} = b_{16j+i}$.
Aug
5
comment Interleaving bytes to make an effectively larger block size
My intuition is that enough rounds of this should be secure, but that you'll need more than 3 rounds.
Aug
5
comment Interleaving bytes to make an effectively larger block size
I don't follow your argument and can't see how a symmetry would propagate through enough rounds.
Aug
4
comment AES-GCM Disadvantage
For full nonce reuse resistance there is no way around processing the message twice. i.e. any mode that only processes a message only once is significantly weaker than SIV when nonces are reused.
Aug
2
comment Is perfect-forward secrecy achieved with RSA?
You don't need a per session key. You can reuse it for other sessions as long as you discard it after a short time. For example you could use RSA keys rotated once a minute, that way the key generation cost is amortized over several connections andis no longer a limitation, even with RSA. The main downside ia that it complicates the protocol compared to per session keys.
Aug
1
comment How many RSA keys before a collision?
@owlstead I used factor to mean small constant multiplier. My computation is only a rough approximation, I didn't care if there are 10x more or less primes than what I wrote, so I included that statement to preempt nitpickers. For example I didn't use a precise form of the prime number theorem and I expect a typical RSA implementation to set the top two bits to 1, not just the top bit to ensure that their product has precisely 1024 bits. According to Wolfram Alpha there are $10^{151}$ primes suitable for RSA 1024.
Aug
1
comment Is perfect-forward secrecy achieved with RSA?
You can achieve forward secrecy with RSA if you generate short lived key-pairs. But most protocols that provide forward secrecy use Diffie-Hellman, probably because generating DH keys is cheap and easy compared to RSA keys.
Jul
29
awarded  Popular Question