Reputation
14,510
Next tag badge:
102/100 score
17/20 answers
Badges
1 36 76
Newest
 Nice Answer
Impact
~289k people reached

Mar
11
comment Workaround to implementing Forward Secrecy
If the certificates use a new private key each time and you erase the old private key (tricky), you get a weak form of forward secrecy. If you create a new certificate with the same private key you get no forward secrecy at all.
Mar
11
comment What is the probability of finding 4 equal bytes?
I'm voting to close this question as off-topic because this is a basic math question, not a crypto question.
Mar
9
comment AES-128/192 safer than AES-256 in practice?
@ThomasM.DuBuisson But do they use primitives designed as PRP/PRF for that? Of course there are primitives that work fine with related keys, in particular most constructions build from cryptographic hashes.
Mar
9
comment AES-128/192 safer than AES-256 in practice?
No they're not. A well designed protocol uses uniformly distributed (pseudo) random keys. So related-key attacks only affect protocols that abused AES.
Mar
7
comment Can IGE mode be parallelized?
Any reason why you'd use IGE?
Mar
7
reviewed No Action Needed Problem with testing MD5 collisions
Mar
7
reviewed No Action Needed Signing Files vs. Signing File Hashes
Mar
7
comment Separate keys for encryption and MAC?
It's bad style, but unless your MAC and your cipher are based on the same primitive it's unlikely to lead to practical weaknesses. See Why can't I use the same key for encryption and MAC? on security.se.
Mar
5
comment Is the half-homomorphic property of RSA a problem for blind RSA signatures?
As long as you use a good padding scheme (full-domain-hash is simple and strong) it shouldn't be possible to obtain more than one padded message for which you know the pre-image per signing query.
Mar
5
comment Multiple encryption of part of block
@Nova The description is a bit unclear, but I assumed that Block 4 uses the first few bytes from the ciphertext not from the plaintext, since else the whole scheme wouldn't make sense.
Mar
5
comment Multiple encryption of part of block
@Nova How is it not ciphertext stealing?
Mar
4
comment Is CBC theoretically harder to brute force when compared with ECB?
@IlmariKaronen Yes, I'm taking about an attacker learning the same message encrypted with different keys and is happy if they break some of them. Trevor Perrin's noise protocol is a particularly severe example, since it uses a different key for each message, but obtaining one key allows you to compute all following keys.
Mar
4
comment How to compare between two cryptographic algorithms in terms of security?
Note that SipHash does not aim to be a collision resistant hash. It only aims for preimage resistance and for being PRF, which only requires collisions to be difficult to find if the attacker doesn't know the key. It has a very small output size. SHA-1 on the other hand tried to be collision resistant, but has since fallen to advancing cryptoanalyis.
Mar
4
answered Multiple encryption of part of block
Mar
4
answered Is CBC theoretically harder to brute force when compared with ECB?
Mar
2
comment 128 bit 3DES Key and AES Key: what's the difference?
One of the annoying properties of DES is that you need to pass a 64 bit key to most implementations and it ignores 8 of them.
Mar
1
comment Are there any known weaknesses with ElGamal algorithm?
Take a look at ECIES, NaCl's boxes and axolotl.
Mar
1
comment Calculation of time needed to crack DES with my CPU
Brute-force is an embarrassingly parallel problem, so I'd expect a sequential CPU to do pretty badly, even with a bitsliced AVX2 implementation.
Mar
1
reviewed Reviewed Hashes and Ciphers
Mar
1
reviewed Edit How does knowing the factorization of N help to obtain the secret?