Reputation
12,198
Next tag badge:
89/100 score
20/20 answers
Badges
1 30 60
Newest
 Yearling
Impact
~205k people reached

Apr
25
answered Can Skein be used as a secure MAC in format H(k || m)?
Apr
23
comment Will hashing over and over eventually give the same hash?
You will end in circles. I believe the average circle length is $\sqrt{N}$ when there are $N$ possible values. There are many such circles, once again approximately $\sqrt{N}$.
Apr
23
comment HMAC definition by using only one key
See “Weaknesses” in SHA-256d? and Dodis, Y., Ristenpart, T., Steinberger, J., & Tessaro, S. (2012). To Hash or Not to Hash Again? (In) differentiability Results for H2 and HMAC
Apr
22
comment Compared to GCM or XTS modes, how secure is H xor R1, E (R2, R1, Message) for confidentiality and integrity?
Authenticating the plaintext is risky. You can easily suffer from padding oracles and similar attacks (via timing side channels, error messages, etc.). We prefer encrypt-then-mac algorithms nowdays to avoid these issues.
Apr
22
comment Compared to GCM or XTS modes, how secure is H xor R1, E (R2, R1, Message) for confidentiality and integrity?
XTS is an unauthenticated mode, so it does not detect modifications of the ciphertext. It only limits how well the attacker can predict the plaintext corresponding to the ciphertext they produced.
Apr
22
comment Use cases for CMAC vs. HMAC?
Hashes usually faster than block ciphers sounds weird. After all most hashes are built from block ciphers and have stronger requirements than PRPness. Could be a historical accident since hashes are commonly ARX based, which is efficiently implementable in software, but that's no inherent property of hashes.
Apr
22
comment Burn after read algorythm. Software verification on compromised environment. Software smart card
Intel seems to be working on something that could enable such functionality in future CPUs. (But Intel itself could still subvert it and it obviously can't prevent the analog attack)
Apr
22
comment Is less security required for a short stream cipher than for the AES enciphering of very long messages?
What exactly is your question?
Apr
22
comment Is less security required for a short stream cipher than for the AES enciphering of very long messages?
Why would you use a system that doesn't fulfill strong security notions when they are easily available and still very fast? Figuring out if certain weaknesses apply to your use case is hard and error prone. Pretty much the only exception are hand ciphers where you need to be able to encrypt/decrypt a message without a computer.
Apr
22
comment Which algorithms are used to factorize large integers?
Your definition of L doesn't match wikipedia. You put the $^{1-a}$ at the end of the expression, wikipedia put it on $\log \log n$.
Apr
22
comment Stateless hash based public key cryptography?
[tahoe-dev] Hash based Signatures for Tahoe LAFS. Seems to contain a working implementation of one of those unlimited tree signature schemes. If you like Merkle Trees you should talk to the TahoeLAFS people.
Apr
21
comment Security of KDF1 and KDF2 (hash based KDF's)
This should work as long as the message being hashed has constant length (or at least is prefix free). Else length extensions might bite you.
Apr
21
comment Simple digital signature example with number
Which part did you correct? The only difference I see is that you're using mod n as an operator and mike uses congruence mod n.
Apr
20
comment Diffusion in Shamir's secret sharing scheme
You should insert the questions you're responding to as quotes into your answer. It's a bit hard to follow in its current form.
Apr
20
comment Is there a reason that the N value in scrypt is limited to powers of two?
((UInt64)X[16] * N) >> 32 has similar properties and is relatively cheap on many CPUs. For example on x86 the high word of a 32x32 multiplication ends up in an second register as byproduct of the standard multiplication and thus is easy to compute.
Apr
17
revised Do Chosen-Chiphertext attacks only apply to public-key cryptosystems?
added 42 characters in body; edited title
Apr
16
comment How can I convert numbers into prime numbers?
@gurghet With a PRNG I mean a cryptographically secure stream cipher which obviously has keys of at least 128 bits. So I don't know where your 32 bit key space comes from.
Apr
16
comment How can I convert numbers into prime numbers?
Sounds needlessly complicated. I see no advantage over the straight forward approach.
Apr
16
comment How can I convert numbers into prime numbers?
Hashing to primes is easy. Just seed a PRNG with the hash of the input and use it to generate a prime with any standard algorithm.
Apr
15
comment Are there any elliptic curve asymmetric encryption algorithms?
@hunter Why? What do you gain from encrypting the message itself with ECC instead of hybrid encryption? ECIES has a standard asymmetric encryption API. There are a few situations where RSA works but ECIES does not, but they're relatively exotic.