Reputation
Next tag badge:
89/100 score
20/20 answers
Badges
1 29 60
Newest
 Revival
Impact
~199k people reached

Mar
27
comment Is Curve25519-java secure?
@Gracchus The API of Curve25519-java is so awkward that few people will be able to use it correctly. It doesn't matter if your crypto works in theory if nobody is able to use it.
Mar
27
comment Is Curve25519-java secure?
I just checked: It simply pushes the responsibility onto the caller. Since it's pretty hard to generate a good enough nonce, any caller who isn't a crypto expert will almost certainly get it wrong.
Mar
27
comment Use cases for “online” authenticated encryption?
Personally I think the "online" feature isn't very important for authenticated encryption. It might be useful for large files downloaded from an untrusted but rarely actually malicious source. But usually I'd prefer a (tree)hash or signed (tree)hash over a MAC in those scenarios.
Mar
26
revised Is substitution with random prefix codes secure?
added 66 characters in body
Mar
26
comment Defending hybrid encryption schemes against padding oracle attacks
@RickyDemer I don't think you can call it insecure per-se since the sender's private key is assumed to be secret. What you expect is a form of forward secrecy for the sender's side. Noise boxes on the other hand provide the property you want: "Noise boxes are "one-way" - they can be decrypted by the receiver, but not the sender."
Mar
26
comment Defending hybrid encryption schemes against padding oracle attacks
@nadavwr NaCl's crypto_box simply computes the shared DH key of the two input keys and encrypts the message with authenticated encryption. Quite similar to the scheme you describe. Knowledge of the sender's private key can encrypt messages sent from/to them. Protocol designers are expected to address this at a higher level, typically by using an ephemeral key to encrypt actual data and a separate DH exchange to authenticate with the sender's long term key.
Mar
26
comment Questions about hash functions
@PaŭloEbermann I don't think that this directly contradicts the basic security definitions. Indirectly it might do so, since it enables a MitM attack so you probably can only achieve $2^{n/2}$ pre-image resistance.
Mar
26
revised Lamport signature: How many signatures are needed to forge a signature?
added 160 characters in body
Mar
26
comment Lamport signature: How many signatures are needed to forge a signature?
@mephisto I was thinking about signing a hash (preferably a with an unpredictable prefix, as in Ed25519), but you're right that the OP didn't specify such hash-then-sign step. I've edited my answer to clarify that.
Mar
25
comment Is PBKDF2-HMAC-SHA1 really broken?
It might have one effect: The designers of entries to the password hashing competition will avoid these collisions.
Mar
25
answered Is PBKDF2-HMAC-SHA1 really broken?
Mar
25
comment Is PBKDF2-HMAC-SHA1 really broken?
Collision resistance isn't considered a required property for password hashes. So this is generally just a curiosity, not a vulnerability.
Mar
25
comment Challenge–response authentication which can be done in head?
1) The scenario you described is symmetric, since you and the doorman have a shared secret. 2) You need authentication, not encryption
Mar
22
comment Questions about hash functions
Even with Merkle-Damgard hashes like SHA-256 (which are vulnerable to length extensions attacks) are not vulnerable to length reduction attacks.
Mar
22
comment Rock-paper-scissors over network, how to protect from cheating server?
If the server pretends that it didn't receive Alice's plaintext, Alice will notice and avoid that server in the future.
Mar
20
answered McEliece key size
Mar
20
awarded  Enlightened
Mar
20
awarded  Nice Answer
Mar
19
comment Why is Serpent faster than AES in this benchmark?
@Gael With parallelism I mean that you have the inputs for multiple blocks (with 16 bytes each) available at the same time. In that case you can call a (single threaded) function that takes e.g. 32 blocks and produces 32 encrypted blocks. This function is cheaper for Serpent than encrypting 32 blocks individually. Using Serpent-XTS should be faster than AES-XTS on your current hardware, but once you get a AES-NI capable CPU AES will pull ahead.
Mar
19
comment Why is Serpent faster than AES in this benchmark?
In that case the AES numbers are plausible (16 cycles per byte) compared to ~12 on i3 without AES-NI in the eBACS benchmark.