9,834 reputation
12450
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 3 months
seen 39 mins ago

Sep
18
comment PKCS1 and blind RSA signatures
@neubert When you actually use blind signatures (e.g. to implement Chaumian E-Cash) then the padding is done by a different entity than the private key operation. One important consequence is that the padder wants to forge signatures, so it doesn't seem like a good idea to use a probabilistic padding scheme.
Sep
18
comment Can PBKDF2 be used to create an XOR cipher key to encrypt random plaintext?
At best you'll get a stream cipher, not a one-time-pad. An OTP needs to be truly random, not pseudorandom.
Sep
18
comment PKCS1 and blind RSA signatures
I'd certainly choose a deterministic padding for blind signatures. In the simplest case, full domain hash.
Sep
18
comment Encrypting 8 times with 8-bit key beneficial?
Meet-in-the-middle will break this with cost $2^{64/2}=2^{32}$, which is feasible with a single PC.
Sep
17
comment Proper way of doing encryption and authentication (PBKDF2 + AES)
Run the output of PBKDF2 through HKDF-Expand to produce different values for different purposes.
Sep
16
revised How is the key shared in symmetric key cryptography?
edited tags
Sep
16
comment How to protect from Silver–Pohlig–Hellman algorithm
"if $p−1$ is a smooth number", but if you choose a $p-1$ with large factors (e.g. twice a prime) then it's not smooth and the algo doesn't break it.
Sep
16
comment Security of (cryptographic) padding compared to other methods for blockcompletion for block ciphers
A proper MAC scheme rejects any modified message in constant time before any other code (such as decryption) runs. Oracle attacks rely on the decrypter leaking some information for attacker modified messages, so by only telling the attacker that the MAC was invalid the attacker doesn't learn anything new. In contract with unauthenticated encryption(or mac-then-encrypt) modiefied messages might be treated differently. For example different error messages, some are accepted, different timing,...
Sep
15
comment What stops the Multiply-With-Carry Random Number Generator from being a Cryptographically Secure Pseudo-Random Number Generator?
No idea why people care about period length above say $2^{256}$.
Sep
14
comment Is it dangerous to use plaintext as IV in CBC?
Your "specification" is pretty unclear. How would you use the plaintext as IV? If you use the plaintext as IV, you need to tell the decrypter about it, but since the usual goal is the keep the plaintext secret, that doesn't make sense.
Sep
13
answered Salsa20 in Davies-Meyer mode with a fixed key (message): is it one-way?
Sep
12
comment Can I dynamically calculate an appropriate number of iterations for PBKDF2 based on the system time, rather than using a fixed value?
One problem with your system is that is assumes performance will double every two years. I think it has already slowed down, and will get even slower in a few years.
Sep
12
comment Possible ECC backdoor and its impact on Internet traffic
It'd break TLS with ECDHE suites, probably passively. In particular gmail. But since nobody in the public knows a way to weaken the curve by choosing a bad $b$ constant, it's unclear what the impact of such a hypothetical attack would be.
Sep
11
comment Guarding against cryptanalytic breakthroughs: combining multiple hash functions
@ddyer "reveals the message" is first-preimage resistance. Concatenation is useful if you care about collisions and second-pre-images. Combiners only preserve some properties of the hash, not all of them.
Sep
10
revised Is there a theoretical maximum useful keysize given the block-size?
edited tags
Sep
10
comment Is there a theoretical maximum useful keysize given the block-size?
Read the questions I linked. For example there are 26! keys for an alphabetic substitution cipher, but only 26 different letters.
Sep
10
comment Is there a theoretical maximum useful keysize given the block-size?
Related AES Key Length vs Block Length and AES key/ciphertext space sizes
Sep
10
comment Is there a theoretical maximum useful keysize given the block-size?
I'd expect something like $log_2(2^n!)$ which you can approximate with sterling and you'll see that the maximal keysize gets really huge really quickly.
Sep
10
comment Should new applications still use RSA? Is it worth going down the ECDH route for protocols?
@Nemo The crypto part of NaCl is fine, but by itself it doesn't satisfy the OP's requirements. In practice I'd use the libsodium variant since it's easier to build. The CurveCP part of NaCl is not production ready. There are significant flaws in the implementation, and minor flaws in the protocol. CurveCP is a great inspiration for protocol designers, but I wouldn't use it in its original form.
Sep
10
comment Hash function based on block cipher (and proof of security in the PRP model)
My impression is that security definitions of unkeyed primitives are generally problematic and that these problems lead to the use of ROM.