9,417 reputation
12345
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years
seen 1 hour ago

Jul
12
comment What is the purpose of update() in popular hash APIs?
I don't get your point. What are you comparing update to?
Jul
12
comment What is the purpose of update() in popular hash APIs?
Why shouldn't it be there? What alternative do you propose?
Jul
12
comment Building a hard to factor number without knowing its factorization
AFAIK it is only possible with huge (and thus very inefficient) primes.
Jul
12
comment Review of AES encryption concept for an open source project
You should use a proper MAC in an encrypt-then-mac scheme, or standard authenticated encryption like AES-GCM.
Jul
11
comment Is OpenPGP vulnerable to the “crypto doom principle”?
Sign-then-Encrypt suffers from pretty much the same issues (padding oracles etc.) as MAC-then-Encrypt. I prefer Sign-then-Encrypt-then-MAC or Sign-then-AuthenticatedEncryption giving you the best of both worlds at moderate cost.
Jul
9
comment Selecting bijective functions for permutations
In most cases we use pretty simple but very fast functions. If you have enough rounds of these it becomes exponentially complicated. For example xor, modular addition and rotation in an ARX cipher, or an sbox in AES.
Jul
9
reviewed Approve suggested edit on Merkle Signature Generation
Jul
9
awarded  Proofreader
Jul
8
comment RSA padding: what is it and how does that work?
"Complexity" is a bad word choice IMO, since it's usually seen as undesirable property.
Jul
8
comment AES-CTR with ephemeral keys vs IV
I'd mix everything to generate a 256 bit master-key from which I'd derive both the keys and the IVs.
Jul
8
comment Do Gap-CDH groups exist?
"beyond the observation that no known algorithms for solving it yet exist" I don't think we have anything more for any group we commonly use.
Jul
8
comment How to safely sign a 6 characters String?
By using a signature operation that's designed for signing that applies proper padding. Most RSA libs have a proper RSA signature function. Don't use textbook RSA, and don't "encrypt with the private key".
Jul
6
comment Snowden Challenge II: Can we solve Snowden challenge quantumly?
@nightcracker At least djb thinks it's "confidence-inspiring code-based public-key encryption" and recently wrote a fast implementation.
Jul
6
comment Decimal point in keyspace notations? (eg 2^54.15)?
Looks like being a bit too precise to me.
Jul
5
comment Guarding against cryptanalytic breakthroughs: combining multiple hash functions
Concatenating two hashes provably is as collision resistant as the stronger of the two. So it certainly doesn't make things worse compared with using only one of them. It probably makes bad use of a given output size or processing time budget.
Jul
5
comment Guarding against cryptanalytic breakthroughs: combining multiple hash functions
If you want only specific combiners it's often possible to create hash functions that are at least as good as the stronger hash. For example concatenation for second pre-images and collisions. Though that combination might be weaker than one algorithm producing a long hash.
Jul
5
comment A block cipher with independent keys for each round
@pg1989 Which only apply if you use AES with non random keys. Related key attacks are only relevant if you want to use AES in unusual ways, for example by building a hash function from it.
Jul
5
comment Is this ECC encryption key sharing method okay?
I'd prefer hashing Cx before using it as key, but that's not a big issue.
Jul
5
comment DSA, RSA, ECDSA etc - which one is cheapest for signing?
If you rotate your ECDH key only once a minute and use it for multiple connections, you need only one signature per minute. i.e. the only costly operation is ECDH. Or you can sign each time, one EC signature has half the cost of ECDH.
Jul
5
comment DSA, RSA, ECDSA etc - which one is cheapest for signing?
RSA decryption as used in RSA TLS suites authenticates. Or the DH approach CurveCP and Noise take. In either case you only prove possession of the private key to the party you're communicating with, not to everybody.