8,799 reputation
12041
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 2 years, 9 months
seen 4 hours ago

Jun
7
comment Can substrings of a long string be efficiently authenticated?
Your trivial solution is open to an attack where the attacker picks chunks from different messages that were authenticated with the same key. So if you go that way you need to include a message specific value in the MAC, losing the ability for incremental updates.
Jun
7
comment Can substrings of a long string be efficiently authenticated?
It's rather unusual to build a tree of MACs. The typical way of doing it is building a tree of hashes and only authenticating the root.
Jun
6
reviewed Approve suggested edit on semantic-security tag wiki excerpt
Jun
6
reviewed Approve suggested edit on semantic-security tag wiki
Jun
6
comment Is triple des similiar to RSA in that they message size is limited to the key size?
Using standard blockcipher modes of encryption with RSA isn't just impractical, it's totally broken for some modes. For other modes the non integral block-size of RSA prevetns use entirely.
Jun
5
comment When making public key fingerprints - is a sha1 hash still a good idea?
@JonnyWilson $2^{160} \approx 10^{48}$ is the cost of a pre-image attack against SHA-1. A generic collision attack costs $2^{80}$, and thanks to SHA-1's weaknesses a collision attack is even cheaper.
Jun
5
comment When making public key fingerprints - is a sha1 hash still a good idea?
The known weaknesses in SHA-1 don't matter much since collisions aren't a big threat for fingerprints. So using it is okay. If you don't need compatibility with fingerprints computed by other software SHA-2 is probably a better idea. You can truncate it a bit if you want.
Jun
5
comment In ECDSA, how many field operations are used for signature verification?
I'm talking about operations in the underlying field. In this case multiplication or squaring modulo $2^{255}-19$. I didn't count additions etc. since those are cheap.
Jun
5
comment In ECDSA, how many field operations are used for signature verification?
The Ed25519 code (on a 255 bit curve) I'm using seems to need around 1500 squarings and 1500 additions to verify a signature. But it's 1) another signature algorithm 2) an edwards curve. | It uses Shamir's trick and some form of pre-computation, but no batch verification.
Jun
5
asked Why use $(r,s)$ instead of $(r,s^{-1})$ as DSA signature?
Jun
5
comment Will D-Wave's quantum computers ruin classical encryption?
1) D-Wave's QC isn't of the crypto cracking variety. It's unclear if it's a QC at all 2) There is plenty of classical crypto that survives QCs. Only the popular asymmetric schemes get broken by QCs. Symmetric crypto and some unpopular asymmetric schemes survive.
Jun
4
comment If RSA is limited to 117-200 bytes or so, is that a very limited use case?
Some people call RSA a block cipher, but that is not a useful way of viewing it. RSA certainly doesn't fulfill the security requirements of a block cipher, and it can't be used in typical modes of operation.
Jun
4
comment If RSA is limited to 117-200 bytes or so, is that a very limited use case?
@RobertHarvey An RSA modulus is typically between 1024 and 4096 bits, minus padding this allows you to put a few hundred bytes in it. In theory it's possible to split the message into multiple RSA blocks to overcome the limit, but there are no standard ways of doing this because it's a really dumb idea.
Jun
4
comment ECC Point Multiplication of Product
What are you using for n? The order of the curve? Or the modulus of the prime field? Scalars need to be reduced modulo the order.
Jun
4
comment ECC Point Multiplication of Product
Are you using bigintegers? With double you'll get loss of precision, with small integers you get overflows.
Jun
3
comment How insecure in practice?
For DES the answer is that it can definitely be decrypted using brute-force. A 56 bit key is far too small.
Jun
2
comment Can i modify data “protected” by a CRC16?
@John Both. Brute-force is cheap at only 16 bits. It's also possible to compute it directly, but I don't remember details. I used that to fix the CRC32 of files to an arbitrary value by modifying 4 consecutive bytes in one of my projects.
Jun
1
comment Can i modify data “protected” by a CRC16?
If you can control at least 2 of the first 50 bytes you can fix the CRC.
May
30
comment How well analyzed are giant block length ciphers?
The website you linked is certainly full of bullshit. A 256 bit block and 256 bit key is certainly enough for almost everything.
May
30
comment How well analyzed are giant block length ciphers?
It's easy to construct a large block blockcipher from a normal block cipher with a factor 2 performance hit. So I see little reason to use dedicated large block blockciphers.