Reputation
11,190
Next tag badge:
97/100 score
18/20 answers
Badges
1 25 57
Newest
 Informed
Impact
~180k people reached

Mar
21
comment Security of simple Skein PBKDF mentioned in the paper
It's not memory hard and is comparable to PBKDF2. Scrypt and bcrypt are still better.
Mar
21
comment Is it safe to prefix the a key with a known value?
Since HMAC exhibits weird behaviour with variable length keys, I wouldn't really count it as an exception.
Mar
20
comment RC4 , Is it possible to find the key if we know the plaintext and ciphertext?
Only if you use many related keys.
Mar
20
comment How can ECDSA signatures be shortened (to be used as a product key)?
Perhaps they implemented BLS signatures. They only produce 2*n bit signatures for n bits of security, compared with 4*n bit signatures with ECDSA. There are also variants of Schnorr/DSA signatures that only produce 3*n bit signatures.
Mar
20
comment ECDSA for encryption
@chrisdew A hybrid system is the way to go with ECC. The alternative is EC-ElGamal and that's clearly an inferior choice. The overhead for ECIES with AES-GCM over a 256 bit curve is 48 bytes, 32 for the ephemeral public key and 16 for the MAC. Or you could simply use NaCl's Box operation, which is conceptually very similar to ECIES.
Mar
19
comment ECDSA for encryption
ECIES (or something similar) is the way to go. I don't see why AES based authenticated encryption wouldn't be a good fit. Of course reusing a key for encryption and signing is a bit of a risk, but IMO it's an acceptable one.
Mar
16
comment What is the most light-weight symmetric cipher thats still usefull?
What's your CPU? How much RAM and ROM do you have? How many CPU cycles can you afford for each byte of the message?
Mar
16
comment RSA Decryption from samples
See Dan Boneh - Twenty Years of Attacks on the RSA Cryptosystem Section 4.2 Hastad's Broadcast Attack.
Mar
16
comment RSA Decryption from samples
What's the public exponent? If e=3 decryption is simple (see Watson's answer). If e is bigger than the number of copies, this attack shouldn't work. But lack of proper padding (preferably OAEP) is still a very bad idea.
Mar
16
comment Reusing a one-time pad?
Since ARM Cortex M0 is a 32 bit processor and supports addition, rotation and xor, it should even be able to efficiently run ChaCha (possibly reduced to 8 or 12 rounds).
Mar
16
comment Reusing a one-time pad?
@Muis Which cipher is cheapest depends on the hardware. I expect RC4 to be reasonably fast on most small CPUs, as long as you can afford the RAM to keep its state. It also has a relatively expensive key setup, especially if you drop the first 1000 bytes (which I strongly recommend), but that doesn't matter for a large file.
Mar
16
comment Reusing a one-time pad?
The OP is suggesting something similar to a Vigenère encryption, not Caesar.
Mar
16
comment Reusing a one-time pad?
If you don't need a lot of security, you could try RC4. It shouldn't need a lot of CPU, but it needs about 300 bytes of RAM for its state. Drop the first 1000 or so bytes of output to avoid the worst biases. There is also a whole field of lightweight cryptography, but I'm can't recommend any particular algorithm.
Mar
16
comment Reusing a one-time pad?
"I have an embedded device."
Mar
14
comment Block cipher mode with diffusion on ciphertext
But trying to use this as a MAC doesn't work - for example truncation attacks are trivial in a known-plaintext scenario.
Mar
13
comment Block cipher mode with diffusion on ciphertext
Why do you need this property?
Mar
13
comment Why are twofish or other algorithms not NIST approved, are they still safe?
NIST simply chose a single candidate (rijndael) to become AES. This was about standardizing one secure choice, not about allowing all secure choices. 3DES and skipjack are only there for legacy support.
Mar
12
comment Workaround to implementing Forward Secrecy
You might want to clarify the second paragraph a bit. The diffie-hellman part of ECDHE is faster than RSA. It's only ECDHE_RSA which involves an RSA signature in addition to ECDHE that it gets slower than plain RSA. With ECDHE_ECDSA you should be even faster than plain RSA.
Mar
12
comment Why are modes of operation used, what attacks do they prevent?
Without a mode of operation you can only deterministically encrypt exactly 16 bytes.
Mar
11
comment Workaround to implementing Forward Secrecy
If the certificates use a new private key each time and you erase the old private key (tricky), you get a weak form of forward secrecy. If you create a new certificate with the same private key you get no forward secrecy at all.