9,417 reputation
12345
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years
seen 5 mins ago

May
5
comment Mapping integers to Ed25519 and back again?
You might want to take a look at Elligator 2, but it has some limitations.
May
5
revised Security benefits of Ed25519 generating signatures deterministically
edited tags; edited title
May
3
revised Shor's Algorithm values
added 18 characters in body
May
2
revised Pseudocode for constant time modular exponentiation
edited title
May
2
comment Back up an information as $n$ pieces and require exactly $n-1$ to recover it
Search for "erasure coding" and "secret sharing"
May
2
comment Can 64-bit “PRINCEcore” practically be brute forced?
Once you're over the initial development cost of custom hardware, this isn't very expensive. I think it's about as much work as mining a single bitcoin block at the current difficult. Or differently said, it would take the current bitcoin mining network only a few minutes. Should be 10k USD or something of that magnitude.
May
2
comment Why should I use an Initialization Vector (IV) when I have unique keys?
It's more of a multi-target pre-image attack rather than a collision attack. Personally I'd only bother with IVs when they key has "only" 128 bits. For 256 bit keys even those multi target attacks are too far out of reach.
May
1
comment Does not using padding mean a lack of security?
There are two kinds of padding: 1) Padding required by the mode of operation (for CBC but not CTR) 2) Padding that aims to make traffic analysis harder. These kinds of padding should not be confused.
May
1
comment Accelerated hashing on consumer-grade CPU?
Are you hashing many short messages, or few long ones? In the latter case you must use a tree hash to have any hope of parallelization.
Apr
30
comment Why must IV be sent with each packet?
You need a new IV for each message. You can't reuse the last block of the previous message. Doing that caused the BEAST attack against SSL. The assumption behind CBC's chaining is that an attacker can't see part of the ciphertext and then influence later plaintext.
Apr
30
comment How do you test the security of your cipher?
Depends a lot on what you mean by cipher. You mix concerns touching primitives, modes of operation and implementation. Each of these is tested completely differently. Primitives need lots of analysis by as many experts as possible. Modes of operation ideally feature a security proof. Implementations mainly need to avoid side channels and need to match official test vectors.
Apr
30
comment Why must IV be sent with each packet?
The IV must be different for each message. If you can use an implicit IV, such as a counter you don't need to send it explicitly. (At least with a mode that only needs unique IVs like CTR. For random IVs as in CBC you need some modifications, but in principle this is still possible)
Apr
29
comment How to implement a Cryptographic Pseudo Random Function
I prefer a two phase function: 1) Extract - Hash the seed and the input to a fixed size (say 256 bits) 2) Expand - Use a stream cipher to expand that key to whatever size you want. | You can use HKDF for this.
Apr
29
comment How to argue to a paranoid that RSA is safe?
There is little to argue beyond "many bright mathematicians tried to break it and nobody in published an attack faster than GNFS"
Apr
29
comment Pseudocode for constant time modular exponentiation
@fgrieu GnuPG used the naive if e[i] then c *= M until 2013. This enables cross VM attacks: eprint.iacr.org/2013/448
Apr
28
comment How can k3d3/ed25519-java's performance be improved?
Using bitshifts for conditionals (select, conditional swap,...) is necessary since the code aims to be constant time. Branches/switch statements have variable runtime due to branch prediction.
Apr
28
revised Pseudocode for constant time modular exponentiation
added 60 characters in body
Apr
28
comment Pseudocode for constant time modular exponentiation
The exponentiation part is easy if you're willing to sacrifice performance. The modular reduction is harder, considering that even the modulus is secret.
Apr
28
comment Pseudocode for constant time modular exponentiation
But you cannot use an if for this. You need a constant time conditional swap for that.
Apr
28
comment Pseudocode for constant time modular exponentiation
Considering the beginner mistakes in GnuPG's RSA I'm beginning to have doubts about that.