10,302 reputation
12452
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 5 months
seen 5 hours ago

Sep
9
comment Security of (cryptographic) padding compared to other methods for blockcompletion for block ciphers
If you verify the MAC before you start decrypting, then any message the attacker has modified (a prerequisite of a padding-oracle attack) won't reach the cipher. So a secure MAC prevents all active attacks against the encryption scheme.
Sep
9
comment Security of (cryptographic) padding compared to other methods for blockcompletion for block ciphers
To prevent oracle attacks, you should add a MAC using an encrypt-then-mac scheme. Most unauthenticated encryption schemes suffer from some kind of active attack, a padding oracle is just the most famous.
Sep
9
comment What NIST protocol was allegedly backdoored by NSA in 2006?
While that's an obvious candidate for a rigged standard, it's not completely clear if it's the standard the article was talking about.
Sep
9
comment What NIST protocol was allegedly backdoored by NSA in 2006?
Somebody claiming to be John Kelsey of NIST says that NSA did not write SP 800-90.
Sep
9
comment Should we trust the NIST-recommended ECC parameters?
Since the seed isn't short (why???) the creator could have tried many curves (say $2^{70}$) in hopes of finding a weak one. So the question is if there is a significant fraction of $b$ values for which the curve is weak, and the NSA knew about that weakness back when the parameters were generated.
Sep
8
comment Distributed Asymmetric Key Decryption with threshold
No idea if anybody wrote a paper about it. It's just a straight forward and useful combination of asymmetric encryption and shamir secret sharing. I came up with it myself and I expect many others to have done so before me.
Sep
8
comment Known-plaintext attack on Blowfish in ECB mode
Brute-forcing a 40 bit key in 60 seconds on a CPU sounds unrealistically fast, especially since Blowfish has a rather slow key-setup. I would have expected several hours at minimum.
Sep
8
comment Is the “secure-as-worst-case” version of NTRU patented?
As a side-note: The proof is asymptotic and thus of limited value for practical key-sizes.
Sep
6
revised What is it meant by a “hybrid argument”?
added 72 characters in body
Sep
6
comment Is javascript RSA signing safe?
I'm suggestion that without SSL everything else you do is meaningless since an attacker can simply replace the html file. Whatever you choose to do should be on top of SSL.
Sep
6
comment Is javascript RSA signing safe?
It still matters if your website was loaded over SSL (i.e. uses HTTPS) and if the web sockets run over SSL.
Sep
6
comment Is javascript RSA signing safe?
Are you using HTTPS? Without HTTPS a webapplication has no hope of being secure.
Sep
6
comment Distributed Asymmetric Key Decryption with threshold
You can create a random symmetric key for each message, apply shamir secret sharing to it (symmetric secret sharing) and then encrypt each share with a different public key.
Sep
4
revised One-way function and $EXP$
edited tags
Sep
4
reviewed Approve One-way function and $EXP$
Sep
2
comment Key Refresh in Diffie-Hellman
"that an attacker would get an amount of ciphertext for the same key for cryptoanalysis and breaking the encryption." As long as you use strong encryption, you shouldn't worry about that. The added complexity is a far greater risk than AES getting broken. But if you insist, you should HKDF with different info strings on the shared key to derive the individual keys instead of re-running DH. Or, my preferred way of encrypting files, use a new random key for each file, and encrypt that key with the master key.
Sep
2
comment Key Refresh in Diffie-Hellman
How would you get your partners public key with respect to the new generator?
Sep
2
comment Key Refresh in Diffie-Hellman
Why do you want to change the key? In your question it sounds like you change keys for changes sake.
Sep
2
revised Where can I double check my elliptic curve results?
added 3 characters in body
Sep
2
comment Initialization vector in symmetric-key encryption
What is the underlying issue behind "there is no way to create an initialization vector for each encryption"? Do you need length preserving encryption? Or deterministic encryption? Or is there no CSPRNG?