9,417 reputation
12345
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years
seen 46 mins ago

Jun
19
comment Is using EAX mode with a 64-bit block cipher a bad idea?
A 64 bit authentication tag isn't a big problem. Authentiation tags are not subject to offline attacks. With an ideal 64 bit MAC each forgery has a $2^{-64}$ chance of being accepted. Thus HMAC-SHA256 with a 128 bit key truncated to 64 bits would give okay security. But I don't know how close EAX is to an ideal MAC. Many AEAD schemes decay as message length increases or as more messages are observed. I'm too lazy to investigate how EAX fares. There is also the concern of birthday problem related attacks with $2^{32}$ cost.
Jun
19
reviewed Reject suggested edit on prime-numbers tag wiki
Jun
19
comment Is there a hash function which has no collisions?
There are collision free one way functions. For example $y = g^x \mod p$. But I'm pretty sure that SHA-512 would be a better choice, despite the collisions.
Jun
18
comment Can two cipher letters per plaintext letter easily defeat character frequency analysis?
Sounds like a homophonic substitution cipher.
Jun
18
reviewed Approve suggested edit on Hash function with values in a multiplicative group of prime order
Jun
17
comment Hash function with values in a multiplicative group of prime order
which group are you using?
Jun
17
reviewed Approve suggested edit on Can cryptography be used to hide routing information from the router?
Jun
17
reviewed Approve suggested edit on Anonymity in end-to-end encryption
Jun
15
comment Security of authenticated encryption modes gcm & ccm
If robustness is more important than performance, then I prefer HMAC+encryption in a encrypt-then-MAC scheme over GCM and the like.
Jun
15
reviewed Approve suggested edit on How do I decrypt ciphertext with this cipher?
Jun
15
comment Can cryptography be used to hide routing information from the router?
It's not obvious to me that homomorphic encryption helps here
Jun
14
reviewed Approve suggested edit on Why is H(message||secret_key) not vulnerable to length-extension attack?
Jun
14
revised Why is H(message||secret_key) not vulnerable to length-extension attack?
added 64 characters in body
Jun
14
reviewed Approve suggested edit on understanding a length extension attack
Jun
14
answered Why is H(message||secret_key) not vulnerable to length-extension attack?
Jun
14
comment Why is H(message||secret_key) not vulnerable to length-extension attack?
You can perform a length extension, but then the message doesn't end with the secret key anymore and is thus not a valid authentication tag.
Jun
14
comment Would this simple encrypted chat program be feasible using One Time Pads?
@zuallauz D.W.'s point is valid. Security is only as strong as the weakest part. The strength of symmetric encryption(which your scheme tries to improve) is not the weakest part. It's also easy to increase the strength of symmetric crypto taking a minor performance hit, for example by cranking up the number of rounds or by using double encryption. The real problems are keeping the endpoints secure vs. malware, backdoors and physical access etc. and the key management i.e. how to securely get your partners (public) key)
Jun
13
revised Scrypt as a KDF with one-time high-entropy input
edited tags
Jun
13
revised KDF with low-entropy salts
edited tags
Jun
13
revised Reason(s) for using a KDF for encryption keys
edited tags