Reputation
12,018
Next tag badge:
89/100 score
20/20 answers
Badges
1 29 60
Newest
 Revival
Impact
~199k people reached

Jan
20
comment In what way is XXTEA really vulnerable?
I'd agree with you if this question were about actual security. But since this question is about DRM (a licensing scheme) it almost certainly relies on security-through-obscurity. Compared to the attacker simply extracting the key or patching the software, the risk arising from a weak blockcipher like XXTEA is probably negligible.
Jan
20
comment Are there groups where the computational Diffie Hellman problem is easy but the discrete log problem is hard?
AFAIK there are no know groups where this is the case, but we know no proof that shows they don't exist either.
Jan
20
comment In what way is XXTEA really vulnerable?
"there are other, simpler ways to defeat the licensing mechanism than launching a cryptographic attack on the license file data." I completely agree with that statement. But it's not clear to me that you actually want encryption in the first place. A MAC or a digital signature might fit your needs better.
Jan
20
comment Which is better ECDHE with TLS 1.0
@fgrieu 1) Most browsers mitigate BEAST, even on TLS 1.0 2) BEAST (like all other attacks based on TLS using MtE instead of EtM) is inherently an active attack. RC4 has some weaknesses even against passive attacks. 3) BEAST seems to be tricky to exploit in practice. The original attack needed browser features/bugs no longer present.
Jan
17
comment Which is better ECDHE with TLS 1.0
@GiovanniNervi Some clients are vulnerable to BEAST. The rest have implemented workarounds even on TLS 1.0. I consider BEAST to be a smaller issue than RC4 sucking.
Jan
17
comment Which is better ECDHE with TLS 1.0
At minimum you can eliminate 3DES, it's strictly worse than AES. And NULL is obviously not useful either when you're interested in confidentiality.
Jan
17
comment what's the advantages of identity-based systems over certificate-based ones?
You don't need to be able to be able to obtain the public key of the recipient before you can encrypt a message to them since you can compute it. That's pretty much the only advantage over certificated based PKI and comes at the steep price of the central authority being able to decrypt everything.
Jan
16
comment Distributed integer factorization?
How large are the semi primes you want to factor? AFAIK the most expensive subprocess for 512 bit and 1024 moduli is a different one, and one of them is hard to distribute.
Jan
15
comment Ephemeral Diffie-Hellman generator selection
Why don't you simply hardcode a default group?
Jan
15
comment Decryption honeypots
TrueCrypt hidden volumes
Jan
15
comment FIPS 140-2 compliant algorithms in Enhanced RSA and AES Cryptographic Provider (Windows XP)
@RX_DID_RX 1) Do you need to use that particular implementation? There are plenty of SHA-2 implementations that work on XP. 2) Do you need a FIPS certified implementation, or just a compliant algorithm?
Jan
15
comment FIPS 140-2 compliant algorithms in Enhanced RSA and AES Cryptographic Provider (Windows XP)
@RX_DID_RX I believe it's approved for some, but not all uses. But even if it's allowed, why use an old and broken function in new code?
Jan
15
comment FIPS 140-2 compliant algorithms in Enhanced RSA and AES Cryptographic Provider (Windows XP)
cross posted on stackoverflow
Jan
14
revised how do you calculate the private exponent in asymmetric key encryption
added 25 characters in body; edited tags
Jan
12
comment Why use Needham-Schroeder if we have Diffie-Hellman?
Needham-Schroeder was published in 1978, Diffie-Hellman in 1976. So DH was new and unproven back then, so based a protocol purely on symmetrical primitives might have been a good idea. Now DH is over 30 years old and has seen a lot of analysis, so it's far more trustworthy now. CPU power has grown a lot as well, which is important since asymmetric crypto is more expensive than symmetric crypto.
Jan
12
comment Why use Needham-Schroeder if we have Diffie-Hellman?
Which Needham-Schroeder are you referring to? The symmetric or the asymmetric? But I'd assume the main reason for choosing either of them is historical. I doubt anybody would design a new protocol based on NS.
Jan
12
comment Methods of making ASIC/GPU resistant encryption?
For most primitives we can simply choose keys large enough to resist brute-force, even with ASIC. Larger keys are cheap for the defender, but exponentially expensive for the attacker. For example a 256 bit AES key is $2^{128}$ times to break as expensive as a 128 bit AES key, but only 1.4 times as expensive to use. Only a few cases we're desperate enough to use expensive operations, usually to compensate for the limits of humans (e.g. users not being willing to memorize secure passwords).
Jan
10
comment ECC - Point Addition/Point Multiplication
An important alternative to euclid is exponentiation. Since you can reduce exponents modulo $\phi(p)=p-1$, computing $x^{-1}$ is equivalent to computing $x^{p-2}$. The big advantage of this technique is that the code has no branches depending on $x$, so it can be implemented in constant time, avoiding side channel attacks.
Jan
9
comment Can I use HMAC-SHA1 in counter mode to make a stream cipher?
A PRF is a keyed primitive, a hash isn't. So the terminology doesn't apply directly. But pretty much all symmetric crypto relies on belief.
Jan
9
comment How is the AEScrypt password related to the underlying AES key
@StephenTouset Most ad-hoc password hashing schemes will have the same security as PBKDF2. Possibly even a bit more, since PBKDF2 invites low performance implementations. Specification wise PBKDF2 is pretty silly as well.