9,834 reputation
12450
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 3 months
seen 10 mins ago

Jul
8
comment AES-CTR with ephemeral keys vs IV
I'd mix everything to generate a 256 bit master-key from which I'd derive both the keys and the IVs.
Jul
8
comment Do Gap-CDH groups exist?
"beyond the observation that no known algorithms for solving it yet exist" I don't think we have anything more for any group we commonly use.
Jul
8
comment How to safely sign a 6 characters String?
By using a signature operation that's designed for signing that applies proper padding. Most RSA libs have a proper RSA signature function. Don't use textbook RSA, and don't "encrypt with the private key".
Jul
6
comment Snowden Challenge II: Can we solve Snowden challenge quantumly?
@nightcracker At least djb thinks it's "confidence-inspiring code-based public-key encryption" and recently wrote a fast implementation.
Jul
6
comment Decimal point in keyspace notations? (eg 2^54.15)?
Looks like being a bit too precise to me.
Jul
5
comment Guarding against cryptanalytic breakthroughs: combining multiple hash functions
Concatenating two hashes provably is as collision resistant as the stronger of the two. So it certainly doesn't make things worse compared with using only one of them. It probably makes bad use of a given output size or processing time budget.
Jul
5
comment Guarding against cryptanalytic breakthroughs: combining multiple hash functions
If you want only specific combiners it's often possible to create hash functions that are at least as good as the stronger hash. For example concatenation for second pre-images and collisions. Though that combination might be weaker than one algorithm producing a long hash.
Jul
5
comment A block cipher with independent keys for each round
@pg1989 Which only apply if you use AES with non random keys. Related key attacks are only relevant if you want to use AES in unusual ways, for example by building a hash function from it.
Jul
5
comment Is this ECC encryption key sharing method okay?
I'd prefer hashing Cx before using it as key, but that's not a big issue.
Jul
5
comment DSA, RSA, ECDSA etc - which one is cheapest for signing?
If you rotate your ECDH key only once a minute and use it for multiple connections, you need only one signature per minute. i.e. the only costly operation is ECDH. Or you can sign each time, one EC signature has half the cost of ECDH.
Jul
5
comment DSA, RSA, ECDSA etc - which one is cheapest for signing?
RSA decryption as used in RSA TLS suites authenticates. Or the DH approach CurveCP and Noise take. In either case you only prove possession of the private key to the party you're communicating with, not to everybody.
Jul
5
comment DSA, RSA, ECDSA etc - which one is cheapest for signing?
I mean that I don't like using signatures to authenticate a side in a transport security protocol, like TLS. I prefer using DH for that. DH is a bit slower, but it offers stronger deniability.
Jul
5
reviewed Approve suggested edit on Cryptographic Challenge: How to Say Something Confidentially to Snowden?
Jul
5
comment DSA, RSA, ECDSA etc - which one is cheapest for signing?
But I don't really like using signatures for transport encryption since it weakens deniability. I prefer EC-Diffie-Hellman, even though it's more expensive than signing.
Jul
5
comment DSA, RSA, ECDSA etc - which one is cheapest for signing?
ECDSA is rather cheap. Personally I'd go with Ed25519 for signatures, which has a easily available high performance implementations.
Jul
5
comment What is the recommended replacement for MD5?
AFAIK SHA-3 isn't specified yet, if you want to use it now you need to use a Keccak variant that'll be slightly different from the final SHA-3. So I recommend waiting until the SHA-3 standard is actually published.
Jul
5
reviewed Approve suggested edit on Guarding against cryptanalytic breakthroughs: combining multiple hash functions
Jul
4
comment Generate a new public/private key pair for each new message?
@Christian The problems with this one is that key management becomes annoying. That's why protocols with a live connection like SSL or OTR can use similar techniques, for example to obtain forward-secrecy. For store and forward protocols like email it's far more annoying. For example how would you support receiving mails on multiple devices?
Jul
4
comment Generate a new public/private key pair for each new message?
@Shaga It's only hard if you only consider cryptographic attacks. Attackers gaining access to the private key by compromising an endpoint is a practical threat. This includes trojans, police raids, subpoenas,...
Jul
4
reviewed Approve suggested edit on constructing QR-like one way function