10,502 reputation
12454
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 6 months
seen 3 hours ago

Dec
4
revised Will X9.31 remain a secure & acceptable deterministic random generator beyond 2015?
added 9 characters in body
Dec
4
comment SHA1 - SSL/TLS Cipher Suite
@crypto-learner The attacker would get the CA to look the harmless looking one of the colliding pair and then use the malicious one with the same signature.
Dec
4
revised Using machine-learning techniques for data-dependent operations in ciphers
added 2 characters in body
Dec
4
reviewed Edit Point decompression on an elliptic curve
Dec
4
revised Point decompression on an elliptic curve
improving formatting, typos
Dec
3
comment Is this problem based on a known hard problem?
I have never seen a meaningful reduction to knapsack. There are almost always issues around asymptotic vs concrete security and average vs worst case. I wouldn't not use anything knapsack based in practice.
Dec
3
answered I don't care about replay attacks. What should I do with the nonce in nacl?
Dec
2
comment Repeating something encrypted and non-encrypted?
As long as your encryption is secure know plaintexts don't help the attacker.
Dec
2
comment Does Ed25519 support cryptographic threshold signatures?
There is always the generic solution: A public key is the concatenation of n individual public keys and the threshold m, a signature is the concatenation of m individual signatures.
Dec
2
revised Does Ed25519 support cryptographic threshold signatures?
added 147 characters in body
Dec
1
comment SHA1 - SSL/TLS Cipher Suite
I'm not sure if that Certificate collision attack would still work, even if people managed to do a chosen prefix attack like what happen with MD5. In response to those attacks many (all?) CAs included a piece of unpredictable data early in the certificate, which should prevent collision attacks.
Dec
1
comment SHA1 - SSL/TLS Cipher Suite
@crypto-learner The typical attack based on collisions in certificate hashes is creating two certificates with the same hash, one having the to-attack domain in it and one a domain you control. Then get the CA to sign the certificate for the domain you control and present the certificate with the attacked domain to the user in SSL.
Dec
1
comment SHA1 - SSL/TLS Cipher Suite
HMAC-SHA-1 used as a MAC is still plenty strong. The problems with the traditional SHA-1 based suites isn't that they use SHA-1, it's that they're using either CBC with encrypt-then-mac (tricky to implement correctly) or RC4.
Dec
1
comment SHA1 - SSL/TLS Cipher Suite
I expect those suites to become less common as AES-GCM and AEAD modes in general gain popularity. TLS 1.3 will probably only support AEAD modes excluding the traditional SHA-1 based suites.
Dec
1
comment Requirement for the length of a HMAC tag?
Why do you consider collision resistance in the context of a MAC? I don't think this is relevant. AFAIK you get $n$ bits of security from a good $n$ bit MAC, and neither collisions nor multi-target attacks apply, assuming a sufficiently long key.
Dec
1
comment ECC - ElGamal with Montgomery or Edwards type curves (curve25519, ed25519) - possible?
If you don't need the special properties of ElGamal, I recommend using ECIES (or something similar). Easier to implement, and I believe the security reduction is a bit better as well.
Nov
28
comment Collision in Merkle–Damgård without a collision in compression function
I don't think so -- the length suffix should be enough to make the reduction work.
Nov
27
comment Finding Elliptical curve points and encoding text using them
@JohanO To prevent key generators in a licensing scheme a signature is a better choice than encryption, provided you can live with a ~40 byte signature (longer once encoded as characters).
Nov
25
comment Elliptical curve cryptography key generation time
You'd use essentially the same algorithms described at Exponentiation by squaring on Wikipedia, except that the basic operation is addition instead of multiplication. This means you only need about 256 squaring and 256 multiplications.
Nov
25
comment OTP from Sony BIOS password recover
With a 64 bit modulus you can simply factor via trial division at cost $2^{32}$.