9,686 reputation
12347
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 1 month
seen 8 hours ago

Apr
29
reviewed Approve suggested edit on Quality of randomness on a Linux system with haveged
Apr
29
reviewed Approve suggested edit on Adding and multiplication in jacobian coordinates
Apr
29
reviewed Approve suggested edit on LT codes with Homomorphic hashing
Apr
29
comment Secure order preserving hash function
Your requirements are simply a contradiction. Order preservation allows binary search which allows trivial and efficient inversion of any unkeyed function.
Apr
29
comment Secure order preserving hash function
Your requirement trivially allows a binary search to recover the the message in a chosen plaintext scenario. It's also easy to prove that the only way to satisfy the condition is order preserving encryption. So I have no clue what you even mean by an oder preserving hash.
Apr
29
comment Counter Mode: static IV but different keys
For secure network protocols you typically run an ephemeral key-exchange at the beginning, so you end up with a unique master key in any case. So using nonce=0 is actually a bit easier, but generating a random nonce is very easy as well.
Apr
29
comment Secure order preserving hash function
Read the CryptoDB paper. I think what they use is the best thing we have, but it obviously has significant weaknesses inherent in order preserving encryption.
Apr
29
comment Secure order preserving hash function
That can't really be a hash anymore. Your condition can only be satisfied by order preserving encryption. It implies having different results for each input, and not just that collisions are hard to find.
Apr
28
comment standard way to authenticate parties with public keys without certificates
You need some way to associate Bob with his public key. Either per finger print verification (SSH style) which shifts to problem to obtaining the fingerprint, per trusted third party(CA), per web of trust,... You alway need some mechanism. Else how do you define "Bob", if not by his public key.
Apr
28
comment Adding and multiplication in jacobian coordinates
Take a look at the Explicit-Formulas Database
Apr
28
comment Adding and multiplication in jacobian coordinates
what's the curve equation? And what do you mean by multiplying points? I only know point addition and doubling and multiplying a point by a scalar by repeated addition/doubling.
Apr
27
comment Secure encrypt-then-sign with RSA
@RickyDemer No, I mean sign, then authenticated symmetric encryption together with RSA encryption on the symmetric key. The authenticated part of that is mainly to prevent annoyances that could break the confidentiality. (padding oracles etc.)
Apr
27
comment Secure encrypt-then-sign with RSA
I prefer sign then authenticated encrypt. The only tricky part is including enough information in the signed part - it needs to be able to stand for itself.
Apr
27
comment implementing long term archive encryption
There is no asymmetric encryption/keyexchange that I'd trust for 30 years.
Apr
26
comment How can a key pair be derived from an arbitrary hash?
Factorization only applies to RSA, not to ECC. For ECDSA a private key is just a number in a certain range. Numbers outside of that range can be mapped into the range with the modulo operator.
Apr
25
comment Password verification
Don't read more than the natural size from PBKDF2. Since Rfc2898DeriveBytes uses SHA-1, reading more than 20 bytes is a bad idea. It halves your KDF performance, without hindering the attacker. For client side password hashing I'd also crank up the iterations a bit to 100k or even higher. If that makes it too slow, replace .net's implementation with a fast implementation. Or switch to scrypt.
Apr
25
reviewed Edit suggested edit on Combining AEAD with RSA
Apr
25
revised Combining AEAD with RSA
corrected the link
Apr
24
comment Using the output of a stream cipher, how to guarantee the integrity of 4 bytes of data?
"Concretely use the stream as a key for SipHash" what do you want to say with that?
Apr
23
comment Using the output of a stream cipher, how to guarantee the integrity of 4 bytes of data?
Are you sure that the overhead actually matters? You could also use a MAC with small constant overhead, such as SipHash.