Reputation
11,065
Next tag badge:
97/100 score
18/20 answers
Badges
1 24 55
Newest
 Custodian
Impact
~178k people reached

Sep
10
comment Who uses Dual_EC_DRBG?
Are there some more detailed descriptions of how the Vista+ CSPRNG works? When I last looked, I only found a description of the old XP CSPRNG.
Sep
10
comment Should new applications still use RSA? Is it worth going down the ECDH route for protocols?
As an inspiration of what can be done with ECDH + symmetric encryption, check out CurveCP and Noise. CurveCP is a bit simpler, but has some minor flaws. An interesting article, inspired by these protocols is Moxie's Simplifying OTR deniability
Sep
10
comment Should new applications still use RSA? Is it worth going down the ECDH route for protocols?
Personally I use ECC for almost everything, ECDH for key-exchange and authentication, EdDSA for third-party verifiable signatures.
Sep
9
reviewed Approve Should we trust the NIST-recommended ECC parameters?
Sep
9
revised Security of pairing-based cryptography over binary fields regarding new attacks
added 7 characters in body
Sep
9
comment Security of (cryptographic) padding compared to other methods for blockcompletion for block ciphers
If you verify the MAC before you start decrypting, then any message the attacker has modified (a prerequisite of a padding-oracle attack) won't reach the cipher. So a secure MAC prevents all active attacks against the encryption scheme.
Sep
9
comment Security of (cryptographic) padding compared to other methods for blockcompletion for block ciphers
To prevent oracle attacks, you should add a MAC using an encrypt-then-mac scheme. Most unauthenticated encryption schemes suffer from some kind of active attack, a padding oracle is just the most famous.
Sep
9
comment What NIST protocol was allegedly backdoored by NSA in 2006?
While that's an obvious candidate for a rigged standard, it's not completely clear if it's the standard the article was talking about.
Sep
9
comment What NIST protocol was allegedly backdoored by NSA in 2006?
Somebody claiming to be John Kelsey of NIST says that NSA did not write SP 800-90.
Sep
9
comment Should we trust the NIST-recommended ECC parameters?
Since the seed isn't short (why???) the creator could have tried many curves (say $2^{70}$) in hopes of finding a weak one. So the question is if there is a significant fraction of $b$ values for which the curve is weak, and the NSA knew about that weakness back when the parameters were generated.
Sep
8
comment Distributed Asymmetric Key Decryption with threshold
No idea if anybody wrote a paper about it. It's just a straight forward and useful combination of asymmetric encryption and shamir secret sharing. I came up with it myself and I expect many others to have done so before me.
Sep
8
comment Known-plaintext attack on Blowfish in ECB mode
Brute-forcing a 40 bit key in 60 seconds on a CPU sounds unrealistically fast, especially since Blowfish has a rather slow key-setup. I would have expected several hours at minimum.
Sep
8
comment Is the “secure-as-worst-case” version of NTRU patented?
As a side-note: The proof is asymptotic and thus of limited value for practical key-sizes.
Sep
6
revised What is it meant by a “hybrid argument”?
added 72 characters in body
Sep
6
comment Is javascript RSA signing safe?
I'm suggestion that without SSL everything else you do is meaningless since an attacker can simply replace the html file. Whatever you choose to do should be on top of SSL.
Sep
6
comment Is javascript RSA signing safe?
It still matters if your website was loaded over SSL (i.e. uses HTTPS) and if the web sockets run over SSL.
Sep
6
comment Is javascript RSA signing safe?
Are you using HTTPS? Without HTTPS a webapplication has no hope of being secure.
Sep
6
comment Distributed Asymmetric Key Decryption with threshold
You can create a random symmetric key for each message, apply shamir secret sharing to it (symmetric secret sharing) and then encrypt each share with a different public key.
Sep
4
revised One-way function and $EXP$
edited tags
Sep
4
reviewed Approve One-way function and $EXP$