9,417 reputation
12345
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years
seen 3 hours ago

Feb
22
revised Why nobody considers counter re-keying as a standard Block Cipher Mode?
added 365 characters in body
Feb
22
revised Why nobody considers counter re-keying as a standard Block Cipher Mode?
added 469 characters in body
Feb
22
revised Why nobody considers counter re-keying as a standard Block Cipher Mode?
added 469 characters in body
Feb
22
comment Why nobody considers counter re-keying as a standard Block Cipher Mode?
Related question: Can I build a secure tweakable block cipher from a normal one by adding key and tweak?. That idea seems to be the same as yours.
Feb
22
answered Why nobody considers counter re-keying as a standard Block Cipher Mode?
Feb
22
comment Digital signatures in SSL/TLS-like protocols
You can authenticate to a specific party using DH. CurveCP is a TLS like protocol that does this.
Feb
22
comment Can I find two specific words with the same md5 hash?
Look up the chosen prefix collision attacks on MD5. | The brute-force collsion attack Jon Hulka describes if far to expensive for the OP.
Feb
21
comment Scrypt as a KDF with one-time high-entropy input
@hunter No, with 8 bytes I'd use scrypt. My definition of "high entropy" is "at least 128 bits of entropy", and it's mathematically impossible for 8 bytes to have such high entropy even when they're perfectly random.
Feb
20
comment Validating successful decryption in AES
I'd use a MAC instead. For example use HMAC-SHA-2 on the ciphertext. Derive the MAC key and the AES key from a master key.
Feb
19
comment Could use an explanation of the notation for an oracle adversary
Asymptotic security definitions ARGHHH
Feb
19
revised AES key/ciphertext space sizes
added 40 characters in body
Feb
19
comment AES key/ciphertext space sizes
possible duplicate of AES Key Length vs Block Length
Feb
16
revised Is sharing the modulus for multiple RSA key pairs secure?
edited body
Feb
15
answered Scrypt as a KDF with one-time high-entropy input
Feb
14
comment Why is OCB-AES mode not becoming a standard for authenticated encryption?
It's not clear to me that you can do much better given AES-NI hardware. Wouldn't be surprised if we needed new instructions for that, which will take a decade or so. 2) Most security proofs assume PRPness of AES, which related key attacks don't affect, and biclique attacks are just a minor speedup. So I don't think there should be many affected proofs. | I also don't think any of these answer why AES-OCB isn't used. People are fine with using AES, and it seems clearly better than other AES based modes.
Feb
14
comment Why is OCB-AES mode not becoming a standard for authenticated encryption?
1) With AES-NI the performance of AES-OCB is great, even ChaCha12 can't compete. It's just without AES-NI that it's slow. 2) What attacks against AES are you talking about? I'm not aware of any real attacks when AES is used with a random key. 3) How is the cost of forgeries unclear? It's simply the cost of decryption. I also think forgery flood isn't that big an issue.
Feb
14
comment Why is triple-DES using three different keys vulnerable to a meet-in-the-middle-attack?
@malexmave There is no way to split either of them into two halves in a way where the more expensive half has less than 2^114 keys.
Feb
14
answered Why is triple-DES using three different keys vulnerable to a meet-in-the-middle-attack?
Feb
12
comment Measuring Shannon's diffusion
Measuring the number of rounds a full diffusion takes is common.
Feb
12
reviewed Approve suggested edit on Why does the SRP6 calculation of B included a multiplier k = 3?