10,054 reputation
12451
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 4 months
seen 7 hours ago

Jun
11
comment length extension attack on an MD5 hash of a text file of about 10K Bytes?
That isn't a length-extension. It's a second-pre-image and totally infeasible (cost above 2^120)
Jun
10
comment When using HMAC, does key encoding matter?
You can't get 512 bits of entropy with HMAC-MD5. The two keys get compressed before use, so they are reduced to 128 bits each. In some situations that might give a combined strength of 256 bits, but in others it won't. There might be meet-in-the-middle attacks, or producing collisions after the first step with 2^64 queries which enable a 2^128 brute-force search against the first key disregarding the second key,... In short I wouldn't rely on HMAC having a larger security level than the hash size.
Jun
9
comment Amateur question: two-way RSA?
1) It's expensive to encrypt all messages with RSA 2) You need to get all the details correct. Replay-attacks,... 3) Exchanging public keys is the hard problem. You need to figure out if the given public key belongs to the party you want to talk to. 4) Good transport encryption protocols offer forward-secrecy. Generating ephemeral RSA keys is a bit annoying compared to diffie-hellman keys.
Jun
9
answered “proof of access” schemes
Jun
9
reviewed Approve suggested edit on How random are commercial TRNGS
Jun
9
comment When using HMAC, does key encoding matter?
IMO using text representations of keys is silly, but it doesn't cause any security issues.
Jun
7
comment Why is TLS SRP verifier based on user name?
The server can choose the salt, so it can start a multi-target attack by giving all users the same salt.
Jun
7
comment Can substrings of a long string be efficiently authenticated?
making leaves smaller than twice the hash size makes little sense. Typically leaves are even bigger than that, for example TTH uses 1KiB leaves.
Jun
7
comment Can substrings of a long string be efficiently authenticated?
Your trivial solution is open to an attack where the attacker picks chunks from different messages that were authenticated with the same key. So if you go that way you need to include a message specific value in the MAC, losing the ability for incremental updates.
Jun
7
comment Can substrings of a long string be efficiently authenticated?
It's rather unusual to build a tree of MACs. The typical way of doing it is building a tree of hashes and only authenticating the root.
Jun
6
reviewed Approve suggested edit on semantic-security tag wiki excerpt
Jun
6
reviewed Approve suggested edit on semantic-security tag wiki
Jun
6
comment Is triple des similiar to RSA in that they message size is limited to the key size?
Using standard blockcipher modes of encryption with RSA isn't just impractical, it's totally broken for some modes. For other modes the non integral block-size of RSA prevetns use entirely.
Jun
5
comment When making public key fingerprints - is a sha1 hash still a good idea?
@JonnyWilson $2^{160} \approx 10^{48}$ is the cost of a pre-image attack against SHA-1. A generic collision attack costs $2^{80}$, and thanks to SHA-1's weaknesses a collision attack is even cheaper.
Jun
5
comment When making public key fingerprints - is a sha1 hash still a good idea?
The known weaknesses in SHA-1 don't matter much since collisions aren't a big threat for fingerprints. So using it is okay. If you don't need compatibility with fingerprints computed by other software SHA-2 is probably a better idea. You can truncate it a bit if you want.
Jun
5
comment In ECDSA, how many field operations are used for signature verification?
I'm talking about operations in the underlying field. In this case multiplication or squaring modulo $2^{255}-19$. I didn't count additions etc. since those are cheap.
Jun
5
comment In ECDSA, how many field operations are used for signature verification?
The Ed25519 code (on a 255 bit curve) I'm using seems to need around 1500 squarings and 1500 additions to verify a signature. But it's 1) another signature algorithm 2) an edwards curve. | It uses Shamir's trick and some form of pre-computation, but no batch verification.
Jun
5
asked Why use $(r,s)$ instead of $(r,s^{-1})$ as DSA signature?
Jun
5
comment Will D-Wave's quantum computers ruin classical encryption?
1) D-Wave's QC isn't of the crypto cracking variety. It's unclear if it's a QC at all 2) There is plenty of classical crypto that survives QCs. Only the popular asymmetric schemes get broken by QCs. Symmetric crypto and some unpopular asymmetric schemes survive.
Jun
4
comment If RSA is limited to 117-200 bytes or so, is that a very limited use case?
Some people call RSA a block cipher, but that is not a useful way of viewing it. RSA certainly doesn't fulfill the security requirements of a block cipher, and it can't be used in typical modes of operation.