9,467 reputation
12346
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years
seen 10 hours ago

Feb
2
comment ECDH VS. DH benchmarking in JAVA
Which curves are you using for ECDH? Fast ECC implementations need to be optimized for the specific curve you're working on. Perhaps the curves you're working on aren't well optimized in your ECC library.
Feb
2
comment ECDH VS. DH benchmarking in JAVA
Generating a keypair is simply a scalar multiplication for ECDH and a modular exponentiation for DH, both with fixed base point (allows some speedup if the implementation takes advantage of that). | @Thomas You don't need to select a random prime for either of them. Selecting prime is part of group generation, not of keypair generation.
Feb
1
revised Visualization of cryptography
added 65 characters in body
Jan
31
comment Prevent/minimize replay attacks in public message board
I'd throw a sequence counter, time-stamp, hash-chain and digital signature at it. I'll write a bit more tomorrow.
Jan
31
comment What is a tweakable block cipher?
The typical use is to use the block number as tweak. No need for hashing. Skein puts the counter into Threefish's tweak, together with a bit of additional information, such as a flag for the last block. When used as disk encryption, XTS simply uses the counter as tweak. You can use Threefish with constant tweak in CBC or any other conventional mode. A tweakable block cipher supports additional chaining modes compared to a normal block cipher, but can be used anywhere a normal block cipher is used.
Jan
31
revised What is a tweakable block cipher?
added 167 characters in body
Jan
31
answered What is a tweakable block cipher?
Jan
31
comment Prevent/minimize replay attacks in public message board
Is there a central server? How much do you trust that server?
Jan
30
comment Why is feed-forward mechanism used in hash functions?
btw. SHA-3 has no feed-forward, but its internal state is big enough to prevent this attack, just like it wouldn't be a problem in SHA-512/256.
Jan
29
comment How do I derive the time complexity of encryption and decryption based on modular arithmetic?
modPow is around $O(n^3)$
Jan
29
revised How do I derive the time complexity of encryption and decryption based on modular arithmetic?
added 44 characters in body
Jan
28
comment Why does Skein use an output transform, but other similar hashes don't?
I already quoted that section in my question. But I don't know why Skein without output transform has this property, and other hash functions constructed from a blockcipher with counter do not.
Jan
28
comment Is there a length-preserving encryption scheme?
I see no way for authenticated encryption to be length preserving. Length preserving encryption is obviously a bit weaker than what we can achieve by adding a nonce/IV and authentication tag, but it's still useful sometimes.
Jan
25
comment Secure communication between multiple peers on a public channel
Use this scheme with DH and not RSA. That allows 16 bytes per target user, instead of >100.
Jan
25
comment Secure communication between multiple peers on a public channel
1) You didn't say how this matches the OPs question. 2) I don't see how IBE is useful here 3) I couldn't find any useful information on that website. I'd like a link to technical information not marketing bullshit.
Jan
25
comment How can encryption software accept password lengths which are not one of the AES key lengths?
Truecrypt uses PBKDF2 with around a 1000 iterations as KDF.
Jan
24
comment What is a block cipher?
DES is clearly a block cipher(but a weak one). RSA generally isn't considered a block cipher, even if it shared some properties with one.
Jan
24
comment Secure communication between multiple peers on a public channel
With "basic" crypto I don't see a way around an overhead of 16*n to inform other users about your choice of short term key. But if you have a server that understands your protocol, that doesn't scale worse than normal multi user chat. I believe there is a way to run a single-round multi-party DH exchange if you use "fancy" crypto, but personally I wouldn't use that.
Jan
24
comment What is the most paranoid way to exchange messages?
Linking identity to public keys is out of scope for pure crypto. Cryptography can't know who you mean with "Alice". Exchange it in RL, have somebody else you already trust tell you(either web of trust or CA),...
Jan
24
comment What is the most paranoid way to exchange messages?
Concerning your articles: 112 bit ECC is broken, but that should be pretty obvious from its security level of 56 bits. ECC with sane sizes, namely 256 bit and above is in no way broken. The only concern is that there are certain patents. | And sorry, you'll need a better article to show the weakness of AES-128 than some vague blog post. I'm not aware of any attack coming close to breaking it in a practical sense.