Reputation
11,576
Next tag badge:
97/100 score
18/20 answers
Badges
1 25 57
Newest
 Informed
Impact
~188k people reached

Aug
14
revised Is there an algorithm or hardware that can sign/verify natural time?
added 51 characters in body
Aug
14
comment Can padding length, and thus plaintext length, be considered public information when using aes-cbc?
What's really important is that you compute a MAC over the whole ciphertext (not plaintext), including padding and IV. Attempting to authenticate the plaintext is a bad idea with CBC mode, you really need to authenticate the ciphertext with a proper MAC.
Aug
12
comment RC2, RC4, RC5 key length
In principle RC4 could consume an arbitrarily long key, as long as it consists of complete bytes, but you don't gain anything once the key-size exceeds the state-size.
Aug
11
comment Verify Messages to Embedded Device
I'd use a deterministic variant of ECDSA. Perhaps Ed25519, perhaps Thomas Pornin's proposal and perhaps a simple hash of private key and message hash.
Aug
10
revised What is the fastest elliptic curve operation f(P) in affine coordinates such that f^n(P)=P only if n is large?
added 850 characters in body
Aug
10
comment What are the security effects of reusing a public RSA key to encrypt large data by blocks?
Why can't you use standard hybrid encryption whee you encrypt the actual message with AES and the AES key with RSA?
Aug
10
answered What is the fastest elliptic curve operation f(P) in affine coordinates such that f^n(P)=P only if n is large?
Aug
10
comment Does impersonating an SRP server give you enough information for an off-line dictionary attack?
I'm certainly no expert on SRP and it has been a long time since I looked at SRP so it's quite possible that I'm wrong. Avoiding this attack could be the explanation for SRPs seemingly unnecessary complexity. I always wondered what SRP offers over simple DH.
Aug
9
comment why AKS is so slow in practice?
@nightcracker While primality testing isn't cryptography per-se, it's close enough for me to consider it on-topic here.
Aug
9
comment Alice's forgetful banking
If the server successfully impersonates a legitimate server(the OP's assumption is that this is possible) they learn the public key of the client. Knowing the public key allows a password guessing attack, which is only partially mitigated by using a good password hash. With socialist millionaire only signup and not login are vulnerable to this.
Aug
9
comment Alice's forgetful banking
Problem with SRP is that an attacker who impersonates a server learns the password hash, enabling offline search. I'd look into socialist millionaire or something similar protocols.
Aug
9
comment Alice's forgetful banking
Can't you simply use the username for the lookup followed by a zero knowledge proof for the password hash?
Aug
9
revised How strong is the ECDSA algorithm?
deleted 51 characters in body
Aug
9
awarded  Enlightened
Aug
9
awarded  Nice Answer
Aug
8
comment why DES encryption uses different modes like ECB,OFB?
Without a mode you can encrypt exactly 8 bytes in a deterministic way. If you want to do anything more, you need a mode.
Aug
8
reviewed Approve Why is Merkle-Damgård construction insecure?
Aug
7
comment Any problems with this secure time synchronization scheme?
@Thomas Why? 1) Then nonce serves as a challenge, else an attacker could simply return an old signed time. The nonce is an essential part of this scheme. 2) A signature scheme may or may not be randomized. I don't see how that matters here.
Aug
7
comment Allowing the user to choose the hashing formula at the registration
@hunter The "no header" approach is an essential part of TrueCrypt's design. It aims at plausible deniability by making encrypted files indistinguishable from random data. AFAIK TrueCrypt needs to try all combinations of cipher and KDF, but it starts with the most common one.
Aug
7
comment Allowing the user to choose the hashing formula at the registration
@hunter No, TrueCrypt needs to try them all since its files have no unencrypted header. IMO it's a good example of what not to do. They could have simply hardcoded PBKDF-2-HMAC-SHA-512 with 100'000 iterations and it would have been far stronger that what they have ATM.