10,054 reputation
12451
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 4 months
seen 2 hours ago

Mar
18
awarded  Fanatic
Mar
18
comment How large should a Diffie-Hellman p be if the messages are encrypted?
You should also ask yourself what you're using DH for, if you already have a shared key? Forward secrecy?
Mar
18
comment How large should a Diffie-Hellman p be if the messages are encrypted?
Messages being encrypted doesn't make a difference. Just use a standard group designed for diffie-hellman.
Mar
17
comment How comparable is OFB to a one-time pad?
OFB is a synchronous stream cipher, and OTP is one as well.
Mar
17
revised Low Public Exponent Attack for RSA
added 45 characters in body; edited tags
Mar
16
comment Is AES-256 a post-quantum secure cipher or not?
The attack you link does not work when you use AES with a random key in a normal way. If you only need AES to be a pseudo-random-permutation (PRP), then it's no attack at all. AES was primarily designed as a PRP, resistance to related key attacks was only a secondary goal(if it was a goal at all). It is only an attack if you use AES in an unusual way where the attacker has control over the key. For example if you try building a hash function from AES, this attack might become an issue.
Mar
16
comment Is AES-256 a post-quantum secure cipher or not?
Calling a related key attack on AES "practical" isn't really true. The way AES is supposed to be used is with a random key. So this attack can't be used against any "normal" AES use.
Mar
11
comment Is there an efficient way to hide the encrypted plaintext length with a block cipher?
I don't get your question, but you can use AES-CTR as PRNG. Stream ciphers and the expansion part of a PRNG are essentially the same thing. But that way the only input will be the key.
Mar
11
comment Would a “Triple AES” (in the sense of how Triple Des works) serve for a dramatic increase in safety?
If were were to use double encryption, I'd go with AES xor ChaCha (or Salsa20). Tahoe-LAFS will use some variant of this for its 100 year crypto.
Mar
11
comment Would a “Triple AES” (in the sense of how Triple Des works) serve for a dramatic increase in safety?
sha256 with salts for stored passwords <- that's weak. You need some iterated scheme, like PBKDF2, bcrypt or scrypt. See How to securely hash passwords?
Mar
11
comment Would a “Triple AES” (in the sense of how Triple Des works) serve for a dramatic increase in safety?
DES is broken because its key is small, not because cryptoanalysis advanced so much. An AES256 key is large enough. So the analogy isn't that useful. While it's likely that 3AES will be stronger that AES, I'd prefer a different algorithm, since you're trying to guard against cryptoanalysis of AES.
Mar
11
revised Can one detect if two pairs of elements in Zp have the same exponential relation?
added latex formatting
Mar
11
comment Where to store the private key and the public key in a communication protocol
@DavidSchwartz Implementing something better than SSL isn't that hard. SSL suffers quite a bit from bad legacy constructions that lead to vulnerabilities like BEAST or Lucky13.
Mar
11
comment Method and explanation for calculating difference in speed between DES and RSA
Find some website with benchmarks (or create your own). If the cost is given per-operation, instead of per-byte, then divide by the block size in bytes.
Mar
11
comment Where to store the private key and the public key in a communication protocol
"And for this reason , it will be more secured" a protocol that wasn't analyzed is much more likely to have undiscovered weaknesses than one that has been analyzed a lot. So this argument makes no sense.
Mar
11
comment computing inverses in truncated polynomial rings manually for NTRU encryption
I don't get your "not pseudo-code". To do it manually, you should execute the pseudo-code manually.
Mar
9
comment Can one detect if two pairs of elements in Zp have the same exponential relation?
I believe there are some groups which have this property. I think the lucre paper briefly mentioned them.
Mar
9
comment Is there a way to use Shamir Secret Sharing with updatable data?
Then why don't you retain the private key, without giving it to the other parties? If you want to be able to read the data without consulting the other parties, then you need to do something that's equivalent to retaining the key.
Mar
9
comment ChaCha cipher + Poly1305
@nightcracker I recommend splitting your implementation into two parts. 1) KeyExchange aka. crypto_box_beforenm which is Hash(scalarMult(b,A)) with HSalsa as the default hash 2) AuthenticatedEncryption aka. crypto_secret_box or crypto_box_afternm which is Salsa20(HSalsa20(key, n1), n2)
Mar
9
comment Is SHA-256 secure as a CTR block cipher?
Using HMAC halves the output speed, and the gain is rather dubious. (Though if you need a fast streamcipher, you wouldn't use SHA-2 in the first place.)