9,506 reputation
12347
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 1 month
seen 2 hours ago

Jan
30
comment Why is feed-forward mechanism used in hash functions?
btw. SHA-3 has no feed-forward, but its internal state is big enough to prevent this attack, just like it wouldn't be a problem in SHA-512/256.
Jan
29
comment How do I derive the time complexity of encryption and decryption based on modular arithmetic?
modPow is around $O(n^3)$
Jan
29
revised How do I derive the time complexity of encryption and decryption based on modular arithmetic?
added 44 characters in body
Jan
28
comment Why does Skein use an output transform, but other similar hashes don't?
I already quoted that section in my question. But I don't know why Skein without output transform has this property, and other hash functions constructed from a blockcipher with counter do not.
Jan
28
comment Is there a length-preserving encryption scheme?
I see no way for authenticated encryption to be length preserving. Length preserving encryption is obviously a bit weaker than what we can achieve by adding a nonce/IV and authentication tag, but it's still useful sometimes.
Jan
25
comment Secure communication between multiple peers on a public channel
Use this scheme with DH and not RSA. That allows 16 bytes per target user, instead of >100.
Jan
25
comment Secure communication between multiple peers on a public channel
1) You didn't say how this matches the OPs question. 2) I don't see how IBE is useful here 3) I couldn't find any useful information on that website. I'd like a link to technical information not marketing bullshit.
Jan
25
comment How can encryption software accept password lengths which are not one of the AES key lengths?
Truecrypt uses PBKDF2 with around a 1000 iterations as KDF.
Jan
24
comment What is a block cipher?
DES is clearly a block cipher(but a weak one). RSA generally isn't considered a block cipher, even if it shared some properties with one.
Jan
24
comment Secure communication between multiple peers on a public channel
With "basic" crypto I don't see a way around an overhead of 16*n to inform other users about your choice of short term key. But if you have a server that understands your protocol, that doesn't scale worse than normal multi user chat. I believe there is a way to run a single-round multi-party DH exchange if you use "fancy" crypto, but personally I wouldn't use that.
Jan
24
comment What is the most paranoid way to exchange messages?
Linking identity to public keys is out of scope for pure crypto. Cryptography can't know who you mean with "Alice". Exchange it in RL, have somebody else you already trust tell you(either web of trust or CA),...
Jan
24
comment What is the most paranoid way to exchange messages?
Concerning your articles: 112 bit ECC is broken, but that should be pretty obvious from its security level of 56 bits. ECC with sane sizes, namely 256 bit and above is in no way broken. The only concern is that there are certain patents. | And sorry, you'll need a better article to show the weakness of AES-128 than some vague blog post. I'm not aware of any attack coming close to breaking it in a practical sense.
Jan
24
comment What is the most paranoid way to exchange messages?
Public key distribution is a problem that can't be solves purely by cryptography. It boils down to how you define identity. How you do that is application dependent. For example you might print it on your business card.
Jan
24
comment What is the most paranoid way to exchange messages?
A public key doesn't need to be secret. But you need a way to find out which public key belongs to Alice without Eve substituting an evil public key.
Jan
24
comment What is the most paranoid way to exchange messages?
Choosing primitives that withstand classical computers is easy. The hard problem with crypto is always how you distribute public keys without the attacker being able to substitute their own.
Jan
24
comment What is the most paranoid way to exchange messages?
Why would AES or ECC be broken soon? ECC gets broken by a large quantum computer, but those probably won't appear any time soon. When using classical computers, even the NSA won't be able to afford breaking 256 bit ECC or 128 bit AES for several decades.
Jan
24
comment Cryptographic Primitive Method
I still don't get your question, but keccak's building block is a unkeyed permutation. Permutations are bijective. Keccak can be used as a hash, MAC, stream cipher and RNG.
Jan
24
comment Cryptographic Primitive Method
A stream cipher is a rather inflexible building block. It might be possible, but it won't be pretty or efficient. Don't do that. If you want a universal building block, use a block cipher(that's what I recommend), or an unkeyed permutation like what keccak uses. There are simple ways to create stream ciphers, hashes, MACs etc. from a wide block cipher.
Jan
24
comment Cryptographic Primitive Method
I don't really get your question. You can build most symmetric primitives from a blockcipher with a block size of at least 256 bit that's not vulnerable to related key attacks. For example you could build all of the above from threefish.
Jan
24
comment Is there a length-preserving encryption scheme?
Search for format preserving encryption. I'd guess the correct security model for length preserving encryption is that it's a variable length pseudo-random permutation (PRP).