9,834 reputation
12450
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 3 months
seen 1 hour ago

Mar
1
comment Is it safe for the ChaCha8 nonce to be deterministic?
You're misunderstanding something. Input to the permutation is 64 bytes, but that includes key, stream-id(nonce), offset and a constant.
Mar
1
comment Timing attack on modular exponentiation
Depends on your implementation. A good implementation uses some technique to defend against side-channel attacks. Either by using the same operations no matter what the data is, or by using blinding.
Mar
1
revised While generating a random Elliptic curve what are the conditions i have to considerd?
added 17 characters in body
Mar
1
reviewed Approve suggested edit on Simple example for CP-ABE (Ciphertext policy attribute-based encryption)
Mar
1
reviewed Approve suggested edit on Are RSA signatures deterministic?
Mar
1
comment Can I combine two PRNGs to make use of more seed data?
There are some tricky points here, but they're not related to entropy or the PRNG. It might be possible that the side that needs to commit later, can generate many public keys, until the random wordlist has some desired properties(such as being similar to the original wordlist). Check out how ZRTP attacked this problem.
Mar
1
comment Can I combine two PRNGs to make use of more seed data?
In that case you have a ~128 bit security level, so a 160 bit PRNG is fine. Or you can hash your seed data, and use it as key for Salsa20.
Mar
1
comment Can I combine two PRNGs to make use of more seed data?
How large is the finite field/elliptic curve you ran you DH on?
Mar
1
comment Counter mode secure hash algorithm
Btw. constructing a MAC with such a property is much easier. We know several such MACs.
Feb
28
comment Efficient Symmetric Mutual Entity Authentication Protocol
Asymmetric crypto isn't that expensive, especially if you use ECDH instead of RSA. It's only an issue if you create really many connections in a short time (several thousand per second) or you're using a really weak device(embedded system).
Feb
28
comment Is SHA-1 collision free on data up to 20 bytes long?
@mikeazo 1) I used exist in the mathematical sense, where you can show that something exists, without being able to actually construct it. (If the claim that there are collisions is actually true, then there exists a short proof for their existance) 2) Not with probability 1. You need $2^{160}+1$ in the worst case. But it's quite unlikely it will need more than $2^{90}$ operations.
Feb
28
comment Is SHA-1 collision free on data up to 20 bytes long?
@mikeazo Technically the proof exists, but it's very expensive ($2^{80}$ invocations) to find it.
Feb
28
comment Efficient Symmetric Mutual Entity Authentication Protocol
When you use passwords as shared secrets, an important property of a such a protocol is not exposing the shared secret to offline search (against passive attackers).
Feb
28
comment Is SHA-1 collision free on data up to 20 bytes long?
With the way we typically construct symmetric primitives the fastest way to prove it, is finding a collision with these properties, and that requires $2^{80}$ work. What's clear is that an ideal 160 bit hashfunction does have collisions with length 20 (with overwhelming probability), and we have not the tiniest amount of evidence suggesting that SHA-1 so broken that it doesn't have this property.
Feb
28
comment Is SHA-1 collision free on data up to 20 bytes long?
Most likely not. See Is SHA-512 bijective when hashing a single 512-bit block?. The same arguments apply to SHA-1.
Feb
28
awarded  hash
Feb
27
comment Is SHA-1 still practical secure under specific scenarios?
I wouldn't use SHA-1 in any situation where MD5 is broken i.e. when some form of collision resistance is required.
Feb
27
comment Is SHA-1 still practical secure under specific scenarios?
Are you talking about HMAC with a key that's unknown to the attacker?
Feb
27
comment How to efficiently generate a stream of independent, but biased random bits?
Actually an output bit has only 0.72 bits of entropy.
Feb
27
comment When do ECC patents end?
My impression is that as long as you use a software implementation of a prime curve without point compression, you're probably not violating any patents. (As usual IANAL applies)