10,073 reputation
12451
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 4 months
seen 45 mins ago

Dec
14
revised How do unkeyed hash functions (for MDCs) provide security?
Added link to an attack on hash+encrypt
Dec
14
comment Public keys and their protocols
But if there are two different doors $D_1$, $D_2$, then one of the doors is able to impersonate the supervisor to the other door.
Dec
13
comment RSA blind signatures in practice
@Denis Simply don't use the same key for blind signatures and encryption/normal signatures.
Dec
13
comment Polynomials and efficient computability
"otherwise we would see much larger RSA keys in use" I wouldn't conclude that. Those definitions are asymptotic and don't say anything about concrete key sizes.
Dec
12
reviewed Approve suggested edit on Information leakage in real-time voice encryption
Dec
12
reviewed Approve suggested edit on Differential Cryptanalysis of FEAL-4
Dec
12
reviewed Approve suggested edit on What is an oracle adversary?
Dec
12
comment RSA blind signatures in practice
@Denis No the bank doesn't pad. The applicant pads before blinding.
Dec
12
comment Can a shift cipher attain perfect secrecy?
@Eric Even if you treat each letter as a single message, you get the requirement that you can't send more than one message using a fixed key.
Dec
12
comment RSA encryption with private key and decryption with a public key
@PiotrDobrogost Check PKSC#1 for secure padding schemes.
Dec
11
comment RC4 encryption -> AES encryption = more or less secure than RC4 or AES alone?
I'd rather combine AES and Salsa20 than AES and RC4. And you did not specify what you mean by "encrypt with AES". Blockciphers don't simply encrypt data, you need a chaining mode. And what about IVs?
Dec
11
comment RC4 encryption -> AES encryption = more or less secure than RC4 or AES alone?
"you will have plenty of time to migrate away from the affected cipher" While you can upgrade authentication, you can't really upgrade confidentiality, since an attacker can simply store the old ciphertext. So in many scenarios you need a time-machine to do that.
Dec
11
comment What are the differences between a digital signature, a MAC and a hash?
One interesting variation is using the result of a DH key exchange as the key for a MAC. That way you can use asymmetric keys, but you avoid non-repudiation.
Dec
11
comment RSA blind signatures in practice
The main difference between blind and normal signatures is that the adversary creates the padding for a blind signature. So I'd prefer some kind of deterministic padding (such as FDH), since it reduces the freedom of the attacker.
Dec
10
comment What are the differences between a digital signature, a MAC and a hash?
Seems like an attempt to create a canonical question that explains the difference between commonly confused operations.
Dec
7
comment using Post-quantum asymmetric ciphers instead of RSA
@AlexandreYamajako The choice of construction depends on the application requirements. But if you just need a symmetric key, you could for example choose two random keys, encrypt each one with a different scheme, and use the hash of both as your symmetric key.
Dec
7
comment Factorize RSA knowing several N and E
Verifying if a number is prime can be done efficiently using a probabilistic algorithm, for example by checking if $a^p=a mod p$ for some different $a$s. (I believe there are also deterministic algorithms, but that's more complicated and doesn't gain anything in practice)
Dec
7
comment RSA 4096 bit key benchmark
Implementing asymmetric encryption on top of ECDH is trivial. ECDH can do almost everything RSA encryption can do. Just like with RSA you have a key-pair, which can be long term, and can be used for encryption.
Dec
7
comment using Post-quantum asymmetric ciphers instead of RSA
Related question: What is the post-quantum cryptography alternative to Diffie-Hellman?
Dec
7
comment RSA 4096 bit key benchmark
But if you want high performance and high security, why RSA? You could use a ~256 bit (or if paranoid ~512 bit) elliptic curve. That's pretty fast and offers a security level of 128 bit (or 256 bit for a 512 bit curve).