Reputation
12,269
Next tag badge:
90/100 score
20/20 answers
Badges
1 31 61
Newest
 Enlightened
Impact
~211k people reached

Aug
20
comment Shuffleless PRNG function with non-repeating values?
search for format preserving encryption and ffx mode.
Aug
20
comment Shuffleless PRNG function with non-repeating values?
Skip32 and ipcrypt have 32 bit blocks.
Aug
19
comment File encryption with AES CTR mode
Reused kev/iv pairs amount to a many-time-pad. For many kinds of data, such as txt or html files this leaks a lot of information seeing 2 versions and nearly perfect recovery seeing 3 versions. We have several questions about that, just search a bit.
Aug
16
comment How to verify the integrity of RSA encrypted messages?
@t0b0 That an attacker can replace the key and message is always the case for asymmetric encryption. You need to add some kind of sender authentication, such as a signature or DH+MAC if you want to prevent that. The concept vlp describes is known as hybrid-encryption and sound, as long as you take the pitfalls otus mentioned into account.
Aug
14
comment Chopping off SHA256 entropy?
The only reason to prefer SipHash over truncated SHA2 is performance. SipHash isn't even designed to be collision resistant.
Aug
12
comment Security impact of signing small data using RSA
Consider using HTTPS/SSL/TLS to secure the connection in addition to your signature scheme.
Aug
12
comment Security impact of signing small data using RSA
Are you using proper padding, like PSS?
Aug
10
comment How can I compare two hash algorithms?
The best way we know for determining the security of primitives is having experts trying to break it for years. It's unlikely that they'll bother to do so with your algorithm.
Aug
10
comment Is it possible to validate a Public Key in RSA?
There are efficient algorithms with which the owner of the key can prove that e and phi(n) are co-prime.
Aug
4
comment Why do crypto libs use table lookups when they're vulnerable to timing attacks?
@user54609 bitslicing is only efficient for parallelizable modes.
Aug
2
comment Is modular Barrett reduction usable for Ed25519?
The order is still pretty close to a power-of-two, so you can use a variant of the approach described at: What are the computational benefits of primes close to the power of 2?
Jul
31
comment Point addition in NaCl/libsodium (Curve25519)
It's public domain if you copy it out of NaCl or SUPERCOP.
Jul
28
comment Factorize RSA knowing several N and E
@Antimony While RSA moduli usually have two prime factors, that's not always the case. Using more factors improves the CRT speedup, but you need to be careful that the factors remain big enough so that elliptic curve factorization (whose cost depends on the size of the factors) is more expensive than GNFS (whose cost depends on the size of the modulus).
Jul
27
comment Point addition in NaCl/libsodium (Curve25519)
NaCl isn't an ECC library, it only offers higher level operations like key-exchange and signatures and doesn't have point addition in its public API. You should be able to find an edwards form point addition function in its Ed25519 implementation.
Jul
26
comment Show How to Efficiently Solve the Computational Diffie-Hellman Assumption given an Algorithm that Solves the Square-DH Problem
Related problem: Can we reduce Diffie-Hellman problem to “Discrete-log inversion” problem?
Jul
22
comment Question about the key in RC4
@lena What's your target hardware? The relative performance of ciphers varies a lot between different CPUs.
Jul
19
comment Why don't use random padding in RSA?
AFAIK what Yehuda described is called RSA KEM. I believe it comes with a pretty strong security proof.
Jul
18
comment How is an epsilon of 1/1000 non-negligible?
1) This question is about what it means for an attacker's advantage to be negligible. Your answer doesn't address that at all. 2) Exploiting a weak PRNG to factor an RSA modulus generated by it isn't related to brute-force. 3) If you're referring to the "many moduli have a prime in common" problem, that was caused by very badly seeded PRNGs outputting identical data of several hundred bits for the first request of random data. This is unrelated to small biases.
Jul
18
comment Why does “2xAES-256” provide “99.99%” security strength whereas “1xAES-128” provides “40%”?
@mikeazo Should I trust CipherCloud? has been closed and deleted. While this question isn't as as non constructive, it still has the "I want to criticize that product but must do it disguised as a question" trait.
Jul
18
comment Why does “2xAES-256” provide “99.99%” security strength whereas “1xAES-128” provides “40%”?
I'm closing this because it's not a genuine question about cryptography. It's a post designed to make fun of ridiculous marketing claims, just phrased as a question. If you enjoy debunking bad crypto, you might want to create a blog, similar to Bruce Schneier's doghouse.