9,731 reputation
12347
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 2 months
seen 8 hours ago

10h
comment Scalar multiplication of elliptic curve point by a fraction
You need the inverse modulo the order of the group, not modulo the inverse in the underlying field.
20h
comment Why would an RSA library tell me that the public key must be at least 512 bits in size?
229110545576645850236522690668306544921 = 13118050575083334077 * 17465289088900344973 so this looks like a plausible modulus, albeit very weak. 13082845549543033994073971762152947067 = 37 * 1128586338367 * 313303828194079496938273 It's quite unusual to use a large e, typically we use small primes with low hamming weight like 3 or 65537.
20h
comment Why would an RSA library tell me that the public key must be at least 512 bits in size?
I also want to note that keys used for confidentiality effectively never time out, since the attacker can store the ciphertext forever.
20h
comment Why would an RSA library tell me that the public key must be at least 512 bits in size?
You should replace the "any kind of asymmetric encryption ... at least 2048 bits" part. This size recommendation if appropriate for RSA or finite field Diffie-Hellman based encryption. There are other algorithms which need much smaller (e.g. 224 bits with ECC) or much larger (~1 Mbit for McEliece) keys for a similar security level.
Sep
13
comment Does NTRU provide Perfect Forward Secrecy?
I don't see the point in using NTRU for authentication and ECDHE for confidentiality. If you want post quantum security, it's far more important to use a PQ algorithm for confidentiality than for authentication, since authentication keys expire and can be revoked.
Sep
13
comment Does NTRU provide Perfect Forward Secrecy?
You can use RSA to achieve forward secrecy and you can use DH creating a non forward secret protocol. Forward secrecy is a matter of protocol design and key management, not about the algorithm you use. In practice we often use DH for forward secrecy since key generation is cheap. But even for algorithms with expensive key generation, you can simply generate a new short term key every couple of seconds, which results in a high degree of forward secrecy.
Sep
11
comment How can AES be considered secure when encrypting large files?
You describe ECB mode, which is indeed not secure. But actually used modes make it different for each block.
Sep
11
comment stream cipher computation cost
Depends on the specific cipher. Salsa20/ChaCha have 512 bit blocks (it's very similar to CTR mode), RC4 outputs bytes. Other ciphers can have different word/block sizes.
Sep
7
comment Can I crack an AES string if I have all these parameters?
They clearly had a bug in their encryption code which stripped the high bits of the IV.
Sep
6
comment Can I crack an AES string if I have all these parameters?
"pad it with 0 x 250" that part makes no sense considering AES only supports 256 bit/32 byte keys, not 256 byte keys. Perhaps you were using an implementation that ignores additional 0 bytes, so only 0 x 26 were used.
Sep
6
comment Why does FIPS 186-4 require specific sizes for keys?
Larger sizes certainly won't hurt security. But restricting the sizes might simplify some implementations.
Sep
5
comment What is the most secure key expansion routine?
@John You could take a look at sosemanuk, which uses serpent as key expansion.
Sep
5
comment Why is Rijndael key length restricted?
Probably because the designer didn't see a point in supporting keys larger than 256 bits. It's not like a conventional computer will ever brute-force 256 bits, and even with a quantum computer it's pretty expensive.
Sep
4
comment Would xoring 2 independant AES CTRs to produce p-rand introduce vulnerabilities?
Meet-in-the-middle means that this isn't stronger against brute-force than single AES in some popular cost models. (Not sure if they are realistic models)
Sep
4
comment Would xoring 2 independant AES CTRs to produce p-rand introduce vulnerabilities?
You should fix your notation so that different variables get different symbols. (e.g. $k_1$ and $k_2$). With its current definition your function is simply zero.
Sep
4
comment Is this correct way to generate stream cipher using AES CTR mode?
Note that even without key-reuse, using a fixed IV enables multi-target attacks. Not a big issue with AES-256, but something I'd avoid with AES-128.
Sep
3
comment Encryption-Decryption-Encryption
@poncho 20 seconds too slow :)
Sep
3
comment Encryption-Decryption-Encryption
Related: Why do we use encrypt-decrypt-encrypt (EDE) in 3DES, rather than encrypting three times?
Sep
3
comment What is the exact purpose of length padding in Merkle–Damgård hash functions?
BLAKE uses a similar technique, but combines it with a traditional padding. In Blake2 we replaced the traditional padding with zeros since that's simpler, still secure and reduces the number of compression function calls if the message length is an integral number of blocks (important for tree hashing).
Sep
3
comment What is the exact purpose of length padding in Merkle–Damgård hash functions?
Normal compression functions have two inputs, the chaining value and the message block. Skein uses a tweakable compression function which has a third input. It uses this input to signal the end of the message end of the message, preventing length extension attacks. It also uses it to pass a kind of block counter to each compression, so a unique compression function is used for each position in the hash, which improves second pre-image resistance compared to MD hashes. Take a look at the Skein paper, it's pretty readable.