CodesInChaos

less info
meta site favicon meta user | stack exchange network profile network profile
5,964 reputation
1927
bio website github.com/CodesInChaos
location Munich, Germany
age
visits member for 1 year, 10 months
seen 16 mins ago
stats profile views 109

681 Comments

suggestions reviews revisions comments badges posts accepts all
11h
 comment How much data can I encrypt with AES before I need to change the key in CBC mode?
Another part of risk management is assessing how big the damage is. For an IV collision with AES-CBC it's typically not very big.
2d
 comment Is Wikipedia's table about SHA-2 collisions correct?
The :24 is probably referring to a version reduced to 24 rounds.
May
15
 comment calculating beta for elgamal elliptic curves
I'd use an existing ECC library which offers a scalar multiplication function. But if you implement it yourself you can look at the Explicit-Formulas Database which as addition/doubling formulas for many curve forms.
May
15
 comment calculating beta for elgamal elliptic curves
@BobbDizzles You need to look up the point addition and doubling formulas for your curve form.
May
15
 comment Generating IV in TLS 1.2
RNGCryptoServiceProvider isn't that slow. It just has a large per-call overhead, so you need to ask for a few kilobytes in a single call. On my notebook it can generate around 4 million IVs (with 16 bytes each) per second on a single core.
May
12
 comment Designing a security system from scratch with a custom protocol, suggestions needed
1) Cryptography is all about leaving things to chance, just with really small chances. 2) Adding a MAC is essential. HMAC in a encrypt-then-mac contruction is one good solution, dedicated authenticated encryption like AES-GCM another.
May
12
 comment Can someone help with the following hashes?
It doesn't look like one of the common encodings like hex or base64.
May
11
 comment Does SRP reduce to DH key echange when shared password is not secret?
And you don't just need a BigInt library for SRP. If you go that way you will most likely be vulnerable to timing attacks. You need a specialized library that does exponentiation in constant time to do DH or SRP.
May
11
 comment Does SRP reduce to DH key echange when shared password is not secret?
Since SRP uses DH as a building block, you need a DH implementation anyways.
May
10
 comment Finding hash almost-collisions
I don't get how you go from $2^{52}$ to $2^{26}$, considering this is a near pre-image, not a near collision.
May
10
 comment Finding hash almost-collisions
Your math can't be right, $2^{26}$ is far too low to win such a competition. That's less than a CPU minute on a single core. I'd expect them to easily exceed $2^{40}$. I wouldn't be surprised if they managed $2^{51}$ operations with ATI GPUs.
May
10
 comment Security of Salsa20 with some known plaintext?
@davidkomer It's essential to use a distinct nonce for every message you encrypt. If you do that, Salsa20 is pretty secure. You should also consider adding authentication, so active attacks are rejected.
May
10
 comment Security of Salsa20 with some known plaintext?
@D.W. Salsa20 is a stream cipher. It always uses something similar to CTR mode.
May
9
 comment Recommended way of adding a pepper/secret key to password before hashing?
I would encrypt the hash
May
8
 comment Many consecutive hashes to slow down brute force attack?
The entropy loss due to collisions is negligible. Nobody has ever found even a single SHA-256 collision. There is no practical security difference between hashing a salted password multiple times and PBKDF2.
May
6
 comment Show that for all integers n>2, n does not divide n^2+2
Depends on what you can take for granted. Normally I'd simply use that $\forall x : x \cdot n = 0 \pmod n$, thus $n^2+2 = 2 \pmod n$. For $n>2: 0 \neq 2 \pmod n$, so $n$ does not divide $n^2+2$.
Apr
29
 comment Adding and multiplication in jacobian coordinates
Once again, what do you mean by "multiplication of 2 points"? I don't think this is a supported operation on elliptic curves.
Apr
29
 comment Secure order preserving hash function
Your requirements are simply a contradiction. Order preservation allows binary search which allows trivial and efficient inversion of any unkeyed function.
Apr
29
 comment Secure order preserving hash function
Your requirement trivially allows a binary search to recover the the message in a chosen plaintext scenario. It's also easy to prove that the only way to satisfy the condition is order preserving encryption. So I have no clue what you even mean by an oder preserving hash.
Apr
29
 comment Counter Mode: static IV but different keys
For secure network protocols you typically run an ephemeral key-exchange at the beginning, so you end up with a unique master key in any case. So using nonce=0 is actually a bit easier, but generating a random nonce is very easy as well.
1 2 3 4 5 … 35