10,532 reputation
12454
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 6 months
seen 1 hour ago

12h
comment How do I communicate the value of the initialization vector to the end user? Should it be part of the encrypted message?
Standard practice is using a random per message IV and sending it alongside the message, typically as a prefix. So in principle you got the IV handling right.
13h
comment Why isn't CTR mode (counter mode) used more often?
@MaartenBodewes In that case I couldn't use what Microsoft built into .NET either. In fact whenever I needed raw CTR (not authenticated encryption like GCM), I needed random read access, which the .NET API doesn't provide.
17h
comment Why isn't CTR mode (counter mode) used more often?
@Anthony Luckily implementing CTR on top of ECB is pretty easy. Perhaps 10 lines of code.
23h
comment Why isn't CTR mode (counter mode) used more often?
One problem with CTR mode is that there isn't just a single way of turning counter and nonce into input for the block cipher core.
1d
comment Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit?
I'm talking about using a message counter as nonce. That way you can have a collision between (k, n_1, c_1) and (k, n_2, c_2).
1d
comment Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit?
For GCM to be secure the inputs to AES must be unique. With concatenation having a unique nonce (responsibility of the caller) and a unique block counter (part of GCM itself) is enough to guarantee unique inputs to AES. With XOR the caller must make sure that the 128 bit nonces are spaced far enough from each other so that xor-ing the counter doesn't cause a collision. That's annoying.
1d
comment Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit?
With concatenation the caller only has to ensure the nonce is unique. For example they can use a counter. If you use xor or add nonce and counter you get overlaps, so a counter as nonce would be fatally broken.
2d
comment How does BLAKE2 ensure that hash(A) != hash(B) when B = A||0 and both A & B have the same number of blocks?
Hopefully the documentation situations will improve, JPA and others recently resumed the work on an RFC style specification.
2d
comment How does BLAKE2 ensure that hash(A) != hash(B) when B = A||0 and both A & B have the same number of blocks?
My blog entry Alternative Blake Padding might be relevant, where I propose a simplified padding, which with some minor tweaks turned into the Blake2 padding.
2d
comment How does BLAKE2 ensure that hash(A) != hash(B) when B = A||0 and both A & B have the same number of blocks?
@Nova The specification document is the first link in the Downloads section.
Jan
25
comment Merkle Tree resistance against spoofing,splicing and replay?
1) replays are a protocol level concern, and make no sense for a hash function. 2) I don't even know what you mean by spoofing and splicing.
Jan
24
comment Why do Certificate Authorites cross-sign each other?
This is a security question, not a crypto question. So it'd be a better fit for Information Security.
Jan
23
comment Finding strong primes
How big it has to be depends on what you want to use it for. For Diffie-Hellman I'd consider 1024 bits the minimum with 2048 bits recommended. Choosing p=2*q+1 is standard practice when generating Diffie-Hellman groups.
Jan
23
comment Number of keys when using symmetric and asymmetric encryption?
I wouldn't count an asymmetric keypair as two keys.
Jan
22
comment How does RSA padding work exactly?
PKCS#1 describes two paddings, v1.5 padding (which is weak) and OAEP padding (which is recommended). Don't try to invent your own padding.
Jan
22
comment Diffie-Hellman on infinite groups
If you are talking about groups like integers, rational or real numbers, they have two problems. First the memory requirement is exponential in the size of the exponent and second the computing logarithms is easy.
Jan
20
comment Practical Attack on RSA
Key size is of little relevant when considering side channel attacks. Some kinds of side channel attacks can be prevented by constant time implementations, for some you need to shield the hardware.
Jan
20
comment Why is EdDSA collision-resilient with SHA-512?
It's important do distinguish between collisions of SHA-512 itself and collisions of SHA-512 mod q.
Jan
19
comment Public key encryption and big files with NaCL
Do you know how big the file is before you encrypt it?
Jan
19
comment Why are some $x$ coordinates unsuitable for an ECDSA generator point?
For an elliptic curve, about half the x values have two associated points, the other half of the x values has none (they correspond to the twist of the curve).