10,257 reputation
12452
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 5 months
seen 23 hours ago

Dec
1
comment SHA1 - SSL/TLS Cipher Suite
I'm not sure if that Certificate collision attack would still work, even if people managed to do a chosen prefix attack like what happen with MD5. In response to those attacks many (all?) CAs included a piece of unpredictable data early in the certificate, which should prevent collision attacks.
Dec
1
comment SHA1 - SSL/TLS Cipher Suite
@crypto-learner The typical attack based on collisions in certificate hashes is creating two certificates with the same hash, one having the to-attack domain in it and one a domain you control. Then get the CA to sign the certificate for the domain you control and present the certificate with the attacked domain to the user in SSL.
Dec
1
comment SHA1 - SSL/TLS Cipher Suite
HMAC-SHA-1 used as a MAC is still plenty strong. The problems with the traditional SHA-1 based suites isn't that they use SHA-1, it's that they're using either CBC with encrypt-then-mac (tricky to implement correctly) or RC4.
Dec
1
comment SHA1 - SSL/TLS Cipher Suite
I expect those suites to become less common as AES-GCM and AEAD modes in general gain popularity. TLS 1.3 will probably only support AEAD modes excluding the traditional SHA-1 based suites.
Dec
1
comment CTR or CBC is using hashed plaintext into encrypted block?
I doubt that this mode has a name - apart from the generic "bad idea".
Dec
1
comment Requirement for the length of a HMAC tag?
Why do you consider collision resistance in the context of a MAC? I don't think this is relevant. AFAIK you get $n$ bits of security from a good $n$ bit MAC, and neither collisions nor multi-target attacks apply, assuming a sufficiently long key.
Dec
1
comment ECC - ElGamal with Montgomery or Edwards type curves (curve25519, ed25519) - possible?
If you don't need the special properties of ElGamal, I recommend using ECIES (or something similar). Easier to implement, and I believe the security reduction is a bit better as well.
Nov
28
comment Collision in Merkle–Damgård without a collision in compression function
I don't think so -- the length suffix should be enough to make the reduction work.
Nov
27
comment Finding Elliptical curve points and encoding text using them
@JohanO To prevent key generators in a licensing scheme a signature is a better choice than encryption, provided you can live with a ~40 byte signature (longer once encoded as characters).
Nov
25
comment Elliptical curve cryptography key generation time
You'd use essentially the same algorithms described at Exponentiation by squaring on Wikipedia, except that the basic operation is addition instead of multiplication. This means you only need about 256 squaring and 256 multiplications.
Nov
25
comment OTP from Sony BIOS password recover
With a 64 bit modulus you can simply factor via trial division at cost $2^{32}$.
Nov
25
comment Are there any digital signature algorithms in common use that result in 32-byte signatures?
My mistake, I wanted to say "at a 128 bit security level". 64 bits of security as you suggest is rather weak.
Nov
25
comment Are there any digital signature algorithms in common use that result in 32-byte signatures?
If the order has 128 bits, a normal EC schnorr signature takes 64 bytes and a hashed schnorr signature still costs 48.
Nov
24
comment Recovering El Gamal secret key from signatures
When the nonce is reused you can simply solve those two equations for the private key.
Nov
20
comment Are all binary-additive stream ciphers reciprocal?
Note that this isn't the case for CFB mode, which is a xor based stream cipher but doesn't fulfill your particular definition.
Nov
19
comment special public keys and modulo n
You need distinct primes. Also if you're using CRT you'll need to change your code a bit to take advantage of the multi prime speedup.
Nov
19
comment Modes of encryption for hard drives?
CTR is not a good idea since an attacker who sees two versions of a block can attack it with the usual many-time-pad attacks. This can happen due to SSD wear leveling.
Nov
19
comment Modes of encryption for hard drives?
XTS is one of the most popular modes. See Disk encryption theory on wikipedia.
Nov
19
comment DHE key exchange. Is it really secure?
You're underestimating what "very big" means. No conventional computer will ever be able to count to $2^{256}$ and that doesn't even consider storing that much.
Nov
18
comment Is there a way to systematically calculate the public exponent $e$ in RSA?
If the modulus is so large that you don't find an e via trival division in less than a minute, it's so big that you won't be able to do the rest of RSA. For example no four-digit number is co-prime to 3, 5, 7, 11 and 13.