CodesInChaos

5,964 reputation

1927

bio	website	github.com/CodesInChaos
	location	Munich, Germany
	age
visits	member for	1 year, 10 months
	seen	38 mins ago
stats	profile views	109

Jabber/XMPP: CodeInChaos@jabber.ccc.de
IRC: CodesInChaos on freenode
Email: My nick on gmail
Blog: codesinchaos.wordpress.com
GitHub: github.com/CodesInChaos
Google+
Twitter @CodesInChaos

	5,964 reputation	bio	website	github.com/CodesInChaos	visits	member for	1 year, 10 months
1927 badges		location	Munich, Germany		seen	38 mins ago

summary answers questions tags badges favorites bounties reputation activity

682 Comments

suggestions reviews revisions comments badges posts accepts all

Apr 29	comment	Counter Mode: static IV but different keys For secure network protocols you typically run an ephemeral key-exchange at the beginning, so you end up with a unique master key in any case. So using nonce=0 is actually a bit easier, but generating a random nonce is very easy as well.
Apr 29	comment	Secure order preserving hash function Read the CryptoDB paper. I think what they use is the best thing we have, but it obviously has significant weaknesses inherent in order preserving encryption.
Apr 29	comment	Secure order preserving hash function That can't really be a hash anymore. Your condition can only be satisfied by order preserving encryption. It implies having different results for each input, and not just that collisions are hard to find.
Apr 28	comment	standard way to authenticate parties with public keys without certificates You need some way to associate Bob with his public key. Either per finger print verification (SSH style) which shifts to problem to obtaining the fingerprint, per trusted third party(CA), per web of trust,... You alway need some mechanism. Else how do you define "Bob", if not by his public key.
Apr 28	comment	Adding and multiplication in jacobian coordinates Take a look at the Explicit-Formulas Database
Apr 28	comment	Adding and multiplication in jacobian coordinates what's the curve equation? And what do you mean by multiplying points? I only know point addition and doubling and multiplying a point by a scalar by repeated addition/doubling.
Apr 27	comment	Secure encrypt-then-sign with RSA @RickyDemer No, I mean sign, then authenticated symmetric encryption together with RSA encryption on the symmetric key. The authenticated part of that is mainly to prevent annoyances that could break the confidentiality. (padding oracles etc.)
Apr 27	comment	Secure encrypt-then-sign with RSA I prefer sign then authenticated encrypt. The only tricky part is including enough information in the signed part - it needs to be able to stand for itself.
Apr 27	comment	implementing long term archive encryption There is no asymmetric encryption/keyexchange that I'd trust for 30 years.
Apr 26	comment	How can a key pair be derived from an arbitrary hash? Factorization only applies to RSA, not to ECC. For ECDSA a private key is just a number in a certain range. Numbers outside of that range can be mapped into the range with the modulo operator.
Apr 25	comment	Password verification Don't read more than the natural size from PBKDF2. Since Rfc2898DeriveBytes uses SHA-1, reading more than 20 bytes is a bad idea. It halves your KDF performance, without hindering the attacker. For client side password hashing I'd also crank up the iterations a bit to 100k or even higher. If that makes it too slow, replace .net's implementation with a fast implementation. Or switch to scrypt.
Apr 24	comment	Using the output of a stream cipher, how to guarantee the integrity of 4 bytes of data? "Concretely use the stream as a key for SipHash" what do you want to say with that?
Apr 24	comment	Create groups of keys This sounds like a program recommendation question, which is off-topic here. An appropriate question here would be how a protocol for accomplishing this would look like, but I suspect that's not what you're interested in.
Apr 23	comment	Using the output of a stream cipher, how to guarantee the integrity of 4 bytes of data? Are you sure that the overhead actually matters? You could also use a MAC with small constant overhead, such as SipHash.
Apr 23	comment	Using the same secret key for encryption and authentication in a Encrypt-then-MAC scheme I recommend HKDF as the KDF when you want to derive multiple keys (for example encryption and MAC) from a single high-entropy master key(not a password).
Apr 22	comment	How is CipherCloud doing homomorphic encryption? @adrenalion The letter, has two parts. One part is the DMCA notice for the images. The other (non DMCA part) is about the false, misleading and defaming statements.
Apr 20	comment	A lower bound on the insecurity of CipherCloud? They claim that their encryption is not deterministic and defeats frequency analysis. Which is a really weird claim and doesn't fit the encryption shown in Sid's screenshot.
Apr 17	comment	Why is $h(H, m) = E(m, H) \oplus m$ insecure? What exactly is the definition of $H$ and $E$? I guess $H$ is the IV or chaining value, and $E$ some form of encryption, but which? In particular which parameter is the key, and which the message? And is it AES, a PRP, or an ideal blockcipher?
Apr 16	comment	Is it safe to assume Salsa20 to be a PRP? Salsa20 takes 16 constant bytes for a reason. While it's build from a permutation, that permutation has some limitations and it has no key.
Apr 16	comment	Is it safe to assume Salsa20 to be a PRP? The random function is produced by xoring a permutation with with its input, similar to the way block ciphers are turned into hashes.