9,417 reputation
12345
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years
seen 2 hours ago

Jun
26
comment Combining Random Hashes - avoiding collisions and ensuring randomness
4) You say the hash should be very fast. Can you give any numbers? 5) All your inputs have exactly 64 bits. Did I understand that correctly? 6) Do you actually need a hash? Perhaps a keyed permutation (i.e. a 64 bit block cipher) is more appropriate? Permutations have no collisions by definition.
Jun
26
comment Combining Random Hashes - avoiding collisions and ensuring randomness
1) It's almost always better to choose a single good hash rather than combining multiple hashes. 2) Use a modern crypto hash. 3) With 64 bit hashes, you only get 32 bits of collision resistance. So in the cryptographic sense, you don't get any practical collision resistance. Even pre-image resistance is rather low at 64 bits.
Jun
25
comment What is the quantum-resistant signature scheme with the smallest signature + pubkey?
Isn't the security level of 128 bit hashes just 64 bits since the Grover reduces the pre-image resitance?
Jun
24
comment Minimum length of PKI key for signature
1) If you care about key size, don't use RSA or DSA. ECC has much smaller keys. 2) Key size by itself is meaningless since it can be trivially reduced, increasing the signature size by the same amount. Do you actually care about the sum of the size of key and signature?
Jun
24
comment Minimum length of PKI key for signature
Your question says RSA, the tags say DSA.
Jun
24
comment What is the quantum-resistant signature scheme with the smallest signature + pubkey?
@RickyDemer eBACs lists a fast Ed25519 implementation at 170k CPU cycles. Most implementations are closer to a million CPU cycles. So 600 calls to a compression function should be in the right ballpark, probably even faster than ECC if you choose a fast hash function.
Jun
24
comment What is the quantum-resistant signature scheme with the smallest signature + pubkey?
@RickyDemer ECDSA sigs use 4x the security level and public keys 2x the security level. So total of public key and signature is around 100 bytes.
Jun
23
comment Fastest random number generator
Why do you care? It's not like you need more than 256 bits of true random data to seed a great PRNG, which can exceed 10 Gbit/s on a modern CPU.
Jun
20
comment How big an RSA key is considered secure today?
The "do not cost significant performance penalty" depends very much on context. For email that may be true since you usually don't receive several emails per second. For many other contexts, such as SSL, several hundred milliseconds of decryption time for a single handshake are not acceptable. The other big problem is that many RSA implementations do not support such large keys.
Jun
19
comment Is a 1024-bit DSA key considered safe?
AFAIK a DSA cracker requires a few hundred times the RAM of an RSA cracker, so I'd assume that cracking a DSA key is a few hundred times more expensive than cracking an RSA key of the same size. Further evidence towards DSA being stronger is that the largest solved discrete logarithms over prime fields are smaller than the largest factored semi-primes.
Jun
19
comment Is a 1024-bit DSA key considered safe?
What's the size of the subgroup q? If it's only 160 bits, this is probably a weaker point than the 1024 bit modulus. If it's 224 bits it's clearly strong enough.
Jun
17
comment curve25519 weak points for contributory behaviour
Discussion of the effect of weak points on Ed25519 signatures It's possible to forge messages that crypto_sign_open verifies if the public key is zero
Jun
17
comment What are good combinations of public key algorithms or primitives for long term security?
Combining public key encryption schemes is easy: just do independent key exchanges and then hash the shared secret to produce a combined shared secret. Encrypt the actual message with symmetric crypto as usual.
Jun
17
comment Is HMAC needed for a SHA-3 based MAC?
This question is pretty similar to Can Skein be used as a secure MAC in format H(k || m)?
Jun
17
comment Is HMAC needed for a SHA-3 based MAC?
Use the key as prefix not as suffix. Key as suffix is secure as well as long as SHA-3 remains unbroken, but falls once a collision attack is found. If you don't care about the performance cost, still using HMAC is a good choice as well.
Jun
16
comment Functions that are only second-preimage resistant?
@fgrieu I don't see how proving that helps.
Jun
13
comment RSA decrypting of a huge file by parts
With the edit things get even more confused since RSA private keys aren't used for encryption.
Jun
11
comment Given $n$ bits, how many “truly random” sequences/numbers can be constructed?
@RickyDemer Kolmogorov is cute, but unfortunately very theoretical. Only useful for long messages and cannot be computed. Even simplifications are exponentially expensive.
Jun
11
comment Given $n$ bits, how many “truly random” sequences/numbers can be constructed?
Shannon entropy is only defined for a generation process, not for an individual sequence. If a good generator produces an all zero sequence, that's still perfectly random even if it doesn't look like it.
Jun
7
comment What differences between Menezes–Vanstone ECC and ElGamal ECC?
If you want practical ECC encryption, use ECIES. It's simple and offers strong security.