9,495 reputation
12346
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 1 month
seen 12 hours ago

Aug
5
comment ECDSA with SHA256 and sepc192r1 curve: Impossible, or how to calculate $e$?
@Christian The security level is limited to half the curve size. So with a 192 bit curve you get 96 bits of security. This is still infeasible to break, but you should consider upgrading to a 224 or 256 bit curve.
Aug
5
comment Interleaving bytes to make an effectively larger block size
There are simple techniques to construct wide PRPs which are much faster than this and provably secure (reducing to the security of AES). So there is no reason to use your construction in practice.
Aug
5
comment Interleaving bytes to make an effectively larger block size
Looks very similar to the way the block-cipher underlying BLAKE works (it uses a 4x4 matrix of 32/64 bit words, not a 16x16 matrix of 8 bit words), so I believe it's possible to construct a secure cipher that way. But BLAKE has about 20 cheap rounds, not 3 expensive rounds. I have doubts that 3 rounds are enough, even with a secure PRP as building block.
Aug
5
comment Interleaving bytes to make an effectively larger block size
I'm reading the interleaving function differently from you. I think it's supposed to be a matrix transposition, i.e. $c_{16i+j} = b_{16j+i}$.
Aug
5
comment Interleaving bytes to make an effectively larger block size
My intuition is that enough rounds of this should be secure, but that you'll need more than 3 rounds.
Aug
5
comment Interleaving bytes to make an effectively larger block size
I don't follow your argument and can't see how a symmetry would propagate through enough rounds.
Aug
4
comment AES-GCM Disadvantage
For full nonce reuse resistance there is no way around processing the message twice. i.e. any mode that only processes a message only once is significantly weaker than SIV when nonces are reused.
Aug
2
comment Is perfect-forward secrecy achieved with RSA?
You don't need a per session key. You can reuse it for other sessions as long as you discard it after a short time. For example you could use RSA keys rotated once a minute, that way the key generation cost is amortized over several connections andis no longer a limitation, even with RSA. The main downside ia that it complicates the protocol compared to per session keys.
Aug
1
comment How many RSA keys before a collision?
@owlstead I used factor to mean small constant multiplier. My computation is only a rough approximation, I didn't care if there are 10x more or less primes than what I wrote, so I included that statement to preempt nitpickers. For example I didn't use a precise form of the prime number theorem and I expect a typical RSA implementation to set the top two bits to 1, not just the top bit to ensure that their product has precisely 1024 bits. According to Wolfram Alpha there are $10^{151}$ primes suitable for RSA 1024.
Aug
1
comment Is perfect-forward secrecy achieved with RSA?
You can achieve forward secrecy with RSA if you generate short lived key-pairs. But most protocols that provide forward secrecy use Diffie-Hellman, probably because generating DH keys is cheap and easy compared to RSA keys.
Jul
29
comment Public key Issue - same key pair as existing one?
Cryptography is all about attacks being "very unlikely". Consider AES128 - the attacker can guess correctly with probability $2^{-128}$ with a single guess. The probability of colliding RSA keys is much smaller than that if you use perfectly random primes.
Jul
29
comment ECDH anonymous key exchange to avoid PKI
Take a look at djb's curvecp and trevor perrin's noise protocol. They're relatively simple protocols where peera are identified by an ecc public key.
Jul
25
comment Does 3-DES take approximately the same time to encrypt 1B and 1KB?
Which mode of operation are you using? A bitsliced implementation could exhibit unusual scaling with message length, but doesn't really fit your description. Perhaps your benvhmark is flawed, so I'd like to see your code.
Jul
17
comment Are there any reasons for using SSL over IPSec?
I think this fits security.se betterthan crypto. @mikeazo can you talk to the sec.se mods and possibly migrate?
Jul
12
comment McEliece and cryptanalysis
I'd expect grover to be applicable to some degree.
Jul
9
comment Is calculating a hash code for a large file in parallel less secure than doing it sequentially?
Note that Merkle-Damgard has a similar loss of second pre-image security, so compared to SHA-2 the security loss is only due to the additional compressions the tree adds, which should account for less than a bit. The workarounds are pretty similar too, either add unique node tagging or use a wide-pipe.
Jul
8
comment What exactly does a key do?
If you have an $b$ bit key, there are $2^b$ possibilities. The base 2 logarithm $\log_2$ is the inverse of the exponential function $2^x$. So with 26 possible keys, you get $\log_2{26} \approx 4.7$ or equivalently $2^{4.7} \approx 26$.
Jul
8
comment What exactly does a key do?
In that sample you could consider "Shift by $x$" the algorithm (Caesar encryption) and $x=2$ the key. This would be a $\log_2{26}\approx4.7$ bit key.
Jul
6
comment Convergent encryption has dictionary attack, but why hash function doesn't?
Sending the hash of the plaintext suffers from the same problems as convergent encryption. The best writeup of the security properties of CE I've seen so far is zooko's Drew Perttula and Attacks on Convergent Encryption
Jul
4
comment Use ElGamal to solve Diffie-Hellman problem
AFAIK ElGamal only reduces to the decisional DH problem, not the the computational DH problem. So this proof shouldn't exist