Reputation
Next tag badge:
102/100 score
17/20 answers
Badges
1 36 76
Newest
 Nice Answer
Impact
~288k people reached

Apr
13
comment Does “double RC4” exhibit the same weaknesses as standard RC4?
@MaartenBodewes I'm too lazy to figure out the details. And poncho is our RC4 expert here.
Apr
12
comment Does “double RC4” exhibit the same weaknesses as standard RC4?
The only weakness in RC4-drop-n (for sufficiently large n), I know of, are the n-gram biases. Those should become much smaller when combining two key-streams, so the amount of data you can produce before it becomes distinguishable should become much bigger.
Apr
12
comment What's the appeal of using ChaCha20 instead of AES?
Do the ChaCha: better mobile performance with cryptography - CloudFlare blog
Apr
12
comment What's the appeal of using ChaCha20 instead of AES?
Speeding up and strengthening HTTPS connections for Chrome on Android - Google Security Blog
Apr
12
comment What's the appeal of using ChaCha20 instead of AES?
ChaCha is cheaper on many CPUs that don't have dedicated AES instructions. I remember google stating that's why they use it on such devices (many mobile devices).
Apr
11
comment Possible problems in using a hash algorithm to construct a stream cipher
@Melab Depending on the security model your algorithm wouldn't be secure with variable length nonces. In particular if you allow the attacker to choose the nonce while only requiring uniqueness they can use the key stream derived from one nonce to predict the key stream of another nonce. (Admittedly that's a rather academic attack)
Apr
11
comment Possible problems in using a hash algorithm to construct a stream cipher
What length of what you pass to the hash. In your case, the length of $K||N||C$. Old hashes are vulnerable to length extension attacks, which are trivially impossible for fixed length inputs.
Apr
11
comment Length extension attacks or prefix attacks on HMAC
@Raoul722 That's a different construction. So it's related, but no duplicate.
Apr
10
comment Space needed to store an RSA private key
Why are you calling storing $d$ optimal? Since you assume knowledge of the public key, you might as well just store $p$, which halves the space requirements compared to $d$ (and as Ricky points out this could be optimized further, but that adds complexity). If you don't assume knowledge of the public key, I'd store $e,p,q$.
Apr
9
comment Is there a German word for computationally secure?
I'd say "sicher gegen Angreifer mit beschränkter Rechenleistung".
Apr
9
comment What's the reasoning behind the design of the TLS 1.2 PRF?
If TLS were designed today, we'd probably use HKDF instead.
Apr
8
comment Encrypt-then-HMAC implementation - am I doing it right?
@RalphP The attacker doesn't need the full 640 bits to confirm the password. Either the MAC or the encryption key is enough. So if you're using PBKDF2-HMAC-SHA-256 they can run the derivation once whereas the defender has to run it thrice.
Apr
8
comment Encrypt-then-HMAC implementation - am I doing it right?
A 640 bit salt is seriously overkill. 128 bits should be enough, 256 if you want to be generous.
Apr
7
comment Possible problems in using a hash algorithm to construct a stream cipher
HMAC halves the performance (in CTR mode at least) and the security improvement is rather dubious. Just make sure to use the key as first input and always use the same message length and a plain hash should be fine.
Apr
7
comment Is there any IND-CPA secure stream cipher with a “standard” hardness assumption?
I wonder if DualEC-DRBG fits the bill.
Apr
7
comment How strong is the ECDSA algorithm?
I suspect that the weird ECC sizes in those tables are simply the sizes of standardized curves and don't reflect security differences between binary and prime fields.
Apr
7
comment If we should not reuse primes in DH, shouldn't we not reuse ECDH elliptic curve properties?
I think DJB published a paper about reducing DL computation time or cost to $n^{1/3}$ for ECC, but it requires ridiculous precomputations and I don't even think it reduces the DL cost in realistic cost models (that properly handle memory).
Apr
6
comment Do I need to use a MAC with asymmetric encryption?
Using the same key for encryption and authentication is discouraged.
Apr
6
comment Can XTS + checksum be used for authenticated encryption?
You might want to take a look at OCB mode, it uses simple xor as checksum.
Apr
5
comment A block cipher whose key changes after each block
Related: XTS