10,539 reputation
12455
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 6 months
seen 4 hours ago

Jan
22
comment Diffie-Hellman on infinite groups
If you are talking about groups like integers, rational or real numbers, they have two problems. First the memory requirement is exponential in the size of the exponent and second the computing logarithms is easy.
Jan
20
comment Practical Attack on RSA
Key size is of little relevant when considering side channel attacks. Some kinds of side channel attacks can be prevented by constant time implementations, for some you need to shield the hardware.
Jan
20
comment Why is EdDSA collision-resilient with SHA-512?
It's important do distinguish between collisions of SHA-512 itself and collisions of SHA-512 mod q.
Jan
19
comment Public key encryption and big files with NaCL
Do you know how big the file is before you encrypt it?
Jan
19
comment Why are some $x$ coordinates unsuitable for an ECDSA generator point?
For an elliptic curve, about half the x values have two associated points, the other half of the x values has none (they correspond to the twist of the curve).
Jan
18
comment Performing HMAC with random key before MAC comparison
I've seen suggestions to use this as constant time comparison by people who're afraid that the compiler will optimize the usual constant time comparison code into variable time code.
Jan
16
comment Pollard's Rho - Restricting the random function to the exponents
You want the cheapest possible function that's still good enough. Exponentiation is expensive.
Jan
16
comment I have a keyword and cipher text but cannot decode it please help!
Don't vandalize your own post.
Jan
16
comment Help converting sha256 to 32-bit stream
I think this is just a weird formulation for "SHA256 outputs a 32 bytes/256 bits which you should then encode with BASE64".
Jan
16
comment Can AES in CCM or GCM counter mode interoperate with AES in “plain” counter mode (CTR)?
Implementing CTR on top of ECB is probably easier than hacking GCM to become CTR.
Jan
16
comment Is ASCON cipher broken?
It only talks about round reduced versions, so it's not a break.
Jan
15
comment Public key encryption and big files with NaCL
1) Salsa20 is a stream cipher, so nonce reuse behaves like one-time-pad key-reuse. crypto.stackexchange.com/… 2) The Poly1305 MAC is a one-time MAC (wegman-carter), so nonce reuse leaks the MAC key for that nonce.
Jan
15
comment Public key encryption and big files with NaCL
1) Do you use a two part nonce, so you can use a different counter as nonce input for each chunk? Reusing the full nonce is fatal. 2) It's essential to use a special counter/nonce for the chunk containing the hash 3) I'd replace the hash by the file size
Jan
14
comment Programming language for modular arithmetic over large numbers
Most major languages either ship with built in bigintegers or have third party implementations. I've heard good things about NTL and it has the additional advantage that it's not merely a biginteger library but contains support for a lot of advanced mathematical features that are useful for cryptography.
Jan
14
comment Programming language for modular arithmetic over large numbers
This question appears to be off-topic because it is about 1) a programming problem, not a crypto problem. 2) A recommendation question with many possible answers, and thus not suitable for stackoverflow either.
Jan
14
comment What is a tweakable block cipher?
@figlesquidge That construction is trivially distinguishable from a proper tweakable cipher. There is a reason that XTS and OCB are more complex.
Jan
12
comment Using hash of plaintext as nonce in NaCl secretbox- bad idea?
An unkeyed hash of the plaintext leaks a lot of information about the plaintext.
Jan
12
comment Where are the ChaCha20 test vectors/examples?
Note that this is no RFC yet, it's only a draft.
Jan
9
comment Which block cipher mode does the experts use?
They use the mode that fits the requirements. Padding not working correctly is not a good reason to ditch CBC, you need to fix the code. Apart from padding there are several other things you'll need to get right, such as authentication/integrity checking and proper IV generation. Adding and removing padding is the easiest of these.
Jan
9
comment How secure is file header encryption for large files?
@Erode Then why do you need such a high performance? A 2GB file will contain a video far longer than 15s or even 3m, so decryption cost should be negligible compared to the video decoding cost.