9,854 reputation
12450
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 3 months
seen 11 hours ago

Dec
2
comment What is the function of the secret key “r” in Poly1305?
$r$ being secret is essential. The only point of $s$ is to prevent an attacker from learning $r$.
Nov
30
comment Why is Lamport-Diffie secure?
As far as we know, there there are collision resistant hashes (if necessary we can even weaken that to random prefix collision resistance) which resist quantum computers with slightly larger security parameter.
Nov
29
comment are ideal hashes possible to create?
If your definition of "ideal hash" is that it has no collisions with an input larger than the output, that's impossible. Pigeonhole principle
Nov
28
comment Convert a number to sha-1
I don't get your point regarding collisions. But 2^44 should be feasible as a one-time effort, the rainbow table is only used to make additional conversions cheaper.
Nov
28
comment Design requirements for a keyed hash function?
The hash function needs to collision resistant. The encryption is trickier. Authenticated encryption always works (but that's a bit of cheating). An unauthenticated stream cipher does not work. A raw blockcipher with same block size as the hash does work.
Nov
28
comment Design requirements for a keyed hash function?
Related question: Is the encryption of a hash a good MAC?
Nov
28
comment Convert a number to sha-1
Searching a fixed 44 bit space might actually be one of the rare situations where a rainbow table is useful.
Nov
28
comment TCR hash functions from MD5
MD5 being broken only means that an attacker can find collisions when its used without a key.
Nov
27
comment scrypt and bcrypt for benefits of both?
For bcrypt and PBKDF2 combining them with each having have the work factor wouldn't really matter. For scrypt it's different: If you're CPU and not memory bound (typical for server side hashing), doubling the time budget doubles the used memory as well, making it four times as hard to break. => scrypt benefits from being the only function you use
Nov
27
comment Reusing PGP key when generating SSL Certificate Authority?
The problem with that is that you need to analyze all protocols using a key checking them for interactions. So I recommend against reusing a key like that.
Nov
26
comment How can Shamir's method for secret sharing work in the GF(256)?
Yes, there is no GF(6) since you can't write it as p^n.
Nov
26
comment How can Shamir's method for secret sharing work in the GF(256)?
You can use any field. Prime order fields are nice because you can use standard modular arithmetic, whereas other fields are a bit tricky to understand. But fields exist for all prime powers p^n. The most common choices p=2 (binary fields like the 2^8 you're talking about) or n=1 (prime fields).
Nov
26
comment Is this new server API authentication protocol secure?
The shared key to allow account creation is fine. The big problem with your approach is that you rely on the secrecy of the shared key for everything. A good design only uses that shared key to ensure that only authorized clients can create an account and nothing more. Distributing the server's public key (or its finger print) isn't harder than distributing the application code or the shared key. But it has the huge advantage that it doesn't need to be confidential.
Nov
25
comment Is this new server API authentication protocol secure?
At minimum you should add a tag to each MAC to ensure MACs created for one purpose can't be used for another purpose. But even then it's an ugly and fragile (shared key for all users. WTF) protocol. It's far easier and stronger to ensure that SSL isn't MitMed. Why do you think it's easier to impersonate the server in SSL than to steal the shared key?
Nov
25
comment Is this new server API authentication protocol secure?
Why no SSL/TLS? If you need custom features, consider building on top of SSL, instead of replacing it.
Nov
25
comment Shamir's Simple Sharing Scheme - preventing partial recovery of data
@user8911 Without an answer to my first question, this can't be answered well. Blindly applying my second point is not the way to go and can be broken by guessing the remaining bits.
Nov
25
comment Shamir's Simple Sharing Scheme - preventing partial recovery of data
1) How would that partial damage happen? Why do you care about this scenario 2) It's often a good idea to apply secret sharing to a symmetric key, not to the data itself.
Nov
24
comment AES and Known-plaintext attack
Nobody has shown that AES is secure. It's just that nobody has found a way to break it.
Nov
24
comment AES and Known-plaintext attack
It's rather the other way round. There are no paper that show AES is vulnerable to known-plaintext attacks.
Nov
23
comment Why is this MAC based on secure PRF with ordering and randomization insecure?
Related Block ordering and security in a MAC? and Why shouldn't one build a MAC by XORing multiple message blocks?