9,834 reputation
12450
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 3 months
seen 4 hours ago

Nov
26
comment How can Shamir's method for secret sharing work in the GF(256)?
You can use any field. Prime order fields are nice because you can use standard modular arithmetic, whereas other fields are a bit tricky to understand. But fields exist for all prime powers p^n. The most common choices p=2 (binary fields like the 2^8 you're talking about) or n=1 (prime fields).
Nov
26
comment Is this new server API authentication protocol secure?
The shared key to allow account creation is fine. The big problem with your approach is that you rely on the secrecy of the shared key for everything. A good design only uses that shared key to ensure that only authorized clients can create an account and nothing more. Distributing the server's public key (or its finger print) isn't harder than distributing the application code or the shared key. But it has the huge advantage that it doesn't need to be confidential.
Nov
25
comment Is this new server API authentication protocol secure?
At minimum you should add a tag to each MAC to ensure MACs created for one purpose can't be used for another purpose. But even then it's an ugly and fragile (shared key for all users. WTF) protocol. It's far easier and stronger to ensure that SSL isn't MitMed. Why do you think it's easier to impersonate the server in SSL than to steal the shared key?
Nov
25
comment Is this new server API authentication protocol secure?
Why no SSL/TLS? If you need custom features, consider building on top of SSL, instead of replacing it.
Nov
25
comment Shamir's Simple Sharing Scheme - preventing partial recovery of data
@user8911 Without an answer to my first question, this can't be answered well. Blindly applying my second point is not the way to go and can be broken by guessing the remaining bits.
Nov
25
comment Shamir's Simple Sharing Scheme - preventing partial recovery of data
1) How would that partial damage happen? Why do you care about this scenario 2) It's often a good idea to apply secret sharing to a symmetric key, not to the data itself.
Nov
24
comment AES and Known-plaintext attack
Nobody has shown that AES is secure. It's just that nobody has found a way to break it.
Nov
24
comment AES and Known-plaintext attack
It's rather the other way round. There are no paper that show AES is vulnerable to known-plaintext attacks.
Nov
23
comment Why is this MAC based on secure PRF with ordering and randomization insecure?
Related Block ordering and security in a MAC? and Why shouldn't one build a MAC by XORing multiple message blocks?
Nov
23
comment Is there a cryptographic method to add noise to a plaintext instead of actually encrypting it?
In that case I'd first encrypt the data, and then add a post processing step that encodes it into a form that looks like plaintext.
Nov
22
comment Can cryptocurrency mining devices be used for cryptanalysis?
Most cryptography is far out of brute-force range, even with ASIC. Password hashing is one of the few exceptions. Among the commonly used password hashes, PBKDF2-HMAC-SHA-256 is closest to bitcoin mining. But I suspect mining ASICs are too specialized to attack it.
Nov
22
comment Creating a secure key
HKDF (with SHA-2 as underlying hash) is the cleanest solution IMO. But a plain SHA-2 hash to extract the entropy would be perfectly fine. // In theory there are some provably secure constructions, in practice SHA-2 I'd prefer a proper hash like SHA-2 over all of them.
Nov
22
comment Block Cipher vs Stream Cipher in Web Application
Web applications typically use HTTPS. Which encrypts the TCP stream using SSL/TLS. SSL can use both stream and block ciphers. In principle they're both fine for this, but SSL made some dumb design choices that weaken block ciphers. On the other hand it only supports a decent stream cipher (AES in GCM mode) in TLS 1.2 which isn't widely supported yet.
Nov
22
comment How to put the hash of a PDF file in the PDF file?
With CRC yes, with MD5 no. Standard practice for similar applications is to ignore the hash or signature part while hashing.
Nov
21
comment Authentication of machine before installation (to stop piracy)
This isn't about crypto. At best it's about security, but even there it's security-through-obscurity.
Nov
21
comment Authentication of machine before installation (to stop piracy)
An attacker can always rewrite the client and remove the the check.
Nov
21
comment When using Curve25519, why does the private key always have a fixed bit at 2^254?
Sorry but I still don't get it. 1) The actual code starts with $P$ and $\infty = (x=1,z=0)$ 2) Why does the code not work if it always starts the ladder at bit 254, but that bit happens to be 0? 3) Your Montgomery ladder link is dead
Nov
20
comment When using Curve25519, why does the private key always have a fixed bit at 2^254?
That this answer is tautological. I read the paper including those paragraphs and still Why does having a fixed position for the leading 1 improve performance? I didn't notice an algorithm in the code that relies on this bit being set. Does the code produce incorrect results if this bit is wrong?
Nov
18
comment Why not just generate random strings for one-time password (OTP)?
Your idea has been used for online banking. My bank used to send me a list with 100 single-use TANs. Then for each transaction ask for one of them.
Nov
18
comment Efficient parameters for group Diffie-Hellman
@poncho Could you describe how to use that oracle to break CDH?