10,357 reputation
12453
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 5 months
seen 35 mins ago

Jan
6
comment Is Curve25519-java secure?
Curve25519-java supports signing, but that wasn't in the original code and thus hasn't seen much review. It's also missing the other Ed25519 goodies, such as deterministic signatures, batch verification, or the faster fixed base multiplication.
Jan
6
comment Is Curve25519-java secure?
As far as we know, Curve25519 itself is secure. But Curve25519 as specified by Bernstein only supports key-exchange, not signing. For signing I recommend using the related Ed25519 instead.
Jan
4
comment Deterministically combine more than one source of entropy
can't you just hash them and map the hash to 0..1?
Jan
4
comment Can a salt for a password hash be public?
Salts aren't there to prevent pre-computation. They prevent multi target attacks. Rainbow tables are one particular example of multi target attacks, and a rather useless one.
Jan
3
comment Usability of padding scheme in blinded RSA signature?
Padding adds a redundancy of a particular form. A random value almost certainly doesn't have that form and is rejected.
Dec
26
comment Security Level Estimate when Cascading/Compositing Ciphers?
Nowadays the reason for cascading is guarding against cryptoanalytic advances against one primitive ensuring that the whole system is as secure as the strongest primitive. It's not a good way to raise the security level.
Dec
25
comment Off-the-record communication
@RickyDemer Different browsers and operating systems render text differently which leads to line breaks at different points. For example I'm using Opera, and all of your answers/comments contain large spaces in inappropriate places. Html is a dynamic format where you can't control the output precisely, unlike say PDF.
Dec
24
comment Can we ensure the security of a crypto-algorithm and -implementaton against acoustic cryptanalysis?
@PaŭloEbermann I haven't looked for one yet, since I'm mostly using ECC. But it shouldn't be too hard to write one. mpz_powm_sec from GMP has a promising description, but I didn't look into the details.
Dec
22
comment Can we ensure the security of a crypto-algorithm and -implementaton against acoustic cryptanalysis?
Didn't investigate the details, but does the attack still work with standard constant time code? These techniques cost a bit of security but not that much. (no secret memory access, always executing the very same instructions, only with different data)
Dec
22
comment Forgery Attack Against RSA Digital Signature
First of all, I want to emphasize that this is textbook RSA, not RSA as it's used in practice. For real RSA signatures an important step of signing is a collision resistant one-way hash. When using such a scheme, finding a message for a given x is practically impossible.
Dec
20
comment How to use HKDF to combine two keys
@user10988 Hashing is better than xor-ing, for the same reason that HKDF is better than xor-ing. HKDF with a constant salt is a hash.
Dec
19
comment Is a Mersenne-twister cryptographically secure if I truncate the output?
You're a beginner who has no experience in cipher design and cryptoanalysis. You're inventing your own stream cipher which has seen no cryptoanalysis and hope that it's secure. Why do you think that's a good idea?
Dec
19
comment Is a Mersenne-twister cryptographically secure if I truncate the output?
Why do you want to use a MT when there are plenty of strong and fast standard CSPRNGs? AES-CTR can output gigabytes of data per second on a modern CPU. What can be simpler than calling a function "Give me n cryptographically secure bytes*?
Dec
18
comment What is the difference between CSPRNG and PRNG?
Sadly we actually had two separate questions suggesting your trivially broken example as a secure stream cipher. A simple block cipher based on the SHA-256 hash function and Is it feasible to build a stream cipher from a cryptographic hash function?
Dec
18
comment What is the difference between CSPRNG and PRNG?
PRNG encompasses all pseudo random number generators, from the horrible rand call in c, over suitable for simulations but not security ones like the mersenne twister, to the most secure cryptographic PRNG. CSPRNGs are simply the subset of PRNGs which are secure. Every stream cipher, including AES-CTR can act as CSPRNG. Depending on the context, one might also include the proper seeding in the scope, which is far more complex than the actual data generation.
Dec
18
comment Why are the lower 3 bits of curve25519/ed25519 secret keys cleared during creation?
The group order is a multiple of 8. Setting the lowest bits zero, sets the scalar to a multiple of 8, ensuring that the points are in the prime-order subgroup without the small subgroup interfering.
Dec
17
comment Calculation of time to crack SHA-256 hash
@JMCF125 Salts are not required to be secret. They should be unique. A username is not ideal since it allows multi target attacks against different versions of the same user's password, or against the same username on different websites. But in the context of this question I'd assume it's unique.
Dec
17
comment RSA exhibits symmetrical properties — is it possible to form a cryptanalytic attack?
FIPS.186-4 is long. You should reference the relevant section(s).
Dec
17
comment Diffie-Hellman on additive group
But if you use addition modulo a prime, that's a bad idea, since the discrete logarithm problem in that group is easy.
Dec
17
comment Diffie-Hellman on additive group
Additive vs. multiplicative is only a difference in notation. Replace multiplication with addition and exponentiation with scalar multiplication.