9,506 reputation
12347
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 1 month
seen 3 hours ago

Oct
23
comment Can I use the ChaCha core as a 256-bit to 256-bit one-way function?
@RickyDemer I don't know much about that, but DJB emphasized that Salsa20 is designed as a cipher, not as a collision resistant hash. He even renamed the core from "hash" to "core" to avoid misunderstandings. "The Salsa20 core does not compress and is not collision-resistant."
Oct
23
comment In RSA, what is faster attacking “d” when plaintext is known, or factoring when M is unknown?
1) Any native brute-force is ridiculously more expensive than sieving based attack. You can't even brute-force RSA-256 2) Why do you say "no plaintext available"? Since RSA is asymmetric, an attacker can produce as many plaintext/ciphertext pair as they like.
Oct
23
comment Can I use the ChaCha core as a 256-bit to 256-bit one-way function?
If you only need one-way-ness / first pre-image resistance, you should be fine, since that maps directly to a key recovery attack on ChaCha. If you need collision resistance, don't use it.
Oct
23
comment MARS and RC6 in CUDA
As a side-note: You should target ATI CPUs as well, those usually have higher performance for crypto.
Oct
22
comment What block cipher is used for CBC-MAC?
CBC-MAC is fine with variable length messages, as long as you never have one message that's a prefix of another. For example a length prefix can achieve that if you know the length of the message beforehand.
Oct
22
comment Should I trust CipherCloud?
Looks like they came up with a major cryptography break-through this month: You can use AES with a random IV. True pioneers who boldly go where no man has gone before.
Oct
21
comment Genuine encryption from only one source?
Does a standard digital signature fit your scenario?
Oct
21
comment How much is slower GCM AES-128 than one of the stream chipher eSTREAM?
eBACS clearly uses AES-NI on some CPUs for aes128ctr but apparently it does not for aes128estream. On CPUs with AES-NI, it seems to run AES-128 at 1.3 cycles-per-byte, but without it costs over 10 cpb.
Oct
21
comment What's wrong with MARS?
At minimum it's rather ugly.
Oct
21
comment Security considerations on “expand 32-byte k”-magic number in the Salsa20 famility of stream ciphers?
Choosing all four 32-bit words of the constant as equal is probably a bad idea.
Oct
21
comment Can Secp 256 K1 curves “map” to a value on FIPS 186-3 or P-256?
Conversion works only if the curves are equivalent, but Secp256K1 and P256 are not equivalent.
Oct
18
comment How exactly was the finalist chosen in the NIST AES competition?
Rijndael is actually pretty tricky to implement in software if you want to completely avoid timing side-channels without specialized instructions.
Oct
17
comment Cryptanalysis not based on method used to encrypt?
what do you mean by matrix based cryptography?
Oct
16
comment Can we decrypt in this order when the message is encrypted twice?
It's important to note that xor isn't secure if the attacker can observe the intermediate values $E_{k_1}(i)$ and $E_{k_2}(i)$, so e.g. using xor with a three-pass-protocol is completely broken.
Oct
16
comment Can we decrypt in this order when the message is encrypted twice?
Search for commutative encryption. There are several related questions on stackoverflow, but you can't trust their answers for security.
Oct
16
comment Can we decrypt in this order when the message is encrypted twice?
You can do it with CTR or OFB. But depending on which intermediate steps an attacker can observe, it's not secure. You need to describe your model, at which points an attacker observes the data clearly. Else you'll end up with a scheme that works but isn't secure.
Oct
14
comment Using same keypairs for crypt and sign with elliptic curve
Even RSA might allow this, as long as the padding is designed with joint security for signing and encrypting in mind. With blind RSA signatures you can't use the same key for anything else, but you can still reuse the modulus with a different e.
Oct
14
comment Reuse of a DH / ECDH public key
IMO RSA is inferior for most applications. 1) Its private key operation is slower, especially at high security levels. 2) It's size overhead is bigger, both for the encrypted key and for the public key. (32 bytes vs ~300 bytes). 3) It can't authenticate to the recipient without signing (deniable authentication) => I'd only use RSA for legacy application, or when you need its special properties (e.g. blind signatures)
Oct
14
comment PGP encryption options
I'd avoid the old ones (Cast, 3DES, IDEA), and prefer AES or TwoFish. But for all of them, it's unlikely that the strength of symmetric encryption is the weakest point of your system. Spend your time creating a secure end-point and being careful about where you get public keys, rather than worrying about the strength of symmetric ciphers.
Oct
13
comment How long does it take a quantum computer to brute force AES?
@e-sushi If NSA isn't far ahead of D-Wave, then we'll be safe for decades.