8,789 reputation
12041
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 2 years, 9 months
seen 7 hours ago

Sep
15
comment What stops the Multiply-With-Carry Random Number Generator from being a Cryptographically Secure Pseudo-Random Number Generator?
No idea why people care about period length above say $2^{256}$.
Sep
14
comment Is it dangerous to use plaintext as IV in CBC?
Your "specification" is pretty unclear. How would you use the plaintext as IV? If you use the plaintext as IV, you need to tell the decrypter about it, but since the usual goal is the keep the plaintext secret, that doesn't make sense.
Sep
12
comment Can I dynamically calculate an appropriate number of iterations for PBKDF2 based on the system time, rather than using a fixed value?
One problem with your system is that is assumes performance will double every two years. I think it has already slowed down, and will get even slower in a few years.
Sep
12
comment Possible ECC backdoor and its impact on Internet traffic
It'd break TLS with ECDHE suites, probably passively. In particular gmail. But since nobody in the public knows a way to weaken the curve by choosing a bad $b$ constant, it's unclear what the impact of such a hypothetical attack would be.
Sep
11
comment How can someone predict the bits of a not-so-PRNG like Dual_EC_DRGB?
when you know the secret values built into the default configuration of dual-ec, then observing a short output is enough to recover the internal state and predict all other outputs until the next big entropy mixin.
Sep
11
comment Guarding against cryptanalytic breakthroughs: combining multiple hash functions
@ddyer "reveals the message" is first-preimage resistance. Concatenation is useful if you care about collisions and second-pre-images. Combiners only preserve some properties of the hash, not all of them.
Sep
10
comment Is there a theoretical maximum useful keysize given the block-size?
Read the questions I linked. For example there are 26! keys for an alphabetic substitution cipher, but only 26 different letters.
Sep
10
comment Is there a theoretical maximum useful keysize given the block-size?
Related AES Key Length vs Block Length and AES key/ciphertext space sizes
Sep
10
comment Is there a theoretical maximum useful keysize given the block-size?
I'd expect something like $log_2(2^n!)$ which you can approximate with sterling and you'll see that the maximal keysize gets really huge really quickly.
Sep
10
comment Should new applications still use RSA? Is it worth going down the ECDH route for protocols?
@Nemo The crypto part of NaCl is fine, but by itself it doesn't satisfy the OP's requirements. In practice I'd use the libsodium variant since it's easier to build. The CurveCP part of NaCl is not production ready. There are significant flaws in the implementation, and minor flaws in the protocol. CurveCP is a great inspiration for protocol designers, but I wouldn't use it in its original form.
Sep
10
comment Hash function based on block cipher (and proof of security in the PRP model)
My impression is that security definitions of unkeyed primitives are generally problematic and that these problems lead to the use of ROM.
Sep
10
comment Should new applications still use RSA? Is it worth going down the ECDH route for protocols?
No, there is no code for Noise, and the code of CurveCP isn't production ready. I only posted them as examples of protocols which only use DH + symmetric encryption.
Sep
10
comment Could RDRAND (Intel) compromise entropy?
But I agree with Dale Emmon's comment that it should be mixed in through the hash and not xor-ed into the output.
Sep
10
comment Could RDRAND (Intel) compromise entropy?
If the PRNG doesn't suck, it doesn't cause any security issues to mix in attacker controlled input.
Sep
10
comment Security of (cryptographic) padding compared to other methods for blockcompletion for block ciphers
HMAC-SHA-2, not plain SHA-2. And it's essential that you compute the MAC over the whole ciphertext (including IV and padding) and not over the plaintext. So you verify the MAC before you decrypt, not after. Another issue is that you need a constant time comparison function for the MAC verification, else you're open to timing attacks.
Sep
10
comment Should new applications still use RSA? Is it worth going down the ECDH route for protocols?
There weren't any breakthroughs regarding RSA and discrete prime characteristic finite fields. The recent breakthroughs were against small characteristic finite fields, in particular binary fields.
Sep
10
comment Relation between key size and PRNG state size
@nightcracker Generating an RSA 1024 key from a 128 bit seed is completely fine. For 4096 bit RSA I'd use a 256 bit seeds.
Sep
10
comment Relation between key size and PRNG state size
I'd use a pool size twice the security level to avoid collisions during the one-way function step. The trickier part are the additional accumulator pools a fortuna like construction needs.
Sep
10
comment Who uses Dual_EC_DRBG?
Are there some more detailed descriptions of how the Vista+ CSPRNG works? When I last looked, I only found a description of the old XP CSPRNG.
Sep
10
comment Should new applications still use RSA? Is it worth going down the ECDH route for protocols?
As an inspiration of what can be done with ECDH + symmetric encryption, check out CurveCP and Noise. CurveCP is a bit simpler, but has some minor flaws. An interesting article, inspired by these protocols is Moxie's Simplifying OTR deniability