9,585 reputation
12347
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 1 month
seen 1 hour ago

Oct
16
comment Can we decrypt in this order when the message is encrypted twice?
It's important to note that xor isn't secure if the attacker can observe the intermediate values $E_{k_1}(i)$ and $E_{k_2}(i)$, so e.g. using xor with a three-pass-protocol is completely broken.
Oct
16
comment Can we decrypt in this order when the message is encrypted twice?
Search for commutative encryption. There are several related questions on stackoverflow, but you can't trust their answers for security.
Oct
16
comment Can we decrypt in this order when the message is encrypted twice?
You can do it with CTR or OFB. But depending on which intermediate steps an attacker can observe, it's not secure. You need to describe your model, at which points an attacker observes the data clearly. Else you'll end up with a scheme that works but isn't secure.
Oct
14
comment Using same keypairs for crypt and sign with elliptic curve
Even RSA might allow this, as long as the padding is designed with joint security for signing and encrypting in mind. With blind RSA signatures you can't use the same key for anything else, but you can still reuse the modulus with a different e.
Oct
14
comment Reuse of a DH / ECDH public key
IMO RSA is inferior for most applications. 1) Its private key operation is slower, especially at high security levels. 2) It's size overhead is bigger, both for the encrypted key and for the public key. (32 bytes vs ~300 bytes). 3) It can't authenticate to the recipient without signing (deniable authentication) => I'd only use RSA for legacy application, or when you need its special properties (e.g. blind signatures)
Oct
14
comment PGP encryption options
I'd avoid the old ones (Cast, 3DES, IDEA), and prefer AES or TwoFish. But for all of them, it's unlikely that the strength of symmetric encryption is the weakest point of your system. Spend your time creating a secure end-point and being careful about where you get public keys, rather than worrying about the strength of symmetric ciphers.
Oct
13
comment How long does it take a quantum computer to brute force AES?
@e-sushi If NSA isn't far ahead of D-Wave, then we'll be safe for decades.
Oct
12
comment How much is slower GCM AES-128 than one of the stream chipher eSTREAM?
The first place to go for performance checks is eBACS. Unfortunately it has its flaws. In particular I suspect that its AES implementations are far from optimal on some platforms.
Oct
12
comment How much is slower GCM AES-128 than one of the stream chipher eSTREAM?
1) That's an apples to oranges comparison. eSTREAM is about unauthenticated stream ciphers, you need to compare with AES-CTR. 2) Which CPU? With AES-NI it's really fast, faster than eSTREAM ciphers. On other CPUs it can it might be 5x slower,... 3) with or without side-channel protection? Implementations of GHASH on CPUs without specialized instructions uses large lookup tables, leading to low key agility and potential cache timing attacks.
Oct
12
comment How many messages needs to be send to server to get AES key in Cache-timing Attack
Depends a lot on how well you can measure the timing. Bernstein used a setup with pretty accurate timing information.
Oct
11
comment Key-size of encryption method
AES-256 uses a 256 bit or 32 byte key by definition. No more, no less.
Oct
11
comment Which stream cipher can we replace the RC4 in the SSL?
There is AES-GCM (which is based on AES-CTR) in TLS 1.2, and AGL at google works on a ChaCha-Poly1305 suite. But there are no widely implemented streamciphers in TLS for now.
Oct
11
comment Is using Ed25519 parameters in ECDSA safe?
What should possible is using Weierstrass for the API, but converting to edwards for computation.
Oct
11
comment Which stream cipher can we replace the RC4 in the SSL?
AES-CTR and Salsa20/ChaCha are the most popular stream ciphers in my experience.
Oct
11
comment Which stream cipher can we replace the RC4 in the SSL?
Context? Future extensions in SSL? Or as a server operator who's limited to existing implementations?
Oct
10
comment Encrypting files with known headers
Personally I don't like using GPG for data at rest. I prefer a simple AEAD API.
Oct
10
comment 2 comparable hashes generated from one string
I would go with random tokens that are simply random values stored in a different database table.
Oct
10
comment 2 comparable hashes generated from one string
Quick observation: MD5 is not an appropriate password hash. See How to securely hash passwords? for how you should hash passwords.
Oct
10
comment Infinite depth BLAKE2b tree hashing
We did not consider unary trees when designing the tree mode and I still don't get their point. Where is the difference between a sequential hash and a unary tree?
Oct
10
comment Hash functions throughput performance
@StephenTouset One needs to be careful about such comparison. The devil is in the details. At least it's faster when comparing with sequential MD5 on 64 bit Intel CPUs, which is pretty much its optimum case. 32 bit, non intel (including AMD), or treeing MD5 will improve MD5s performance relatively to Blake2b. On the other hand you can cut the number of rounds by a factor 3 or so to get a version of Blake2 that's still much stronger than MD5.