Reputation
11,065
Next tag badge:
97/100 score
18/20 answers
Badges
1 24 55
Newest
 Custodian
Impact
~178k people reached

Mar
5
comment Long-term data protection, storage of old encrypted traffic and quantum cryptocalipse
@Thomas Just because there are no large quantum computers yet,(don't remember the precise current state of the art, but it's around 5 qubits factoring huge semi-primes like 15) doesn't mean that there won't be such QCs twenty years from now. If you want long term confidentiality QCs resistance should be a consideration.
Mar
5
comment Prime factors of non-random keys
Another related article There’s no need to panic over factorable keys–just mind your Ps and Qs. @fgrieu That paper is pretty high on my list of "dumbest paper titles".
Mar
3
comment Three-way hash collision
You get a $2^l$ way collision with cost $l \cdot 2^{64}$. So you get a 16-way collision with cost $2^{66} = 4 \cdot 2^{64}$ not just an eight-way collision.
Mar
3
comment Machine Learning with Encryption
Related questions: Any practical uses of machine learning for cryptography? and Cryptography based upon neural networks
Mar
3
comment Machine Learning with Encryption
You might be able to throw machine learning at side-channel or meta data. But that's a bit beyond crypto per-se.
Mar
3
comment Machine Learning with Encryption
The crypto techniques somewhat related to machine learning that I know of are 1) using SAT solvers as part of cryptoanalysis 2) Learning with error problems in lattice based crypto
Mar
3
comment Check the validity of a rsa key pair with only the public key?
Blind RSA signatures might have some issues if the modulus has a small factors since padded signatures/blinding factors might share factors with the modulus.
Mar
3
comment Derive both MAC and AES keys from same PBKDF2?
@fgrieu I mainly base it on performance, i.e. on the issue describes in that answer. I also think that being able to specify an arbitrary info string is nice.
Feb
28
comment Frequency of letters change by the length of the texts?
There are two different effects: 1) For short texts the frequency won't be statistically significant unless you average over many independent samples 2) Different kinds of text use different words. For example the word frequencies you'd get from emails would be very different from those on wikipedia. It's very well possible that this shifts the frequency of letters somewhat.
Feb
28
comment Rfc2898DeriveBytes - password length
For those not familiar with .NET: Rfc2898DeriveBytes implements PBKDF2-HMAC-SHA-1.
Feb
28
comment Attacking both authenticity and secrecy in authenticated encryption modes
On x86/AMD64 CPUs "hardware support" means that the AES-NI instruction set is supported, which contains special instructions for AES and GCM (the latter can be used for binary field operation in general).
Feb
28
comment Non-standard signature security definition conforming ed25519 malleability
@Gracchus The expression $R < l - 1$ makes no sense. You can't compare group elements and scalars. Where in the paper is this?
Feb
27
comment Non-standard signature security definition conforming ed25519 malleability
@Gracchus What I listed is normal malleability. I assume you could run the same attack that hit MtGox by adding $l$ to $S$. If you want to use Ed25519 in a bitcoin like protocol, you certainly should add a $S<l$ check. Nightcracker's attack on the other hand is weirder, it certainly doesn't fit the common definition of malleability. I'm not even sure if we should classify it as an attack. (for details, see discussion on the github issue, I posted a longer comment overthere).
Feb
27
comment Designing a secure IM protocol
One obvious issue is that you can send a different message to each recipient with that scheme.
Feb
27
comment Non-standard signature security definition conforming ed25519 malleability
@Gracchus I only checked one implementation (Ref10, the most popular one), which accepts $s \geq l$. I.e. with this implementation Ed25519 is malleable. I expect most other implementations to accept those signatures as well. => You can't rely on non malleability unless you add additional checks yourself.
Feb
27
comment Non-standard signature security definition conforming ed25519 malleability
@DrLecter For bitcoin doesn't matter if the real signer can produce distinct signatures. They obviously can with all ElGamal derived signatures, like ECDSA, Schnorr or EdDSA. But it matters if an attacker who doesn't know the key can take a signed message and modify any part of it, including the signature. Some implementations (e.g. MtGox) falsely relied on attackers not being able to do that, but the reference implementation doesn't suffer for these issues. See Transaction Malleability on the bitcoin wiki for additional information.
Feb
27
comment Non-standard signature security definition conforming ed25519 malleability
@DrLecter I suspect Gracchus wants to be sure EdDSA is not malleable, to avoid issues like the one that recently owned MtGox.
Feb
26
comment Can a properly implemented ed25519 private key with public underlying data be cracked?
@Gracchus No, don't pre-hash the message before passing it to Ed25519. Ed25519 already hashes the message, but in a way that's stronger than a normal hash. My example of additional signatures weakening the scheme is rather theoretical. My point is just that you can't make a generalized statement like ultraman's, you need to consider the specific scheme.
Feb
25
comment pbkdf2 password validation
For password hashes a constant time validation isn't that important, especially for attackers who don't know the salt. It's merely good style to use it. For MAC validation it's far more important, since a timing leak would allow construction of a valid MAC.
Feb
25
comment Strange Password Hashing
The technique for avoiding timing attacks doesn't work. So if the salt is known, it's just as vulnerable to side channel attacks as scrypt with known salt. At a glance this looks like a badly done variant of scrypt.