Reputation
14,430
Next tag badge:
102/100 score
17/20 answers
Badges
1 36 76
Newest
 Nice Answer
Impact
~288k people reached

Apr
14
comment Weaker alternative to Ed25519?
@Chris Why use crypto at all, if its extremely weak? 56 bits of security is rather dubious. You should rather figure out how to comply with the export regulations of your country. Some countries (like Germany) don't care at all. In the US you need to jump through a couple of bureaucratic hoops, but shouldn't be too difficult.
Apr
12
comment CTR_DRBG versus OFB_DRBG
Since AES is a pseudo-random-permutation not a pseudo-random-function, you can't apply the birthday problem and the average cycle length is $2^{127}$ not $2^{64}$.
Apr
12
comment CTR_DRBG versus OFB_DRBG
Average cycle length of AES-OFB is expected to be $2^{127}$, too big to matter in practice.
Apr
12
comment AES-XTS: find key from ciphertext and plaintext
There is no known efficient key-recovery attack against AES, no matter the mode of operation.
Apr
12
comment AES file encryption with PBKDF2. Safe parameters?
I'd stay with PBKDF2, bcrypt and scrypt for several more years. I don't consider the review the candidates received during the PHC competition sufficient to be really confident in their security.
Apr
12
comment Use cases for “online” authenticated encryption?
If you encrypt a movie, you should split the file into segments and authenticate them. It's a bad idea to release unauthenticated data to your video player. Why use authenticated encryption if you don't verify the tag until it's too late?
Apr
12
comment Randomness in generation of Virtual Machines from pre-built Image
It's a general security question, not a cryptography question. It might fit security.se.
Apr
9
comment Is it possible to combine true streaming with AEAD?
Splitting the message into segments and authenticating each segment separately is the standard approach.
Apr
7
comment Salsa20-GCM composition secure?
Strictly speaking GCM has been defined using a 128 bit block cipher, but it's easy to generalize it to any stream cipher that takes a nonce and it's be secure that way. But I see little reason to do so, since GCM only works well if you have specialized instructions, which are typically only available on CPUs which can also accelerate AES.
Apr
3
comment How to encypt/decrypt messages after ECDH key agreement
Why did you tag this with PQ-crypto? Diffie-Hellman is not PQ secure, neither on finite fields, not on elliptic curves.
Apr
3
comment Required key size for an ideal cipher with a 32 bit block size
@fgrieu A 16 GiB lookup table could fit into RAM and should have acceptable performance. Efficient key expansion from a minimal-size key might be a bit trickier though.
Apr
2
comment Will there always be 256 collisions for the output of the MD5 hashsum function for 17-byte inputs?
@coder543 The whole bitcoin miner network computes around $2^{80}$ SHA256d hashes per year (burning several hundred million USD on hardware and electricity). While MD5 is a slightly cheaper than that, it'd still take it several trillion years to compute $2^{128}$ MD5 hashes.
Apr
2
comment Is there a need to encrypt data when send over https?
@MaartenBodewes Apparently the OP has an unusually painful voice :) "Doctor, it hurts when I do this." -- "Don't do that."
Apr
2
comment Is there a need to encrypt data when send over https?
As long as you ensure that you're talking to the correct server (typically by properly validating the server's certificate), sending passwords in plain isn't a big issue. "just by installing my certificate" nobody stops you from shouting yourself in the foot. You could have "just installed a trojan horse", same thing really.
Apr
2
comment Will there always be 256 collisions for the output of the MD5 hashsum function for 17-byte inputs?
Concerning rainbow tables 1) they're much smaller than all 17 byte inputs. 2) Probably below to 8 bytes or 13 lowercase letters. 3) Even for the target range, they typically only contain most but not all values.
Apr
1
comment Probability of SHA256 Collisions for Certain Amount of Hashed Values
@vern You're right. I forgot the 1-exp(...) part
Apr
1
comment Average/approximate difference in value between valid consecutive $x$ coordinates in ECC?
$d$ should be pretty close to 2.
Mar
31
comment Is it safe to encrypt random data using ECB mode?
Can't answer that without context. But there is one thing all the modes you mentioned lack: Integrity checks/MACs.
Mar
30
comment Is there any pattern in points on EC?
Even if you're given a compressed point, i.e. you don't know y, you can still check if x^3+ax+b is a square. This can be avoided by either randomly choosing a point from the curve or its twist (with the correct probabilities) or using something fancy, like elligator.
Mar
27
comment Can I construct a zero-knowledge proof that I solved a Project Euler problem?
Checking if you have the same answer as somebody else is the Socialist millionaire problem.