8,799 reputation
12041
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 2 years, 9 months
seen 2 days ago

Mar
25
comment Is PBKDF2-HMAC-SHA1 really broken?
It might have one effect: The designers of entries to the password hashing competition will avoid these collisions.
Mar
25
comment Is PBKDF2-HMAC-SHA1 really broken?
Collision resistance isn't considered a required property for password hashes. So this is generally just a curiosity, not a vulnerability.
Mar
25
comment Challenge–response authentication which can be done in head?
1) The scenario you described is symmetric, since you and the doorman have a shared secret. 2) You need authentication, not encryption
Mar
22
comment Questions about hash functions
Even with Merkle-Damgard hashes like SHA-256 (which are vulnerable to length extensions attacks) are not vulnerable to length reduction attacks.
Mar
22
comment Rock-paper-scissors over network, how to protect from cheating server?
If the server pretends that it didn't receive Alice's plaintext, Alice will notice and avoid that server in the future.
Mar
20
comment Current standard security level for a hash function?
I prefer at least 128 bits of security for everything ( => use 256 bit hashes if you want collision resistance). If you care less or only need short term security you can go down to about 80 bits.
Mar
19
comment Why is Serpent faster than AES in this benchmark?
@Gael With parallelism I mean that you have the inputs for multiple blocks (with 16 bytes each) available at the same time. In that case you can call a (single threaded) function that takes e.g. 32 blocks and produces 32 encrypted blocks. This function is cheaper for Serpent than encrypting 32 blocks individually. Using Serpent-XTS should be faster than AES-XTS on your current hardware, but once you get a AES-NI capable CPU AES will pull ahead.
Mar
19
comment Why is Serpent faster than AES in this benchmark?
In that case the AES numbers are plausible (16 cycles per byte) compared to ~12 on i3 without AES-NI in the eBACS benchmark.
Mar
19
comment Why is Serpent faster than AES in this benchmark?
What CPU do you have? Intel? AMD? How fast? Which architecture?
Mar
18
comment What is the importance of the $r$ and $c$ values for the Sponge Construction?
C=128 has a security level of 64 bits against certain attacks, but the output size is still unlimited.
Mar
18
comment Elliptic Curves of different forms
If you assume that the weierstrass implementation is safe, you only lose performance. Rigidness is the only property that directly relates to the security of the curve, all the other safety properties are about making it easier to write a fast and secure implementation. For example BouncyCastle C# is neither fast nor secure.
Mar
18
comment Is this a secure (and correct) sign-then-encrypt technique for transferring messages?
RSA is very fast for encryption and signature verification (public key operations) and slow for decryption and signing (private key operations). ECC has decent performance for all operations. If you sum the cost of encryption and decryption, RSA is certainly much slower than than its ECC equivalent (by a factor 10 or so).
Mar
18
comment Is this a secure (and correct) sign-then-encrypt technique for transferring messages?
IMO it's a silly design. 1280 bit RSA sucks for confidentiality but might be good enough for authentication. ECDSA on the other hand is trickier to use than RSA encryption, since it needs good randomness for each signature (unless you use an uncommon deterministic variant). Using EC-DH (256 bit) for key-exchange (and thus encryption) and RSA for signing would be a far better choice. Or just one algorithm for both.
Mar
18
comment Is the term “Elliptic Curve Discrete Logarithm Problem” a misnomer?
Mathematicians don't care how you call the basic operation. We commonly call it addition, but calling it multiplication is just as valid.
Mar
18
comment Which of following new (2013) ECC curves is the most secure or efficient?
The larger the curves the slower (but stronger) they are.
Mar
17
comment Is this an acceptable implementation of ARC4 encryption for my system?
@traxonja If you want authentication and encryption you could consider AES-CCM.
Mar
16
comment Elliptic Curves of different forms
Why do you want to use a montgomery/edwards curve if you then proceed to perform weierstrass form operations on them? To take advantage of montgomery form you need to use differential addition with an appropriate ladder. The whole point of supporting montgomery ladders is that you use them.
Mar
13
comment Which eliptic curves in OpenSSL 1.0.1f meet all / most of the SafeCurves requirements?
Apart from rigidness those "weaknesses" are features of montgomery/edwards curves. Those features don't gain you anything if you use weierstrass form in your implementation.
Mar
13
comment Are there use cases where a signature itself needs to be signed?
@JohannesErnst I'd rather encapsulate it, like {data={...}, sigs=[{sig1}, {sig2}]}. If one signature needs to be signed, the outer signature can encapsulate the previous one, else add them to the array.
Mar
13
comment Are there use cases where a signature itself needs to be signed?
You should take a look at JSON Web Signature (JWS). I didn't read it myself, so I can't vouch for its quality.