10,529 reputation
12455
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 6 months
seen 1 hour ago

Jan
9
comment How secure is file header encryption for large files?
1) What are your security goals? Encrypting only part of the file will not be acceptable under most security goals. 2) A desktop computer should be able to get under 15s as long as IO keeps up.
Jan
9
comment Discrepancy with reported key size for EDE ciphers in Qualys SSL Labs
I don't think an attacker would implement the meet-in-the-middle like that. Cycle finding should be applicable, reducing the memory to around $2^{56/2}$ pairs and you need to do far fewer memory lookups.
Jan
8
comment curve25519 weak points for contributory behaviour
If you reject points based on their bitstrings, one pitfall is that different implementations treat the last bit differently. NaCl treats the input as a 256 bit integer, most other implementations ignore the bit. The strings you need to reject differ between the encodings.
Jan
8
comment CBC with a fixed or random IV
1) With a fixed IV you leak if the first 16 bytes of two messages are identical. 2) The IV is usually send alongside the ciphertext, typically as a prefix. The IV is not secret, but needs to be different for each message.
Jan
7
comment What is a good way to demonstrate elliptic curve cryptography?
@fkraiem It's silly to encrypt actual messages with ElGamal. Every sane protocol uses some kind of hybrid encryption, such as ECIES. IMO the only reason to use ElGamal encryption is needing its special properties (such as homomorphic encryption).
Jan
7
comment Sophie Germain primes and safe primes
1) Why don't you simply generate a random number of the desired size, check if it's a safe prime and repeat if it's not? 2) I think there are some RFC documents that define standard primes for use with Diffie-Hellman, these are often safeprimes.
Jan
7
comment Are there any Secp256k1 ECDSA test examples available?
Both answers don't include any ECDSA test vectors, only testvectors for scalar multiplication of the base point.
Jan
6
comment NTRU key generation
Where does that 1.5 come from? Is just an arbitrary choice that compensates for multi target attacks?
Jan
6
comment Share encrypted files without giving master key
The standard solution would be to store the random value (which acts similar to an IV) at the beginning of the ciphertext. I would avoid coupling to external meta data, especially since filenames aren't unique.
Jan
6
comment Share encrypted files without giving master key
Why use the filename instead of a random per-file value?
Jan
5
comment How many bits of entropy would I get from 300 coin tosses?
If it's an unbiased coin, you get one bit per toss. Since Shannon entropy is additive for independent events, you get 300 bits total. (This assumes that you toss 300 times, not that you toss 300 indistinguishable coins together)
Jan
3
comment Is BBS used for generation of keys for any modem cryptosystem?
Why do you ask?
Jan
3
comment RSA - Why should we sign hash rather than raw content?
The size limitation is similar for encryption and signing. It's the size of the modulus (256 bytes for RSA 2028) minus some space reserved for of padding (40ish bytes). The reason you never heard "we can't encrypt a file bigger than 256 bytes using a RSA public key" is because nobody (competent) does that. RSA encryption is almost always hybrid encryption i.e. you only encrypt a random key with RSA and the rest with symmetric encryption like AES. Just li
Jan
2
comment (Re-)Using deterministic IV in CTR mode / How to: deterministic AES
Since you'll need to publish the IV, it's essential that the derivation function is keyed.
Jan
2
comment Are there cryptographic hash functions which do not have any collisions?
There exist one-way functions which have no collisions, but obviously their output will be at least the size of the input.
Jan
2
comment (Re-)Using deterministic IV in CTR mode / How to: deterministic AES
Search for BEAR, LION, LIONESS. Might be relevant
Jan
2
comment Size of a MAC for a quickly checked message?
I'd use between 8 and 16 bytes, depending on the desired security level.
Dec
28
comment Can I simulate iterated AES-ECB with other block cipher modes?
Has been some time since I looked at keepass2, but from what I remember it was equivalent to two independent uses of CBC with zero bytes as data.
Dec
26
comment Which Block cipher mode should I use?
The best choice of block cipher mode depends on context. Apart from ECB all popular modes are semantically secure. But perhaps you need integrity checks, in which case you might want authenticated encryption, like AES-GCM or a traditional MAC in an encrypt-then-mac scheme. Sometimes you need to preserve the length, sometimes you need nonce reuse resistance, sometimes you need asymmetric authentication, sometimes you worry about certain side-channels, sometimes you don't...
Dec
25
comment test vectors for 3DES seem to in fact be testing DES - not 3DES
Did you confuse bits and bytes? DES has a 56/64 bit key and 3DES has a 168/192 bit key.