Reputation
12,008
Next tag badge:
98/100 score
18/20 answers
Badges
1 29 60
Newest
 Revival
Impact
~199k people reached

Jun
21
comment Determine safety of exercise hash functions
Which security properties do you want?
Jun
20
comment What is Polymorphic encryption?
Can you elaborate on the context where you heard this? The closest thing I know is polymorphic malware.
Jun
20
comment Any use for now-defunct Mt Gox Yubikey?
I'm voting to close this question as off-topic because it is not about cryptography.
Jun
20
comment 2DES vs. two-key triple encryption, with no decryption step
Related question: Why is triple-DES using three different keys vulnerable to a meet-in-the-middle-attack?
Jun
19
comment 3DES over Galois Counter Mode (GCM) for authenticated encryption
@MaartenBodewes You wouldn't use a 64 bit polynomial. You'd use 2 blocks as keys/mask for GHash. The biggest problem with 64 bit block ciphers is that the IV size becomes even smaller (32 bits for counter, 32 bit IV). Not sure how big the impact on protocol design is in practice, since a random 96 bit IV isn't a great idea either, so when a good protocols needs a random IV, it uses a KDF to derive a one time key from IV and master key.
Jun
19
comment Relationship between an elements order and the DLP
Related question: Solving discrete logarithm when p is not a safe prime
Jun
19
comment Relationship between an elements order and the DLP
We don't have a good question about small subgroup attacks and IMO we should have one. But I'm not sure if we should use this one (edited if necessary), or if we should create a well written canonical question, and close this one as duplicate of it.
Jun
19
comment In which situations is a length-extension attack a problem?
Similar multi collision attacks apply to all narrow pipe hashes, since for them, finding a state collision isn't harder than finding an output collision.
Jun
18
comment How can complexity be increased or decreased in AES?
If this is password based encryption, then there is a natural security-performance tradeoff: The cost of the key-derivation-function can be increased or decreased. For example, bcrypt and PBKDF2 have a number of iterations which can be tuned.
Jun
16
comment SHA512 faster than SHA256?
@MaartenBodewes By the time I remembered that, the 5 min edit limit had expired.
Jun
16
comment SHA512 faster than SHA256?
The crossover point should be at 56 bytes, since SHA256 jumps to 2 blocks of 64 bytes each, at that point. SHA256 might get ahead again at 120 bytes, since then it's 3 blocks for SHA256 and 2 blocks (128 bytes each) for SHA512.
Jun
14
comment Should I use ECB or CBC encryption mode for my block cipher?
1) The additional complexity of CBC or CTR is small compared to the complexity of the blockcipher itself. The performance hit is negligible using CTR mode. 2) CBC can be decrypted if you lose data in the middle since each plaintext blocks only depends on two consecutive ciphertext blocks. But it's rarely a good idea to decrypt modified data.
Jun
14
comment Supersingular Isogeny Key Exchange Software
I heard something about 200ms/op for current implementations. Considering how new it is and its mediocre performance, I'd rather use lattice crypto.
Jun
12
comment Should I use ECB or CBC encryption mode for my block cipher?
What's ccb? Did you mean cbc?
Jun
11
comment Cryptanalysis and Copying encrypted volumes
1) moder encryption aims to be immune to known or even chosen plaintext attacks. So as long as the crypto is unbroken, known plaintext doesn't matter. 2) truecrpt leaks which 16 byte blocks are identical if you have two xontainers using the same key.
Jun
11
comment Is DES slow in hardware or only in software?
You might want to expand the blocksize point.
Jun
11
comment Is DES slow in hardware or only in software?
Note that bitsliced DES isn't that slow in software, but you can only use it if you can process multiple blocks in parallel. This is the case for ECB, CTR and CBC decryption, but not CBC encryption. Similar to Why is Serpent faster than AES in this benchmark?
Jun
8
comment Converting ECC Code from python to Java. Extended Euclidean Algorithm not working.
Python carries out the tuple assignment at the same time, your java assignments happen sequentially. This means lm and low already have their new values when you assign them to hm and high, whereas in python they still have the old value.
Jun
8
comment Converting ECC Code from python to Java. Extended Euclidean Algorithm not working.
I'm voting to close this question as off-topic because it is a programming problem.
Jun
2
comment Which attacks are possible against raw/textbook elliptic curve?
ECIES corresponds to RSA-KEM, with both you hash the shared secret using a KDF. Typical ECC signatures are similar to RSA-FDH, since in both cases you use a hash as big as the modulus as a number.