9,427 reputation
12345
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years
seen 4 hours ago

Jun
3
comment Montgomery Ladder vs Double-and-Add
On montgomery curves montgomery ladders enable cheap addition via differential addition in x/z form. In most other situations I'd rather create a lookup table with 32 or so entries and then double 5 times followed by one lookup and one addition.
Jun
2
comment Measure ECC key size
When talking about the size in ECC we generally refer to the field size.
Jun
1
comment Parallel hash construction
Related question: Counter mode secure hash algorithm
May
28
comment RSA and ECDSA performances
Concerning optimized implementations, ECC has one big advantage: A fixed modulus which usually has been chosen to allow efficient reductions. Certain academics like publishing papers about their world record speed ECC implementations, so ECC has seen quite a bit of optimization work targeting modern CPUs. ECC is more complex mathematically, but I think it's actually easier to write a fast ECC implementation compared to a fast RSA implementation.
May
28
comment Is TEA considered secure?
@user54609 8 byte blocks are annoying to use since it makes encrypting more than a GB using a fixed key problematic. In a quick test TEA was rather slow at 45 cycles per byte. Why do you claim it's "super fast"?
May
25
comment Efficiency of chaining AES “groups” of blocks
This technique is responsible for the famous BEAST attack against TLS.
May
21
comment Which tamper-protection algorithm provides the shortest output?
@Vilx- With HMAC the chance of accepting a forgery is $2^{-n}$ for an $n$ bit MAC. With GCM every successful forgery reveals a big part of the key whereas for HMAC the only effect is that you accept a forgery. So if you really need to go below 128 bit MACs, I recommend against GCM. Another issue with GCM is that it needs a nonce and reuse is fatal, whereas HMAC doesn't need a nonce.
May
21
comment Which tamper-protection algorithm provides the shortest output?
I'd go with truncated HMAC-SHA-2 with a length somewhere between 64 and 128 bits. Truncation is fine with HMAC, but do not truncate a GCM / GHash MAC.
May
20
comment how to use common modulus attack?
Didn't realize RSA had this property. Even though this is a low effort question, +1 for making be learn something new.
May
19
comment Do I need two keys for AES CBC and HMAC or can I use the same key for both operations?
Related: Why can't I use the same key for encryption and MAC?
May
16
comment Is concatenated data hashed with scrypt vulunarable to a length extension attack?
I think scrypt inherits the zero padding length extension from PBKDF2. scrypt(s, salt) == scrypt(s + \0, salt) for short enough s shorter than 64 bytes.
May
14
comment ECDSA vs RSA: Performance on Android platform and surprising results
@user13397 My point is that the main reason for ECDSA being slow in your test is not that it's implemented in pure java, it's because the implementation has not been optimized. Native code usually results in a speedup, but a smaller one. I'd guess a good java implementation would be 50 times faster than your code and native code would result in a factor 2-3 speedup beyond the best possible java implementation. But I don't have java/android experience, so these are very rough guesses coming from my experience with writing crypto code in C#.
May
13
comment ECDSA vs RSA: Performance on Android platform and surprising results
@mikeazo It uses its own BigInteger library. But even with pure java code you can get much better performance.
May
11
comment How to decrypt a text which is ciphered same length key?
See also: How does one attack a two-time pad (i.e. one time pad with key reuse)?
May
9
comment Point addition and doubling in Ed25519 (ref10)?
sc_clamp makes no sense on encoded points. It operations on scalars.
May
9
comment Why is Triple DES not vulnerable to meet in the middle attacks?
Very similar to the question Why is triple-DES using three different keys vulnerable to a meet-in-the-middle-attack?
May
9
comment Point addition and doubling in Ed25519 (ref10)?
Is your code publicly available?
May
9
comment Point addition and doubling in Ed25519 (ref10)?
If you only need one coordinate of the output, you can convert to montgomery form, compute the scalar multiplication and convert back. You only need your approach if you need both coordinates.
May
9
comment Point addition and doubling in Ed25519 (ref10)?
Why do you want to avoid the conversion to Montgomery for DH? It's a bit slower than using (Y/Z) coordinates in Edwards form due to an additional field inversion, but almost certainly faster than what you're attempting to build. Conversion back to edwards at the end of the scalar multiplication is free, but I didn't do so for compatibility with existing Curve25519 shared secrets.
May
8
comment Decrypt a public encrypted message and Sign a signature, how the math is different?
With RSA you generally use different padding. With other schemes encryption and signing usually have very little in common.