Reputation
11,691
Next tag badge:
97/100 score
18/20 answers
Badges
1 25 57
Newest
 Informed
Impact
~189k people reached

Apr
29
comment Yubico's take on U2F key wrapping
Are you using the HMAC key as second parameter?
Apr
29
comment Montgomery Ladder vs Double-and-Add
@David天宇Wong I don't get your point. The cost of multiplication is data independent for most CPUs. So as long as you implement your code without secret dependent array lookups and secret dependent branches, you should trivially end up with a side channel resistant implementation.
Apr
29
comment Montgomery Ladder vs Double-and-Add
@David天宇Wong But montgomery curves have nice properties which allow fast constant time implementations of montgomery ladders.
Apr
27
comment Are more S boxes more secure in a SP-Network?
1) The increased pressure on the CPU cache might be more expensive than what you gain from being able to reduce the number of rounds. 2) You can't add special s-box instructions to the CPU if there are many sboxes (see AES-NI)
Apr
27
comment Can cycle finding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?
Working on a prototype implementation, I noticed that my assumptions about how iterated hashes cycle were wrong. I didn't know that a few cycles and their tails dominate.
Apr
26
comment Can cycle finding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?
You can't just equate the number of operations with time, you also need to take parallelism into account. (And DJB argues that you can't neglect the cost of memory access circuitry for many attacks either.) With cycle-finding I'd expect the cost of memory to be cheap compared to the cost of all those parallel DES computation circuits. For example such a computer might have ~4 GB of memory and $2^{20}$+ DES circuits, running for ~$2^{36}$ timesteps (where each timestep is one DES invocation).
Apr
26
comment Can cycle finding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?
1) In the simplest case we could truncate. If we need a tweak to repeat the whole experiment with a different hash function (not sure if that's required) we can use any kind of tweakable hash (preferably a cheap one) 2) I don't think the block-size matters at all with most modes of operation (including ECB, CBC and CTR). We simply need a long enough known plaintext/ciphertext pair.
Apr
26
comment Why does applying 56-bit DES twice only give 57 bits of security?
@fgrieu I originally planned to verify the technique experimentally with small keys before posting about it, but since I don't have the time for that at the moment, I've asked it as a question: Can cycle findinding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?
Apr
25
comment SHACAL-2 vs. AES as underlying block cipher for Secure Hash (aka SHA-256)
@EvgeniVaknin Depends on the hardware. AES will probably be faster than SHACAL-2 on most processors. But on processors without AES-NI the difference will be smaller than the ratio of the number of rounds. You also need to keep in mind that a hash gives an attacker much more control over the inputs, so the same block cipher might need more rounds when used as hash compared to being used as encryption.
Apr
25
comment SHACAL-2 vs. AES as underlying block cipher for Secure Hash (aka SHA-256)
You can use AES to build a secure MAC (CBC MAC and its derivatives). Unlike your suggestion, these constructions use AES with a random key, which the attacker doesn't know.
Apr
25
comment Why cant I use ECB with some obfuscation for random access data stored in say a DDR
Why not do it properly? XTS mode is similar to your idea (it combines the address with the data), but actually secure.
Apr
24
comment Prime factorization
@tylo GNFS depends on the size of the number. But some other algorithms like ECM depend on the size of the smallest factor. If your factors are small enough so that ECM is faster, then the cost will depend on the size of the factors. If all the factors are big enough so that GNFS is faster, the size of the factors doesn't matter.
Apr
24
comment Prime factorization
Since factoring a 512 bit semiprime costs about $100, it's clearly more than a standard computer can do in a few hours. Your number has 392 bits, so factoring would be relatively cheap, but I don't know if it'd fall below your limit. If the number has small factors, ECM should be faster than GNFS.
Apr
23
comment Security aspects of using a global values as nonce and additional data for AES?
Strictly speaking, you must never reuse a (key, nonce) pair.
Apr
23
comment How are onetimepads distributed?
Both parties could meet in person and exchange a disk containing the pad. Or perhaps you send a diplomatic courier with the key material in a sealed bag. The annoying key-distribution is one of the reasons why one-time-pads aren't very popular.
Apr
22
comment Can Grover's algorithm be parallized?
@mikeazo I think I was asking the wrong question. I've changed it a bit, to be closer to what matters for attacks on cryptography.
Apr
22
comment What is the “compression function” in Merkle-Damgård?
Yes. MD is a domain extender which turns a fixed input size hash into a variable input size hash.
Apr
22
comment Is it possible to break enigma code with a todays laptop
When you say "rollers", you mean the "rotors", right?
Apr
22
comment Super-simple encryption of short strings
1) Why use encryption at all? I'd rather use a lookup table/tokenization. 2) If you want to use crypto, why use format-preserving-encryption? 2) Anonymizing data sets is hard. It's often possible to correlate data from different sources to deanonymize such data.
Apr
22
comment side channel attacks against TDES (compared to AES)
So it wasn't just a timing attack, but a power analysis attack? In that case you're pretty much doomed with any general purpose CPU. If you want to prevent attacks where the attacker has physical access to the device, you should use special purpose hardware designed to make these attacks harder. The choice of cipher matters far less compared to how much effort the hardware designer put into preventing those attacks.