8,799 reputation
12041
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 2 years, 9 months
seen 2 days ago

Aug
5
comment Is AES-XTS considered safe to encrypt multiple files with the same keys?
Encrypting the same plaintext block twice at the same position leads to identical ciphertext block. That's already quite a big leak.
Aug
5
comment salting with password hash to improve security?
Duplicate on security.stackexchange: When hashing passwords, is it ok to use the hashed password as the salt?
Aug
5
comment Discrete log problem with modulus prime
DL is hard for prime moduli as long as $n-1$ has certain properties. We typically use primes for Diffie-Hellman or DSA.
Aug
5
comment Why Elliptic curve cryptography are not popular in practice
"RSA [...] can be implemented using the technique of Elliptic curves" Generally you don't implement an RSA equivalent on elliptic curves. I think it doesn't offer a real advantage of normal RSA. Typically we use Diffie-Hellman or DSA (and some very similar algorithms) on elliptic curves.
Aug
5
comment Finite fields in elliptic curve
$a$ needs to be an integer (which can be reduced modulo the curve order). There is no operation that multiplies two curve points, and dividing two curve points is prohibitively expensive (requires computing the discrete logarithm)
Aug
2
comment Converting Ed25519 public key to a Curve25519 public key
You can add github.com/nightcracker/ed25519/blob/master/src/key_exchange.c to your project. It should be compatible with the rest of your implementation. It takes an Ed25519 public key, converts it to montgomery, and then computes a scalar multiplication. Don't forget to add a hashing step in the end, preferably one that's compatible with NaCl. That's what I do in my C# port.
Aug
2
comment Converting Ed25519 public key to a Curve25519 public key
In my own application I chose to use Ed25519 public keys in the public API, even for key-exchange. Then convert the public key to montgomery during key-exchange. That's slightly more expensive, but makes the API nicer since there is only one kind of public key visible to the consumer. I also think that it's possible to convert the key-exchange to use Ed25519 natively, removing the performance penalty, but didn't get around to investigating that yet.
Jul
31
comment Why elgamal is still discussed
I don't get your point about ECC. EC-DH vs. EC-ElGamal is no different from DH vs. ElGamal on finite fields. Personally I use EC-DH as much as possible, only falling back to signatures or RSA when absolutely necessary.
Jul
31
comment Why elgamal is still discussed
And DH isn't unauthenticated per-se. If you use a long term key, DH authenticates you. DH providing authentication is one of the big advantages of DH over RSA or ElGamal in my book.
Jul
31
comment Why elgamal is still discussed
IMO the homomorphic properties are the only useful property of ElGamal. For anything else I prefer DH + AES in an authenticated mode.
Jul
31
comment Why elgamal is still discussed
I agree with you. ElGamal is only useful in niche applications. For normal usage DH is preferable.
Jul
31
comment Practical consequences of using functional encryption for software obfuscation
@rath AVs are practically irrelevant for keeping your computer secure. The only reason for having them is to avoid the accusation of negligence for not having one.
Jul
31
comment Derive a key from public data using a secret master key
@RickyDemer The OP won't derive 2^60 keys, so that doesn't matter. For reasonably sized outputs AES-CTR is indistinguishable from random data. And even if you'd go above the birthday bound, it'd most likely stay secure despite indistinguishably breaking down. So I wouldn't worry about the birthday bound.
Jul
31
comment Derive a key from public data using a secret master key
NIST has also published an AES based variant of HKDF. Might want to look for that one. But personally I prefer hashes for key derivation in most situations.
Jul
31
comment Derive a key from public data using a secret master key
If you encrypt a unique block with AES you get a unique output, and key recovery is hard. So I don't see a problem with your scheme as long as you only encrypt a single block.
Jul
31
comment Derive a key from public data using a secret master key
is your message longer than one block?
Jul
31
comment Derive a key from public data using a secret master key
Not sure what you mean by "brute force attack is plausible" in the context of HKDF. Your scheme and HKDF seem to aim at the same context, where you have a strong master key.
Jul
30
comment Why use variable p, q, g for Diffie-Hellman?
My impression is that most protocols support arbitrary finite fields, but implementations usually choose a standard curve.
Jul
30
comment Why use variable p, q, g for Diffie-Hellman?
Isn't that an advantage of standard groups? Since for those you can easily check if they were generated properly e.g. checking that the $p$ is a safe prime, or that the groups is a schnorr group with properly sized factors.
Jul
30
comment Why use variable p, q, g for Diffie-Hellman?
What's the problem of the knowing factorization of the order? AFAIK it is usually known. Finite fields used with DH are usually based on a safe prime or are schnorr-groups. In both cases the prime factors of the order are known.