9,854 reputation
12450
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 3 months
seen 5 hours ago

Oct
23
comment Can I use the ChaCha core as a 256-bit to 256-bit one-way function?
If you only need one-way-ness / first pre-image resistance, you should be fine, since that maps directly to a key recovery attack on ChaCha. If you need collision resistance, don't use it.
Oct
23
comment MARS and RC6 in CUDA
As a side-note: You should target ATI CPUs as well, those usually have higher performance for crypto.
Oct
22
comment What block cipher is used for CBC-MAC?
CBC-MAC is fine with variable length messages, as long as you never have one message that's a prefix of another. For example a length prefix can achieve that if you know the length of the message beforehand.
Oct
22
comment Should I trust CipherCloud?
Looks like they came up with a major cryptography break-through this month: You can use AES with a random IV. True pioneers who boldly go where no man has gone before.
Oct
21
comment Genuine encryption from only one source?
Does a standard digital signature fit your scenario?
Oct
21
comment How much is slower GCM AES-128 than one of the stream chipher eSTREAM?
eBACS clearly uses AES-NI on some CPUs for aes128ctr but apparently it does not for aes128estream. On CPUs with AES-NI, it seems to run AES-128 at 1.3 cycles-per-byte, but without it costs over 10 cpb.
Oct
21
comment What's wrong with MARS?
At minimum it's rather ugly.
Oct
21
comment Security considerations on “expand 32-byte k”-magic number in the Salsa20 famility of stream ciphers?
Choosing all four 32-bit words of the constant as equal is probably a bad idea.
Oct
21
comment Can Secp 256 K1 curves “map” to a value on FIPS 186-3 or P-256?
Conversion works only if the curves are equivalent, but Secp256K1 and P256 are not equivalent.
Oct
18
comment How exactly was the finalist chosen in the NIST AES competition?
Rijndael is actually pretty tricky to implement in software if you want to completely avoid timing side-channels without specialized instructions.
Oct
17
comment Cryptanalysis not based on method used to encrypt?
what do you mean by matrix based cryptography?
Oct
16
comment Can we decrypt in this order when the message is encrypted twice?
It's important to note that xor isn't secure if the attacker can observe the intermediate values $E_{k_1}(i)$ and $E_{k_2}(i)$, so e.g. using xor with a three-pass-protocol is completely broken.
Oct
16
comment Can we decrypt in this order when the message is encrypted twice?
Search for commutative encryption. There are several related questions on stackoverflow, but you can't trust their answers for security.
Oct
16
comment Can we decrypt in this order when the message is encrypted twice?
You can do it with CTR or OFB. But depending on which intermediate steps an attacker can observe, it's not secure. You need to describe your model, at which points an attacker observes the data clearly. Else you'll end up with a scheme that works but isn't secure.
Oct
14
comment Reuse of a DH / ECDH public key
IMO RSA is inferior for most applications. 1) Its private key operation is slower, especially at high security levels. 2) It's size overhead is bigger, both for the encrypted key and for the public key. (32 bytes vs ~300 bytes). 3) It can't authenticate to the recipient without signing (deniable authentication) => I'd only use RSA for legacy application, or when you need its special properties (e.g. blind signatures)
Oct
14
comment PGP encryption options
I'd avoid the old ones (Cast, 3DES, IDEA), and prefer AES or TwoFish. But for all of them, it's unlikely that the strength of symmetric encryption is the weakest point of your system. Spend your time creating a secure end-point and being careful about where you get public keys, rather than worrying about the strength of symmetric ciphers.
Oct
13
comment How long does it take a quantum computer to brute force AES?
@e-sushi If NSA isn't far ahead of D-Wave, then we'll be safe for decades.
Oct
12
comment How much is slower GCM AES-128 than one of the stream chipher eSTREAM?
The first place to go for performance checks is eBACS. Unfortunately it has its flaws. In particular I suspect that its AES implementations are far from optimal on some platforms.
Oct
12
comment How much is slower GCM AES-128 than one of the stream chipher eSTREAM?
1) That's an apples to oranges comparison. eSTREAM is about unauthenticated stream ciphers, you need to compare with AES-CTR. 2) Which CPU? With AES-NI it's really fast, faster than eSTREAM ciphers. On other CPUs it can it might be 5x slower,... 3) with or without side-channel protection? Implementations of GHASH on CPUs without specialized instructions uses large lookup tables, leading to low key agility and potential cache timing attacks.
Oct
12
comment How many messages needs to be send to server to get AES key in Cache-timing Attack
Depends a lot on how well you can measure the timing. Bernstein used a setup with pretty accurate timing information.