8,799 reputation
12041
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 2 years, 9 months
seen 2 hours ago

Jul
20
comment Is generating public key inevitably slow in classic Diffie-Hellman if the private key is large?
I think you can still choose a small value for x (say 256 bits) without losing much security even with a 3000 bit q. A large q is mainly problematic for DSA, not DH.
Jul
20
comment Can you explain what the AES paper means by “sharing active S-boxes”?
@e-sushi I don't think this is a reference request. It's asking for for clarification of certain concepts used in a notable paper. It's limited in scope and doesn't lead to link-only answers. So I consider it on topic.
Jul
20
comment How difficult is it to find the “pre-image” of a block cipher?
@samoz If $M_2$ isn't fixed then Thomas' suggestion works for every key.
Jul
20
comment Is HMAC-MD5 considered secure?
Collisions are irrelevant in typical MAC usage scenarios.
Jul
19
comment Generating a secure random number in javascript
Using strong crypto in the RNG is the easy part. The real problem is entropy gathering. Which sources to use, and how to estimate the entropy. One really common issue is allowing consumers to read from the PRNG before enough initial entropy has been gathered.
Jul
19
comment Jumblar: Using map locations as passwords
The entropy contained in a single location is pretty low, so the generated password might be weak.
Jul
17
comment AES 256 Encryption - Is it really easy to decrypt if you have the key?
@bhs Then get out a time machine and travel back a few centuries. It is a core principle of modern crypto that it must be secure if the attacker knows everything about the scheme, except the key.
Jul
17
comment How can scrypt be improved to counter GPU mining
One can simply adjust the memory use parameter of scrypt. Litecoin chose a really small amount of memory. It's also possible to design a new scheme that doesn't allow certain time-memory trade-offs the GPU implementation takes advantage of.
Jul
16
comment Birthday Attack
That 2H looks weird. Shouldn't that be in the denominator?
Jul
16
comment Generating a secure random number in javascript
Your approach is certainly much worse than hashing all the raw entropy with SHA-2 and then expanding it to the desired size.
Jul
16
comment Generating a secure random number in javascript
See Generate cryptographically strong pseudorandom numbers in Javascript? on security.SE
Jul
15
comment How can Alice prove that a message has not been tampered with?
What do you mean by privileges? Can Bob use the message to claim some privileges from Carol? In that case a simple digital signature should do the trick. Bob can modify the message, but carol won't accept it.
Jul
15
comment Primality testing (deterministic vs. non-deterministic)
On real hardware all algorithms are probabilistic and something like $2^{-200}$ is certainly smaller than the probability of your hardware messing up the computation. So deterministic algorithms don't really offer a practical advantage.
Jul
15
comment Primality testing (deterministic vs. non-deterministic)
It'd be useful to add a column that states the probability of being wrong.
Jul
14
comment How does NaCL Poly1305 implementation do modular multiplication?
When you reduce $x \cdot 2^{130}$ modulo $2^{130}-5$ you get $5\cdot x$. When you reduce $x \cdot 2^{136} = x \cdot {256}^{17}$ modulo $2^{130}-5$ you get $320\cdot x$.
Jul
14
comment How does NaCL Poly1305 implementation do modular multiplication?
There are Floodyberry's implementations. The poly1305-donna-unrolled variant can be easily ported to other languages. I'm working on one as well, but I'm not finished yet.
Jul
14
comment How does NaCL Poly1305 implementation do modular multiplication?
It's funny that this implementation is used so often, given its bad performance.
Jul
14
comment Technical feasibility of decrypting https by replacing the computer's PRNG
@Thomas I heard that Linux uses RdRand directly in some places instead of just mixing it into the pool. In that case you don't need to poison the entropy pool.
Jul
13
comment What is the purpose of update() in popular hash APIs?
Which requires putting the full message into a continuous piece of address space. So it needs unnecessary copying in some cases and doesn't fit at all for large inputs. With an update() based API I can easily hash a multi gigabyte file on a modest computer.
Jul
13
comment Efficient Incremental Updates to Large Merkle Tree
You can choose until which level you keep the tree. If you keep less of the tree updates become more expensive, but you need less memory.