9,467 reputation
12346
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years
seen yesterday

Sep
10
comment Should new applications still use RSA? Is it worth going down the ECDH route for protocols?
No, there is no code for Noise, and the code of CurveCP isn't production ready. I only posted them as examples of protocols which only use DH + symmetric encryption.
Sep
10
comment Could RDRAND (Intel) compromise entropy?
But I agree with Dale Emmon's comment that it should be mixed in through the hash and not xor-ed into the output.
Sep
10
comment Could RDRAND (Intel) compromise entropy?
If the PRNG doesn't suck, it doesn't cause any security issues to mix in attacker controlled input.
Sep
10
comment Security of (cryptographic) padding compared to other methods for blockcompletion for block ciphers
HMAC-SHA-2, not plain SHA-2. And it's essential that you compute the MAC over the whole ciphertext (including IV and padding) and not over the plaintext. So you verify the MAC before you decrypt, not after. Another issue is that you need a constant time comparison function for the MAC verification, else you're open to timing attacks.
Sep
10
comment Should new applications still use RSA? Is it worth going down the ECDH route for protocols?
There weren't any breakthroughs regarding RSA and discrete prime characteristic finite fields. The recent breakthroughs were against small characteristic finite fields, in particular binary fields.
Sep
10
comment Relation between key size and PRNG state size
@nightcracker Generating an RSA 1024 key from a 128 bit seed is completely fine. For 4096 bit RSA I'd use a 256 bit seeds.
Sep
10
comment Relation between key size and PRNG state size
I'd use a pool size twice the security level to avoid collisions during the one-way function step. The trickier part are the additional accumulator pools a fortuna like construction needs.
Sep
10
comment Who uses Dual_EC_DRBG?
Are there some more detailed descriptions of how the Vista+ CSPRNG works? When I last looked, I only found a description of the old XP CSPRNG.
Sep
10
comment Should new applications still use RSA? Is it worth going down the ECDH route for protocols?
As an inspiration of what can be done with ECDH + symmetric encryption, check out CurveCP and Noise. CurveCP is a bit simpler, but has some minor flaws. An interesting article, inspired by these protocols is Moxie's Simplifying OTR deniability
Sep
10
comment Should new applications still use RSA? Is it worth going down the ECDH route for protocols?
Personally I use ECC for almost everything, ECDH for key-exchange and authentication, EdDSA for third-party verifiable signatures.
Sep
9
comment Security of (cryptographic) padding compared to other methods for blockcompletion for block ciphers
If you verify the MAC before you start decrypting, then any message the attacker has modified (a prerequisite of a padding-oracle attack) won't reach the cipher. So a secure MAC prevents all active attacks against the encryption scheme.
Sep
9
comment Security of (cryptographic) padding compared to other methods for blockcompletion for block ciphers
To prevent oracle attacks, you should add a MAC using an encrypt-then-mac scheme. Most unauthenticated encryption schemes suffer from some kind of active attack, a padding oracle is just the most famous.
Sep
9
comment What NIST protocol was allegedly backdoored by NSA in 2006?
While that's an obvious candidate for a rigged standard, it's not completely clear if it's the standard the article was talking about.
Sep
9
comment What NIST protocol was allegedly backdoored by NSA in 2006?
Somebody claiming to be John Kelsey of NIST says that NSA did not write SP 800-90.
Sep
9
comment Should we trust the NIST-recommended ECC parameters?
Since the seed isn't short (why???) the creator could have tried many curves (say $2^{70}$) in hopes of finding a weak one. So the question is if there is a significant fraction of $b$ values for which the curve is weak, and the NSA knew about that weakness back when the parameters were generated.
Sep
8
comment Distributed Asymmetric Key Decryption with threshold
No idea if anybody wrote a paper about it. It's just a straight forward and useful combination of asymmetric encryption and shamir secret sharing. I came up with it myself and I expect many others to have done so before me.
Sep
8
comment Known-plaintext attack on Blowfish in ECB mode
Brute-forcing a 40 bit key in 60 seconds on a CPU sounds unrealistically fast, especially since Blowfish has a rather slow key-setup. I would have expected several hours at minimum.
Sep
8
comment Is the “secure-as-worst-case” version of NTRU patented?
As a side-note: The proof is asymptotic and thus of limited value for practical key-sizes.
Sep
6
comment Is javascript RSA signing safe?
I'm suggestion that without SSL everything else you do is meaningless since an attacker can simply replace the html file. Whatever you choose to do should be on top of SSL.
Sep
6
comment Is javascript RSA signing safe?
It still matters if your website was loaded over SSL (i.e. uses HTTPS) and if the web sockets run over SSL.