10,054 reputation
12451
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 4 months
seen 2 hours ago

Oct
29
comment Deterministic nonces in CTR mode
One problem with constant IV is that it enables multi-target attacks. When using AES-128 an attacker you can break all messages encrypted with this scheme with $2^{128}$ work and break one random message cost only $2^{128}/t$ for $t$ known ciphertext. So I'd avoid constant IVs with 128 bit keys, but 256 bit keys it doesn't really matter.
Oct
28
comment Definition of a CSPRNG
If an application wants to offer forward secrecy it needs a PRNG that can't be run backwards.
Oct
26
comment The weak link is the password?
For password based encryption the password is usually the weakest link. It's one of the reasons for avoiding passwords as much as possible.
Oct
26
comment Timing Attacks on ECDSA, ECDHE, AES and SHA2
I'd expect typical implementations of SHA-2 to resist timing attakcs, but naive implementations of all others should suffer from timing attacks. What's tricky is figuring out in which situations they're practical and in which they are not.
Oct
25
comment RSA with modulus product of many primes
A related question: Are there any standards of multi-prime RSA key generation? and AGL's blog post about how security and performance scale with the number of primes
Oct
25
comment RSA with modulus product of many primes
You can use multiple primes as long as they're large enough. It gives you less security for a given modulus size, but it can give you a better performance/security trade-off.
Oct
24
comment Knowing pre-encryption data, can we find the private key CryptoLocker used?
No, if they implemented asymmetric encryption properly, such attacks are not possible.
Oct
24
comment RSA decrypt long messages (javascript)
Please don't cross-post
Oct
24
comment RSA decrypt long messages (javascript)
Your formatting problem was that you attempted to use LaTeX ($$) formatting instead of code formatting (indent by four spaces).
Oct
23
comment Is there a “brainwallet” for GPG keys?
@ralu The coding part is easy. Typical password quality is a problem, especially since you can't use salts.
Oct
23
comment Having 4096 bit keys and short (< 256 byte) messages, can I simply use the key as OTP?
1) You still need a MAC, luckily for you polynomial MACs are provably secure (with a certain probability of not detecting the error which is independent of attackers computation resources) 2) The problem with OTP is exchanging those keys and that you need state to ensure that you never reuse a key.
Oct
23
comment Is there a “brainwallet” for GPG keys?
Same problem as for all password based encryption, except a bit worse since it's not possible to use salts. So whenever practical, encrypt your private key with the password instead of using a password as seed.
Oct
23
comment Open source implementations of Symmetric Searchable Encryption and Order Preserving Encryption
1) These kinds of encryption are inherently weak 2) Take a look at CryptDB
Oct
23
comment Can I use the ChaCha core as a 256-bit to 256-bit one-way function?
@nightcracker For the one-way function part, yes. But you'll also need a collision resistant hash for the message.
Oct
23
comment Can I safely replace XOR with ADD in a stream cipher?
@HannoBinder If your stream cipher is so broken that this makes a difference, run.
Oct
23
comment Can I use the ChaCha core as a 256-bit to 256-bit one-way function?
@RickyDemer I don't know much about that, but DJB emphasized that Salsa20 is designed as a cipher, not as a collision resistant hash. He even renamed the core from "hash" to "core" to avoid misunderstandings. "The Salsa20 core does not compress and is not collision-resistant."
Oct
23
comment In RSA, what is faster attacking “d” when plaintext is known, or factoring when M is unknown?
1) Any native brute-force is ridiculously more expensive than sieving based attack. You can't even brute-force RSA-256 2) Why do you say "no plaintext available"? Since RSA is asymmetric, an attacker can produce as many plaintext/ciphertext pair as they like.
Oct
23
comment Can I use the ChaCha core as a 256-bit to 256-bit one-way function?
If you only need one-way-ness / first pre-image resistance, you should be fine, since that maps directly to a key recovery attack on ChaCha. If you need collision resistance, don't use it.
Oct
23
comment MARS and RC6 in CUDA
As a side-note: You should target ATI CPUs as well, those usually have higher performance for crypto.
Oct
22
comment What block cipher is used for CBC-MAC?
CBC-MAC is fine with variable length messages, as long as you never have one message that's a prefix of another. For example a length prefix can achieve that if you know the length of the message beforehand.