Reputation
12,269
Next tag badge:
90/100 score
20/20 answers
Badges
1 31 61
Newest
 Enlightened
Impact
~211k people reached

Mar
19
comment Does a dynamic accumulator exist yet?
@DrLecter You still need a trusted party who promises to forget the factorization. While you can generate RSA moduli without knowing their factorization they're very big.
Mar
18
comment What is the importance of the $r$ and $c$ values for the Sponge Construction?
C=128 has a security level of 64 bits against certain attacks, but the output size is still unlimited.
Mar
18
comment Elliptic Curves of different forms
If you assume that the weierstrass implementation is safe, you only lose performance. Rigidness is the only property that directly relates to the security of the curve, all the other safety properties are about making it easier to write a fast and secure implementation. For example BouncyCastle C# is neither fast nor secure.
Mar
18
comment Is this a secure (and correct) sign-then-encrypt technique for transferring messages?
RSA is very fast for encryption and signature verification (public key operations) and slow for decryption and signing (private key operations). ECC has decent performance for all operations. If you sum the cost of encryption and decryption, RSA is certainly much slower than than its ECC equivalent (by a factor 10 or so).
Mar
18
comment Is this a secure (and correct) sign-then-encrypt technique for transferring messages?
IMO it's a silly design. 1280 bit RSA sucks for confidentiality but might be good enough for authentication. ECDSA on the other hand is trickier to use than RSA encryption, since it needs good randomness for each signature (unless you use an uncommon deterministic variant). Using EC-DH (256 bit) for key-exchange (and thus encryption) and RSA for signing would be a far better choice. Or just one algorithm for both.
Mar
18
comment Is the term “Elliptic Curve Discrete Logarithm Problem” a misnomer?
Mathematicians don't care how you call the basic operation. We commonly call it addition, but calling it multiplication is just as valid.
Mar
18
comment How do the following new (2013) ECC curves compare in security or efficiency?
The larger the curves the slower (but stronger) they are.
Mar
17
comment Is this an acceptable implementation of ARC4 encryption for my system?
@traxonja If you want authentication and encryption you could consider AES-CCM.
Mar
16
comment Elliptic Curves of different forms
Why do you want to use a montgomery/edwards curve if you then proceed to perform weierstrass form operations on them? To take advantage of montgomery form you need to use differential addition with an appropriate ladder. The whole point of supporting montgomery ladders is that you use them.
Mar
13
comment Which eliptic curves in OpenSSL 1.0.1f meet all / most of the SafeCurves requirements?
Apart from rigidness those "weaknesses" are features of montgomery/edwards curves. Those features don't gain you anything if you use weierstrass form in your implementation.
Mar
13
comment Are there use cases where a signature itself needs to be signed?
@JohannesErnst I'd rather encapsulate it, like {data={...}, sigs=[{sig1}, {sig2}]}. If one signature needs to be signed, the outer signature can encapsulate the previous one, else add them to the array.
Mar
13
comment Are there use cases where a signature itself needs to be signed?
You should take a look at JSON Web Signature (JWS). I didn't read it myself, so I can't vouch for its quality.
Mar
13
comment counter to indicate hotp count
@RichieFrame Shouldn't matter.
Mar
13
comment How do I convert the definition of E-521 into a curve definition a la Bouncy Castle?
I'd rather start with a Curve25519/Ed25519 and replace the field arithmetic operations. Converting to weierstrass misses the point of edwards/montgomery curves. Montgomery addition is differential, so you can't simply reuse the BC code for weierstrass scalar multiplication. Finding a $F_{521}$ implementation shouldn't be too hard, considering it's also used in NIST-P521.
Mar
13
comment How does the key size per data bit influence the security?
@Marste 1) TLS in its typical use doesn't bother changing the key during the lifetime of a connection 2) Changing the key within a connection strengthens forward secrecy 3) More samples don't help brute-force, but might aid cryptoanalysis. There is also a block size dependent limit, which is only a couple of GB for 64 bit blocks. Older protocols worry about these issues since we didn't have AES yet. Nowadays it's less of a concern.
Mar
12
comment How do I convert the definition of E-521 into a curve definition a la Bouncy Castle?
I suspect this library only supports weierstrass form, so you'd need to either convert (bad idea IMO) or implement a custom EccPoint class with edwards arithmetic. But last time I checked BC C# had quite bas ECC implementations. Not resistant to side channel attacks and slow as hell (using affine coordinates).
Mar
12
comment How do I convert the definition of E-521 into a curve definition a la Bouncy Castle?
FpCurve is for prime fields, F2mCurve for binary fields. This field is prime, so you need to choose FpCurve.
Mar
11
comment Is there a flaw in whole disk encryption vs volume or folder encryption?
Yes, you're wrong. Modern cryptography doesn't allow an attacker to learn the key given (plaintext, ciphertext) pairs. This is a "known plaintext" attack.
Mar
10
comment I need a 64-bit cryptographic hash for 96 bits of data
But you can't really get "very high" collision resistance with a 64 bit hash. For example if you have 4 billion entries, collisions become likely, but you can't neglect them with only a few million entries.
Mar
10
comment I need a 64-bit cryptographic hash for 96 bits of data
Just take the first 64 bits of SHA-256 output. It's as good as 64 bit hashes get.