8,789 reputation
12041
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 2 years, 9 months
seen yesterday

Jul
5
comment DSA, RSA, ECDSA etc - which one is cheapest for signing?
But I don't really like using signatures for transport encryption since it weakens deniability. I prefer EC-Diffie-Hellman, even though it's more expensive than signing.
Jul
5
comment DSA, RSA, ECDSA etc - which one is cheapest for signing?
ECDSA is rather cheap. Personally I'd go with Ed25519 for signatures, which has a easily available high performance implementations.
Jul
5
comment What is the recommended replacement for MD5?
AFAIK SHA-3 isn't specified yet, if you want to use it now you need to use a Keccak variant that'll be slightly different from the final SHA-3. So I recommend waiting until the SHA-3 standard is actually published.
Jul
4
comment Generate a new public/private key pair for each new message?
@Christian The problems with this one is that key management becomes annoying. That's why protocols with a live connection like SSL or OTR can use similar techniques, for example to obtain forward-secrecy. For store and forward protocols like email it's far more annoying. For example how would you support receiving mails on multiple devices?
Jul
4
comment Generate a new public/private key pair for each new message?
@Shaga It's only hard if you only consider cryptographic attacks. Attackers gaining access to the private key by compromising an endpoint is a practical threat. This includes trojans, police raids, subpoenas,...
Jul
4
comment Fast Salsa20 in java?
Do you have a link to an optimized Salsa20 implementation?
Jul
4
comment Construct a random permutation from a random function?
In the current form it's a purely theoretical problem. If this is based on a practical problem, then my impression is that your approach is misguided, i.e. that you suffer from the XY problem.
Jul
4
comment Hash Family Example
Sounds like you want a keyed hash. A common choice is HMAC-SHA-2(k, m). With SHA-3 it's even easier since it's not subject to length extensions, so SHA-3(k||m) works.
Jul
3
comment Construct a random permutation from a random function?
If this is a practical problem, you should take a step back and describe your actual requirements.
Jul
3
comment Construct a random permutation from a random function?
Since a truncation of a PRF is still a PRF, you can trivially use the above construction where you truncate the PRF to N/2.
Jul
2
comment Using single EC cert/keying material to derive symmetric encryption key (for storage)?
Using asymmetric encryption is rather silly if the target is yourself. It's easier and stronger to use a symmetric secret for that. Can't you derive the P521 private key and the AES key from the same master key? That'd be a strong an clean solution.
Jul
2
comment ECDH VS. DH benchmarking in JAVA
BC uses affine coordinates (at least the implementation I looked at, perhaps it offers multiple), which are really slow for most curves. Optimized implementations should be 10-20 times as fast as BC.
Jul
1
comment How much stronger is RSA-2048 compared to RSA-1024?
@woliveirajr RSA-1024 is far weaker than that. AFAIK it's currently borderline feasible to break it for state level adversaries with a few billion to spend. If it's not breakable now, 10 years from now it should be.
Jul
1
comment What does NSA mean by 'Analyzable'?
The algorithms are similar to existing blockciphers, so cryptographers know how to analyze them. Being easy to analyze them is a good thing, because it becomes less likely that somebody suddenly find a new and much better attack.
Jun
30
comment Block cipher with key longer than block size
Related questions AES Key Length vs Block Length and AES key/ciphertext space sizes
Jun
30
comment Block cipher with key longer than block size
This will likely be the case for some messages (even if the key is a shorter than the block size), but not for all of them. For a good block cipher for any key-pair $k_0 \neq k_1$ almost all messages will encrypt differently.
Jun
30
comment Why use variable p, q, g for Diffie-Hellman?
@RickyDemer Hm? Standard groups are random Schnorr groups. The only difference is that they're used by many people.
Jun
30
comment Why use variable p, q, g for Diffie-Hellman?
IMO fixing the group is a good idea. If I were to use finite-field based DH I'd use a standard group, just like I use standard elliptic curves. There are minor advantages in having your own group, but IMO the added complexity isn't worth it.
Jun
29
comment Quantum resistance of Lamport signatures
Security of lamport signatures reduces to the pre-image resistance of the underlying hash function. The best generic quantum algorithm to find pre-images is grover's algorithm with cost $2^{n/2}$.
Jun
29
comment inverse problem about scalar multiplication on elliptic curve
Solving $Q=np$ for $n$ is the discrete logarithm problem and expensive. Solving for $P$ is cheap (assuming the order of the curve is known).