9,761 reputation
12448
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 2 months
seen 39 mins ago

Aug
19
comment Parallel variant of Carter-Wegman MAC with incremental property
You can always interleave several MACs
Aug
13
comment Is it possible to find plaintext from ciphertext if (n) and (a) are known for RSA?
@user3728778 Boneh wrote a paper listing most know attacks on RSA
Aug
13
comment Is it possible to find plaintext from ciphertext if (n) and (a) are known for RSA?
Your claim that these are the easiest way of breaking RSA.
Aug
13
comment Is it possible to find plaintext from ciphertext if (n) and (a) are known for RSA?
Note that this only applies to properly padded RSA. Textbook RSA has weaknesses a plenty.
Aug
12
comment Is XORing a SHA256 better than truncating it?
1) Just take the first 16 bytes. Simple and secure if SHA256 is. 2) Any unkeyed 128 bit hash has at most 64 bits of collision resistance. That's generally not considered secure. Either increase the size or introduce a key not known to the attacker (using HMAC-SHA-2).
Aug
12
comment Is XORing a SHA256 better than truncating it?
1) Using a cryptographic hash doesn't gain anything if SHA256 is already a secure hash 2) Length extensions are not applicable and don't work if you truncate the output of SHA256 to 128 bits.
Aug
12
comment Security issues of a MAC-then-Encrypt-then-MAC approach?
I don't think "plaintext integrity" is useful in the context of of MACs since a mismatch between MAC and cipher key can only happen if you messed up your protocol. I'd only use a similar approach if the inner authentication is a signature, not a MAC.
Aug
12
comment Hash or compression function in Merkle tree nodes?
In principle you can use compression functions if you know what you're doing. But the devil is in the details. Skein and Blake2 only pad to a full block, never adding an additional compression.
Aug
12
comment CTR mode encryption using PRG
Using Salsa20Core in CTR mode certainly results in a secure stream cipher -- that's precisely the way Salsa20 is defined in the first place.
Aug
12
comment Are there any cryptographic flaws in my webhook signing process?
Why sign webhooks at all? I prefer a pattern where the recipient doesn't assume that the webhook is authentic and simply uses it as a trigger to fetch the relevant information. That fetch is authenticated and protected against replay attacks since it uses HTTPS with your server as target.
Aug
11
comment Computational Complexity - When is it really exponential time?
You wrote $n=2^{log_2 n}$ which makes no sense. DL has polynomial cost in the order of the group and exponential cost in the bitlength of the group order. If you want to be precise you can't say "this algorithm has exponential cost", you need to specify in which variable it is exponential. Colloquially we omit that specification if everybody knows which variable we're talking about.
Aug
11
comment Computational Complexity - When is it really exponential time?
You can't use $n$ to refer both the order of the group and its bitlength. Rename one of them, e.g. use $n = \log_2 N$
Aug
10
comment Help deciphering caesar cipher
1) Define the alphabet as string and use the indexOf function to simplify your code. 2) You can use a for loop for the rotation 3) Use alphabet.length instead of hardcoding the 27.
Aug
10
comment Streaming mode of operation that is more resistant against nonce reuse
A blockcipher in CFB mode only leaks the xor of the first block that differs and not the xor of the whole message. I think keccak's duplex mode has similar properties.
Aug
8
comment Implementation and Testing of SRP-6a
@Andrey Slow hashes have the same purpose as with any other protocol - to protect the passwords if the database containing the hashes leaks.
Aug
8
comment Implementation and Testing of SRP-6a
Note that both SHA-1 and SHA-2 are bad as password hashes even when used in SRP (since they're fast). The modular exponentiation improves the situation somewhat since it's not as cheap as SHA1/2, but it's still cheaper than a proper password hash.
Aug
5
comment Homogenous and heterogeneous Unbalanced Feistel Networks
One advantage of simple algorithms is that analyzing them is less work.
Aug
5
comment ECDSA with SHA256 and sepc192r1 curve: Impossible, or how to calculate $e$?
@Christian The security level is limited to half the curve size. So with a 192 bit curve you get 96 bits of security. This is still infeasible to break, but you should consider upgrading to a 224 or 256 bit curve.
Aug
5
comment Interleaving bytes to make an effectively larger block size
There are simple techniques to construct wide PRPs which are much faster than this and provably secure (reducing to the security of AES). So there is no reason to use your construction in practice.
Aug
5
comment Interleaving bytes to make an effectively larger block size
Looks very similar to the way the block-cipher underlying BLAKE works (it uses a 4x4 matrix of 32/64 bit words, not a 16x16 matrix of 8 bit words), so I believe it's possible to construct a secure cipher that way. But BLAKE has about 20 cheap rounds, not 3 expensive rounds. I have doubts that 3 rounds are enough, even with a secure PRP as building block.