9,417 reputation
12345
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years
seen 8 hours ago

May
9
comment Point addition and doubling in Ed25519 (ref10)?
Is your code publicly available?
May
9
comment Point addition and doubling in Ed25519 (ref10)?
If you only need one coordinate of the output, you can convert to montgomery form, compute the scalar multiplication and convert back. You only need your approach if you need both coordinates.
May
9
comment Point addition and doubling in Ed25519 (ref10)?
Why do you want to avoid the conversion to Montgomery for DH? It's a bit slower than using (Y/Z) coordinates in Edwards form due to an additional field inversion, but almost certainly faster than what you're attempting to build. Conversion back to edwards at the end of the scalar multiplication is free, but I didn't do so for compatibility with existing Curve25519 shared secrets.
May
8
comment Decrypt a public encrypted message and Sign a signature, how the math is different?
With RSA you generally use different padding. With other schemes encryption and signing usually have very little in common.
May
7
comment Cryptodefense ransom use RSA-2048. Any chance with known plaintext attack?
You have no chance if the malware has been implemented properly.
May
7
comment ECC partially blind signature scheme verification
I'd consider using RSA based blind signatures. It's simple, robust and supports tons of additional features. The main downsides are the lower performance and larger signatures.
May
6
comment Is knowing the private key of RSA equivalent to the factorization of $N$?
If you know $e$, $d$ and $n$, you can efficiently factor $n$. Just knowing $d$ is not enough if $e$ is big.
May
5
comment Does Microsoft use Dual_EC_DRBG by default?
According to wikipedia you introduced DUAL_EC_DRBG in Windows Vista, but your post doesn't mention Vista and Server 2008. What's their status regarding DUAL_EC? Sorry for nitpicking, but I read a few too many carefully worded denials recently. According to imichaelmiers's answer there was a change in the default in a Service Pack for Vista, with both versions (Hash and AES-CTR) considered safe.
May
5
comment Mapping integers to Ed25519 and back again?
You might want to take a look at Elligator 2, but it has some limitations.
May
2
comment Back up an information as $n$ pieces and require exactly $n-1$ to recover it
Search for "erasure coding" and "secret sharing"
May
2
comment Can 64-bit “PRINCEcore” practically be brute forced?
Once you're over the initial development cost of custom hardware, this isn't very expensive. I think it's about as much work as mining a single bitcoin block at the current difficult. Or differently said, it would take the current bitcoin mining network only a few minutes. Should be 10k USD or something of that magnitude.
May
2
comment Why should I use an Initialization Vector (IV) when I have unique keys?
It's more of a multi-target pre-image attack rather than a collision attack. Personally I'd only bother with IVs when they key has "only" 128 bits. For 256 bit keys even those multi target attacks are too far out of reach.
May
1
comment Does not using padding mean a lack of security?
There are two kinds of padding: 1) Padding required by the mode of operation (for CBC but not CTR) 2) Padding that aims to make traffic analysis harder. These kinds of padding should not be confused.
May
1
comment Accelerated hashing on consumer-grade CPU?
Are you hashing many short messages, or few long ones? In the latter case you must use a tree hash to have any hope of parallelization.
Apr
30
comment Why must IV be sent with each packet?
You need a new IV for each message. You can't reuse the last block of the previous message. Doing that caused the BEAST attack against SSL. The assumption behind CBC's chaining is that an attacker can't see part of the ciphertext and then influence later plaintext.
Apr
30
comment How do you test the security of your cipher?
Depends a lot on what you mean by cipher. You mix concerns touching primitives, modes of operation and implementation. Each of these is tested completely differently. Primitives need lots of analysis by as many experts as possible. Modes of operation ideally feature a security proof. Implementations mainly need to avoid side channels and need to match official test vectors.
Apr
30
comment Why must IV be sent with each packet?
The IV must be different for each message. If you can use an implicit IV, such as a counter you don't need to send it explicitly. (At least with a mode that only needs unique IVs like CTR. For random IVs as in CBC you need some modifications, but in principle this is still possible)
Apr
29
comment How to implement a Cryptographic Pseudo Random Function
I prefer a two phase function: 1) Extract - Hash the seed and the input to a fixed size (say 256 bits) 2) Expand - Use a stream cipher to expand that key to whatever size you want. | You can use HKDF for this.
Apr
29
comment How to argue to a paranoid that RSA is safe?
There is little to argue beyond "many bright mathematicians tried to break it and nobody in published an attack faster than GNFS"
Apr
29
comment Pseudocode for constant time modular exponentiation
@fgrieu GnuPG used the naive if e[i] then c *= M until 2013. This enables cross VM attacks: eprint.iacr.org/2013/448