Reputation
11,556
Next tag badge:
97/100 score
18/20 answers
Badges
1 25 57
Newest
 Informed
Impact
~188k people reached

Apr
20
comment DHKE choice of private keys
If you forbid $p-1$, shouldn't you also forbid $(p-1)/2$?
Apr
20
comment Is it ever unsafe to compress an EC point?
@poncho Curve25519 has $p \equiv 5 \pmod 8$. P-224 has $p \equiv 1 \pmod 4$. But there are efficient algorithms for computer square-roots in both of those fields.
Apr
20
comment Is there any patent free EC point compression available? If not, should I GPL/LGPL my code?
(Twisted) Edwards form point compression shouldn't be covered by a patent, but you can't use it for the NIST curves.
Apr
18
comment Why does applying 56-bit DES twice only give 57 bits of security?
Note that an actual attacker wouldn't create a table with $2^{56}$. They'd use distinguished points/cycle finding to reduce the memory use.
Apr
18
comment Why is triple-DES using three different keys vulnerable to a meet-in-the-middle-attack?
@MichaelKjörling Yes. If you use random keys, 3-key 3DES is at least as strong as 2-key 3DES, but it doesn't provide the 168 bits of security we'd expect from an ideal 168 bit cipher. MitM has nearly the same cost against both 2-key and 3-key 3DES. But since "attack" is often defined as "faster than brute-force" and brute-force is slower with a 168 bit key, MitM now counts as an attack. (If you'd allow related-key attacks the 3-key variant would probably end up worse, but related keys are not applicable to well designed protocols, so I didn't mention that in my answer.)
Apr
16
comment Is this a good entropy collector and whitening technique?
What would you use as key for CBC-MAC? In practice a fixed public key should be fine, but means you can't reduce your security to AES being a PRP.
Apr
16
comment RSA modulus (N) from public key and calculating N from p, q not equal
Endianness or sign bits are two common error sources.
Apr
14
comment Are there equivalent IVs in DES/CBC?
The first block (8 bytes) should differ if you use another IV.
Apr
14
comment Weaker alternative to Ed25519?
@Chris Why use crypto at all, if its extremely weak? 56 bits of security is rather dubious. You should rather figure out how to comply with the export regulations of your country. Some countries (like Germany) don't care at all. In the US you need to jump through a couple of bureaucratic hoops, but shouldn't be too difficult.
Apr
12
comment CTR_DRBG versus OFB_DRBG
Since AES is a pseudo-random-permutation not a pseudo-random-function, you can't apply the birthday problem and the average cycle length is $2^{127}$ not $2^{64}$.
Apr
12
comment CTR_DRBG versus OFB_DRBG
Average cycle length of AES-OFB is expected to be $2^{127}$, too big to matter in practice.
Apr
12
comment AES-XTS: find key from ciphertext and plaintext
There is no known efficient key-recovery attack against AES, no matter the mode of operation.
Apr
12
comment AES file encryption with PBKDF2. Safe parameters?
I'd stay with PBKDF2, bcrypt and scrypt for several more years. I don't consider the review the candidates received during the PHC competition sufficient to be really confident in their security.
Apr
12
comment Use cases for “online” authenticated encryption?
If you encrypt a movie, you should split the file into segments and authenticate them. It's a bad idea to release unauthenticated data to your video player. Why use authenticated encryption if you don't verify the tag until it's too late?
Apr
12
comment Randomness in generation of Virtual Machines from pre-built Image
It's a general security question, not a cryptography question. It might fit security.se.
Apr
9
comment Is it possible to combine true streaming with AEAD?
Splitting the message into segments and authenticating each segment separately is the standard approach.
Apr
7
comment Salsa20-GCM composition secure?
Strictly speaking GCM has been defined using a 128 bit block cipher, but it's easy to generalize it to any stream cipher that takes a nonce and it's be secure that way. But I see little reason to do so, since GCM only works well if you have specialized instructions, which are typically only available on CPUs which can also accelerate AES.
Apr
3
comment How to encypt/decrypt messages after ECDH key agreement
Why did you tag this with PQ-crypto? Diffie-Hellman is not PQ secure, neither on finite fields, not on elliptic curves.
Apr
3
comment Required key size for an ideal cipher with a 32 bit block size
@fgrieu A 16 GiB lookup table could fit into RAM and should have acceptable performance. Efficient key expansion from a minimal-size key minimal size key might be a bit trickier though.
Apr
2
comment Will there always be 256 collisions for the output of the MD5 hashsum function for 17-byte inputs?
@coder543 The whole bitcoin miner network computes around $2^{80}$ SHA256d hashes per year (burning several hundred million USD on hardware and electricity). While MD5 is a slightly cheaper than that, it'd still take it several trillion years to compute $2^{128}$ MD5 hashes.