Reputation
Next tag badge:
97/100 score
18/20 answers
Badges
1 25 57
Newest
 Informed
Impact
~181k people reached

Mar
16
comment Reusing a one-time pad?
Since ARM Cortex M0 is a 32 bit processor and supports addition, rotation and xor, it should even be able to efficiently run ChaCha (possibly reduced to 8 or 12 rounds).
Mar
16
comment Reusing a one-time pad?
@Muis Which cipher is cheapest depends on the hardware. I expect RC4 to be reasonably fast on most small CPUs, as long as you can afford the RAM to keep its state. It also has a relatively expensive key setup, especially if you drop the first 1000 bytes (which I strongly recommend), but that doesn't matter for a large file.
Mar
16
comment Reusing a one-time pad?
The OP is suggesting something similar to a Vigenère encryption, not Caesar.
Mar
16
comment Reusing a one-time pad?
If you don't need a lot of security, you could try RC4. It shouldn't need a lot of CPU, but it needs about 300 bytes of RAM for its state. Drop the first 1000 or so bytes of output to avoid the worst biases. There is also a whole field of lightweight cryptography, but I'm can't recommend any particular algorithm.
Mar
16
comment Reusing a one-time pad?
"I have an embedded device."
Mar
14
comment Block cipher mode with diffusion on ciphertext
But trying to use this as a MAC doesn't work - for example truncation attacks are trivial in a known-plaintext scenario.
Mar
13
comment Block cipher mode with diffusion on ciphertext
Why do you need this property?
Mar
13
comment Why are twofish or other algorithms not NIST approved, are they still safe?
NIST simply chose a single candidate (rijndael) to become AES. This was about standardizing one secure choice, not about allowing all secure choices. 3DES and skipjack are only there for legacy support.
Mar
12
comment Workaround to implementing Forward Secrecy
You might want to clarify the second paragraph a bit. The diffie-hellman part of ECDHE is faster than RSA. It's only ECDHE_RSA which involves an RSA signature in addition to ECDHE that it gets slower than plain RSA. With ECDHE_ECDSA you should be even faster than plain RSA.
Mar
12
comment Why are modes of operation used, what attacks do they prevent?
Without a mode of operation you can only deterministically encrypt exactly 16 bytes.
Mar
11
comment Workaround to implementing Forward Secrecy
If the certificates use a new private key each time and you erase the old private key (tricky), you get a weak form of forward secrecy. If you create a new certificate with the same private key you get no forward secrecy at all.
Mar
11
comment What is the probability of finding 4 equal bytes?
I'm voting to close this question as off-topic because this is a basic math question, not a crypto question.
Mar
9
comment AES-128/192 safer than AES-256 in practice?
@ThomasM.DuBuisson But do they use primitives designed as PRP/PRF for that? Of course there are primitives that work fine with related keys, in particular most constructions build from cryptographic hashes.
Mar
9
comment AES-128/192 safer than AES-256 in practice?
No they're not. A well designed protocol uses uniformly distributed (pseudo) random keys. So related-key attacks only affect protocols that abused AES.
Mar
7
comment Can IGE mode be parallelized?
Any reason why you'd use IGE?
Mar
7
comment Separate keys for encryption and MAC?
It's bad style, but unless your MAC and your cipher are based on the same primitive it's unlikely to lead to practical weaknesses. See Why can't I use the same key for encryption and MAC? on security.se.
Mar
5
comment Is the half-homomorphic property of RSA a problem for blind RSA signatures?
As long as you use a good padding scheme (full-domain-hash is simple and strong) it shouldn't be possible to obtain more than one padded message for which you know the pre-image per signing query.
Mar
5
comment Multiple encryption of part of block
@Nova The description is a bit unclear, but I assumed that Block 4 uses the first few bytes from the ciphertext not from the plaintext, since else the whole scheme wouldn't make sense.
Mar
5
comment Multiple encryption of part of block
@Nova How is it not ciphertext stealing?
Mar
4
comment Is CBC theoretically harder to brute force when compared with ECB?
@IlmariKaronen Yes, I'm taking about an attacker learning the same message encrypted with different keys and is happy if they break some of them. Trevor Perrin's noise protocol is a particularly severe example, since it uses a different key for each message, but obtaining one key allows you to compute all following keys.