9,824 reputation
12450
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 3 months
seen 10 mins ago

Aug
21
comment Is this a plausible PBKDF?
@esushi? Why KBKDF? This is clearly password based, not key based.
Aug
21
comment ECC cryptography with shorter signature when not needing high security?
The shortest usable signatures I know are BLS at twice the security level in size. You can truncate a few bits, raising the verification cost exponentially. Even if you'd use a 112 bit curve (which matches the largest academic ECDL break) this only goes down to about 90 bits.
Aug
21
comment Is this a plausible PBKDF?
Please include a compact description using mathematical notation or pseudo code instead of long c code full of unnecessary details.
Aug
20
comment Recover plaintext from truncated ciphertext using AES for FPE
Ending up with the ciphertext equaling the plaintext is not a problem. The probability for that is 1 in 10^19.
Aug
20
comment Recover plaintext from truncated ciphertext using AES for FPE
Read the Feistel network article I linked.
Aug
20
comment Recover plaintext from truncated ciphertext using AES for FPE
You might want to take a look at FFX mode which uses a pretty similar principl.
Aug
20
comment Recover plaintext from truncated ciphertext using AES for FPE
Truncation is not reversible. These truncated values are only used in the Feistel network. The feistel network ensures reversibility even when using a non reversible function.
Aug
20
comment Regular MACs vs Carter-Wegman MAC
WC style MACs need a nonce and leak the key if you ever reuse one.
Aug
20
comment Regular MACs vs Carter-Wegman MAC
AES-GCM is becoming pretty common. Salsa20/ChaChaPoly1305 are are used occasionally as well.
Aug
20
comment A patched SHA1 attempt for password verification
Unsalted SHA-1 is just as crappy a password hash as MD5.
Aug
20
comment A patched SHA1 attempt for password verification
Just send the password in plaintext (over HTTPS/SSL/TLS) to the server and use a proper password hash on the server. It's the job of TLS to protect data in transit, don't try to invent your own crappy hashing scheme instead.
Aug
19
comment What's the advantage of using OFB/CFB/CTR modes over a stream cipher
CTR has one big advantage: It allows random access
Aug
19
comment Parallel variant of Carter-Wegman MAC with incremental property
You can always interleave several MACs
Aug
13
comment Is it possible to find plaintext from ciphertext if (n) and (a) are known for RSA?
@user3728778 Boneh wrote a paper listing most know attacks on RSA
Aug
13
comment Is it possible to find plaintext from ciphertext if (n) and (a) are known for RSA?
Your claim that these are the easiest way of breaking RSA.
Aug
13
comment Is it possible to find plaintext from ciphertext if (n) and (a) are known for RSA?
Note that this only applies to properly padded RSA. Textbook RSA has weaknesses a plenty.
Aug
12
comment Is XORing a SHA256 better than truncating it?
1) Just take the first 16 bytes. Simple and secure if SHA256 is. 2) Any unkeyed 128 bit hash has at most 64 bits of collision resistance. That's generally not considered secure. Either increase the size or introduce a key not known to the attacker (using HMAC-SHA-2).
Aug
12
comment Is XORing a SHA256 better than truncating it?
1) Using a cryptographic hash doesn't gain anything if SHA256 is already a secure hash 2) Length extensions are not applicable and don't work if you truncate the output of SHA256 to 128 bits.
Aug
12
comment Security issues of a MAC-then-Encrypt-then-MAC approach?
I don't think "plaintext integrity" is useful in the context of of MACs since a mismatch between MAC and cipher key can only happen if you messed up your protocol. I'd only use a similar approach if the inner authentication is a signature, not a MAC.
Aug
12
comment Hash or compression function in Merkle tree nodes?
In principle you can use compression functions if you know what you're doing. But the devil is in the details. Skein and Blake2 only pad to a full block, never adding an additional compression.