Reputation
14,430
Next tag badge:
102/100 score
17/20 answers
Badges
1 36 76
Newest
 Nice Answer
Impact
~287k people reached

Mar
15
comment Why is Pearson hash not used as a cryptographic hash?
@poncho Generalized the code to include a first pre-image attack like that.
Mar
15
comment Why is Pearson hash not used as a cryptographic hash?
Such a hash never contains duplicate bytes. That's a distinguisher attack, but it prevented the collision attack I was looking for.
Mar
13
comment Why inversion and multiplication operations are costly in elliptic curves?
On prime fields, an inversion costs over 100 multiplications, so we rarely use more than one inversion (at the end of a scalar multiplication, converting from projective/extended coordinates to affine coordinates). But I think the ratio is much smaller in binary fields, so trade-offs are more interesting there.
Mar
13
comment Why inversion and multiplication operations are costly in elliptic curves?
I'd expect squaring to be counted as a (fraction of) a multiplication. For example, some papers, I read, counted a squaring as 2/3 of a multiplication.
Mar
11
comment Using Counters instead of MAC in CBC mode
CBC decryption propagates an error only to the next block.
Mar
10
comment Fast algorithm for reduction modulo a prime
How big are $a$ and $b$? How big is $|a-b|$? How does the larger algorithm you want to use this in look like?
Mar
9
comment Why haven't we proven many things computationally secure yet?
We haven't even shown that P!=NP.
Mar
8
comment How to calculate min entropy of the output of PRNG?
You don't even need a calculation: It's 0.
Mar
7
comment Is there any benefit to verifying PKCS#7 padding when using AES CBC and HMAC?
Even if the mode doesn't require padding, you might want to add padding to reduce the information leak through ciphertext length. Once you do, you have the same choice of fully validating the padding, or not.
Mar
7
comment Decrypt affine cipher given encryption key
$(c-11)\cdot 7^{-1} \pmod {27}$. See also Modular multiplicative inverse
Mar
7
comment How to salt PBKDF2, when generating both an AES key and a HMAC key for Encrypt then MAC?
@d1str0 It's not strictly needed for security, but it ensures that each iteration of the hash has a unique input.
Mar
7
comment How to salt PBKDF2, when generating both an AES key and a HMAC key for Encrypt then MAC?
h1 = HMAC(MasterKey, info | 0x01), h2 = HMAC(MasterKey, h1 | info | 0x02), ... Just look at the HKDF spec I linked above for the details.
Mar
7
comment How to salt PBKDF2, when generating both an AES key and a HMAC key for Encrypt then MAC?
@d1str0 If you never need more than one block of output, it's pointless. But HKDF supports larger outputs, where the last byte of the message acts as counter (it also includes the previous output in the message, similar to OFB mode).
Mar
6
comment “Security” of SHA functions (Wikipedia), what does it mean?
One of our top contributors uses exactly the same nick name as you. So it might be a good idea to change your name, to avoid confusion.
Mar
6
comment Is there any benefit to verifying PKCS#7 padding when using AES CBC and HMAC?
I'd verify the whole padding, to ensure my communication partner doesn't have a bug in their padding creation code. If you let a protocol violation pass, allowing that violation effectively becomes part of the protocol.
Mar
6
comment Why is $Mac_k(m_1||m_2) = ⟨F_k(m_1), F_k(m_1 \oplus \overline{m_2})⟩$ not a secure MAC?
@Lemon I explained it the other way round (querying $m^\prime$ and forging $m$), but that works as well.
Mar
6
comment Why is $Mac_k(m_1||m_2) = ⟨F_k(m_1), F_k(m_1 \oplus \overline{m_2})⟩$ not a secure MAC?
@mandragore Fixed.
Mar
6
comment Why is $Mac_k(m_1||m_2) = ⟨F_k(m_1), F_k(m_1 \oplus \overline{m_2})⟩$ not a secure MAC?
@mandragore I think the question is asking for the minimum number of queries you need for a guaranteed forgery.
Mar
6
comment Why is $Mac_k(m_1||m_2) = ⟨F_k(m_1), F_k(m_1 \oplus \overline{m_2})⟩$ not a secure MAC?
$⟨x,y⟩$ is supposed to be a tuple?
Mar
3
comment Password hashing in embedded systems
Perhaps secure offloading via Makwa's delegation feature.