Reputation
2,748
Top tag
Next privilege 3,500 Rep.
Protect questions
Badges
2 13 36
Impact
~42k people reached

1d
comment Asymmetric cipher with multiple public keys
@RickyDemer Why ask me here and not there? Anyway: so what? I only changed the title and the tags. I shrunk the very long title to the main point of the question, which is that it isn't enough to specify the password and “AES” in order to have compatible tools. If the IV was the only variable, all tools would be compatible in practice since they pretty much always prepend the IV to the ciphertext.
May
26
comment public key for encrypting and both private and group key for decrypting
Your question is incomprehensible. What encryption scheme is used?
May
25
comment Why don't we have hardware generate NON-pseudo, but REAL random numbers from meta-stable flip-flops?
“Why don't we…” This question doesn't make sense since we do. All current high-end processors on smartphones and PC include a hardware RNG, based on flip-flops or other unstable physical process. Note that unlike what you claim in your question, a hardware RNG is good for seeding a PRNG but a PRNG is necessary to get unbiased output. Also unlike what you claim in your question, the problem with a PRNG is not brute-force attacks against the algorithm (quantum or not), but poor seeding that the adversary can reproduce.
May
20
comment Cannot verify rsa signature on Android
I'm voting to close this question as off-topic because it is a programming question about Java APIs. It can be asked on Stack Overflow, with complete code and input to reproduce the problem.
May
18
comment How to securely store data? / How to securely encrypt a file?
Given the scope, I suggest a chat or meta discussion on the topic first. There's a lot of good material in your answer, but I fear that it's all packed so tightly that it's difficult to find the relevant parts for any given problem.
May
18
comment How to securely store data? / How to securely encrypt a file?
I am voting to close as too broad because, seeing the answer, it's clear that there's just too much stuff to say on the topic. Besides, the answer to the question as written is “use an existing implementation such as dmcrypt, TrueCrypt, GPG, etc.”.
May
9
comment At what point can you you implement crypto algorithms?
I'm voting to close this question as off-topic because it is about risk management, not about cryptography. It was on-topic on Information Security.
May
8
comment At what point can you you implement crypto algorithms?
@gowenfawr This is mainly about risk management, it isn't about crypto itself. So it's far better for Information Security than for Cryptography. I'd vote to close it as off-topic on Crypto.
May
8
comment At what point can you you implement crypto algorithms?
Applied Cryptography is dated, and more targeted at people who design algorithms. His book Cryptography Engineering is more recent and more relevant to crypto implementers.
May
7
comment Why is the P-521 elliptic curve not in Suite B if AES-256 is?
This begs the question of why they weren't interested in a 256-bit security level.
Apr
24
comment Asymmetric cipher with multiple public keys
Why can't all the verifiers receive the same public key? Do you need it to be difficult to tell whether two public keys correspond to the same private key? It would seem that being able to verify the same message would give it away. If you sign a message and then generate more public keys, do the new public keys need to be able to verify the signature?
Apr
20
comment Multiple AES/ECB encryptions of different data with same key all end with same pattern
Your question is incomprehensible. You should give an example with some sample plaintexts and the corresponding ciphertexts, and explain exactly how they're computed (like you did in your comment, but it's unreadable due to the lack of formatting: edit your question). Also tell us how you're generating the IV.
Apr
4
comment What is the purpose of pre master secret in SSL/TLS?
@MaartenBodewes I disagree: this is not an IT security question, it's a protocol design question. Protocol design is cryptography.
Apr
2
comment Is there a need to encrypt data when send over https?
There are three parts here: the browser on Android, the proxy, and the server. What exactly did you install on Android? Is this a certificate for the server or for the proxy? What did you install on the proxy? How did you arrange for the proxy to be a man-in-the-middle? If what you did was to tell Android to trust a certificate for which the proxy has the private key, then this is perfectly normal: you told Android to blindly trust your proxy. In other words, if that's what you did, you opened the door and are now complaining that the zombies are coming in. The solution is: don't do that.
Mar
31
comment How can mega store my login details and still be secure?
That's interesting. Do you work on Mega? If not, where do you get your information from?
Mar
31
comment Is there any pattern in points on EC?
See crypto.stackexchange.com/help/account if you're having trouble accessing your account.
Mar
29
comment How much would it cost in U.S. dollars to brute force a 256 bit key in a year?
Your math is completely wrong.
Mar
26
comment zendo data size restrictions
How do you know how the keystream is generated? I don't see that in the TC article. Granted, not all phones have a hardware RNG, so they must have a fallback — and that's probably happening at the OS level, behind the scenes of /dev/random, not under control of their application.
Mar
25
comment Cycles in SHA256
Your other question about collisions on 256-bit strings is answered here (for SHA-512 but the principle is the same).
Mar
23
comment Is it possible to make time-locked encrytion algorithm?
You can't know that adversaries haven't kept a cache of the web page.