3,130 reputation
1926
bio website
location Tennessee
age 20
visits member for 1 year, 9 months
seen 9 hours ago

I'm an aspiring cryptographer. Other interests include software engineering and Linux-based system administration.

I can be contacted at: reid [at] rwiggins [dot] net.


Mar
12
comment How does the key size per data bit influence the security?
It will take $2^{127}$ tries on average, not $2^{64}$. If the probability of each guess being correct is $1/2^n$, it takes $2^n / 2 = 2^{n-1}$ guesses to have a 50% chance of success.
Mar
9
comment Using a hash with a constant key to create easily verifiable codes
Well, I have two problems with this answer: (1) it doesn't mention HMAC, which the question just screams to recommend IMO, and (2) it suggests signing a digest of the message, which should already be handled by the signature's padding scheme.
Mar
9
comment Finding an x such that xP = (11,44) on an elliptic curve
Some folks write curve points with uppercase letters.
Mar
5
comment Any use for now-defunct Mt Gox Yubikey?
48 bits is not a whole lot. I don't know much about the system is setup, but could you possibly brute-force that?
Feb
15
comment The difference between these 4 breaking Cipher techniques?
Hmm, (re)reading this answer, perhaps it would be prudent to reorder these from weakest to strongest, so that each attack builds on the previous one. (That is the typical presentation.) I think this answer might serve in the future as a useful high-level reference for the different attack types. I've noticed that the associated Wikipedia article(s) are of particularly poor quality in that department.
Feb
4
comment What exactly is the base for the KECCAK (SHA3) claim that a security strength of 256 bits is “post-quantum sufficient”?
@figlesquidge: See this paper by Bernstein, particularly the third page. In it, he argues that the BHT quantum algorithm for collision-finding will cost more than Grover's. All thanks goes to nightcracker, who provided me this citation about a month ago.
Feb
3
comment Can passwords be stored securely so that a similarity comparison can be made?
That's essentially the only (secure) way, as far as I can see. Suppose you had some password storage algorithm that allowed you to compute a "similarity metric" between two digests (or one digest and one input; the scenario doesn't change). Then couldn't one use the similarity metric to optimize a brute-force search? (That is: follow a path that maximizes the similarity metric.) This isn't a proof, but it does intuitively explain the problem here.
Feb
3
comment Can passwords be stored securely so that a similarity comparison can be made?
Well: if the password change form asks for your previous password, it can use it to check similarity between the new password and the old (after checking it against the stored digest in the DB for security, of course).
Feb
2
comment The difference between these 4 breaking Cipher techniques?
What particular difficulties are you having understanding the above? In what way(s) are you confused?
Jan
30
comment How do institutions like banks do RSA with big primes?
As an aside, banks probably don't use numbers much larger than most organizations, or even people. They're more cautious about things like key management, but exceptionally strong crypto is widely available these days; it's more of a matter of ensuring your protocols are properly secure instead of picking a insanely high (computational) security level.
Jan
28
comment One-way function and uninvertible function
Can you update the question with your definition of one-way and uninvertible? To prove the statement you're given, you need to understand the essence of why the two definitions are different.
Jan
20
comment Is SHA-256 safe when used in this way?
Minor nit: "where the attacker tries to figure out information about the original message from the hash" is not a preimage attack necessarily. A preimage attack is, given some $f(x)$, try to find an $x'$ such that $f(x) = f(x')$. Even if $f(x)$ exposes some information about $x$, it may not necessarily lead to a preimage attack. This is related to the notion of a hard-core predicate.
Jan
18
comment How to ensure that a “received value” is not altered?
Is verification-value known beforehand? If so, you can sign it with your private key. (Then everyone who has your public key can verify its correctness.)
Jan
13
comment Time complexity to solve Discrete log problem
Note that this is a heuristic asymptotic complexity, not a proven one.
Jan
12
comment Methods of making ASIC/GPU resistant encryption?
We want slow (password-based) KDFs because the only secret is low-entropy (i.e., a human-memorable password) and therefore brute-force-susceptible. Secret-key encryption schemes are a whole different ballgame: there, we have nice, strong secrets (typically 128+ bits) that make brute force infeasible (hopefully). So, we don't care much about ASIC/GPU/FPGA attacks on, say, AES. Quite the opposite: we want encryption to be as efficient as possible, and efficiency is what separates good ciphers from the bad these days.
Jan
9
comment Can I use HMAC-SHA1 in counter mode to make a stream cipher?
@izaera: The compression function in that proof is the compression function of the underlying iterated hash scheme (SHA1). You can see one iteration of the compression function in the first diagram on this page.
Jan
8
comment Would data be secure if a cryptographically secure PRNG was used for encryption?
You'd be interested in stream cipher. That's basically what your scheme is (except, of course, when specifying a cipher, we usually leave out things like key exchange and authentication). As for the AES comment, you can use AES as a stream cipher with the appropriate mode of operation, e.g. CTR mode. (Indeed, this is a common way to use AES.)
Jan
7
comment Is there a metric (term) for work required to decrypt a public key?
And all of the above can basically be summed up into "security level", for a general term that's applicable almost anywhere.
Dec
30
comment Random Number Generation with a Entropy pool versus Seed
There is window.crypto.getRandomBytes. You may already have looked at this and decided not to use it (incompatibility), etc., but for anyone reading the post not aware, that's an honest-to-goodness built-in CSPRNG implemented by newer browsers. Also, there is the SJCL which has Fortuna already implemented. None of this affects the validity of your question, but I wanted to give already-built solutions.
Dec
30
comment Are hash trees an alternative, quantum-resistant signature scheme which can replace RSA?
@nightcracker: Thanks for the reference! The paper title does not include 'brassard' in its title or keywords, it seems ... At any rate, that'll take some time to digest, but the premise certainly makes sense -- BHT takes $\Theta(n^{1/3})$ space, which really is a fair bit.