191 reputation
6
bio website
location Germany
age 35
visits member for 2 years, 4 months
seen Aug 20 at 13:27

I'm currently a PhD student and have studied CS. I started programming as a hobby at the age of about 9 (Basic on a Commodore C64) if I remember correcly and progressed from there (Pascal, Delphi, Java). But only recently (about 3 yrs ago) I started learning and using the C++ language which comes in quite handy for the performance critical computations I'm mostly doing right now (tomography, other big nonlinear optimization problems).


Sep
24
awarded  Autobiographer
Aug
7
comment Interleaving bytes to make an effectively larger block size
@CodesInChaos: What simple techniques do you have in mind? Anything simpler than, say, creating a Feistel network with Keccak as round function?
Apr
30
comment Performance for Subbytes in AES
From what I know, fast software implementations are table-based in which a single table lookup not only performs SubByte but also four field multiplications of the SubByte result with the four factors of MixColumns. So, you'd have one or four tables of 256 32-bit values.
Apr
5
comment How do I create a short signature? (e.g. less than 100 bytes)
@AdamSmith: I don't think it is part of the OpenPGP standard. And I would be surprized if GnuPG supported it. But honestly, I don't know for sure. The Crypto++ library for C++ supports something like this. No idea what kind of crypto libs people usually use for iOS.
Apr
5
comment How do I create a short signature? (e.g. less than 100 bytes)
related: crypto.stackexchange.com/questions/679/…
Apr
4
comment Use cases for “online” authenticated encryption?
The reason I ask this is because most candidates of the CAESAR competition advertise their design to be "online". After having implemented NORX with "online support", I'm wondering whether this was really worth the effort.
Apr
4
revised How do I create a short signature? (e.g. less than 100 bytes)
deleted 140 characters in body
Apr
4
answered How do I create a short signature? (e.g. less than 100 bytes)
Mar
28
awarded  Editor
Mar
28
revised Use cases for “online” authenticated encryption?
deleted 62 characters in body
Mar
27
asked Use cases for “online” authenticated encryption?
Jan
28
comment Avoiding overflow when encrypting with RSA
You're not computing m^e and then reduce it modulo n. You do the mod n reduction after every multiplication. And you compute m^e mod n via something like a square and multiply algorithm where "mod n" is built into the squaring and multiplication. Note, however, that such a simple implementation will leak information on side-channels. So, if you really want to use RSA, you just take a well-known open source library to do that. :)
Jan
26
comment Can curve25519 keys be used with ed25519 keys?
@nightcracker: It seems I did. Your last sentence "This means that if you want to use modern cryptography, like Ed/Curve25519, ChaCha, Keccak, BLAKE, Poly1305, that you'll either have to implement it yourself or trust an often badly performing non-scrutinized third-party implementation." sounds to me as if you were saying that there are no well-optimized implementations. But I guess you are talking about Java implementations only.
Jan
25
comment Can curve25519 keys be used with ed25519 keys?
@nightcracker: With "Ed/Curve22519, Chacha, Keccak, Blake, Poly1305" you named examples of cryptographic primitives that actually seem to come with well-optimized implementations in C & ASM. :)
Jan
25
comment What happens to entropy after hashing?
even for a random transformation of n bits to n bits, there will probably be some collisions. but the entropy won't decrease significantly. It does tend to decrease a little bit, however.
Nov
6
comment Are NIST's changes to Keccak/SHA-3 problematic?
@user239558: Quantum computers only half the preimage sucurity level if preimage resistance was actually the same as the output length. As far as I know (you'll be able to find quantum-related Keccak questions and answeres here on this site) quantum computers reduce security from c/2 to c/3 for a sponge construction. So, even if NIST were to proceed with their "lower capacity" plans, SHA3-512 would still have an overall "quantum security level" of 170 (for collision and preimage attacks) which is practically safe for eternity.
Nov
6
comment Are NIST's changes to Keccak/SHA-3 problematic?
minor quibble: Keccak (the family of hash functions) was never going to be modified. It's just a subsetting issue (what parameters to standardize) similar to AES being restricted to 128-bit blocks where Rijndael actually supports 192- abd 256-bit blocks as well.
Oct
9
awarded  Commentator
Oct
9
comment Are NIST's changes to Keccak/SHA-3 problematic?
Since you mentioned preimage resistance w.r.t. to passwords and other secrets: First preimage resistance is probably not lower-bounded by c/2. IIRC, the best known generic attack requires more work. Some authors of sponge-based hash functions (eg. PHOTON) actually claim a higher first preimage resistance than c/2. Second preimage resistance is however limited to c/2 as far as I know.
Oct
9
comment Are NIST's changes to Keccak/SHA-3 problematic?
@JohnDeters: Isn't a security level of 80 a bit outdated now? Very strong (but still realistic) attackers probably only need a year to crack that nut IIRC.