Next tag badge:
117/100 score
19/20 answers
5 74 143
~728k people reached

comment How can I convert a DER ECDSA signature to ASN.1?
It is specified in the standard for DHE parameters, and in the other standard for ECDHE parameters. In the former case (DHE), it is the concatenation of the client random, the server random, and the encoded DH values (TLS encoding, not ASN.1/DER). With ECDHE, this is an encoding of the curve description and the server ECDH public value, this time without the client and server randoms.
comment How can rainbow tables be used for a dictionary attack?
@FredericoSchardong: see this article for some thorough analysis. It is not an easy read. Informally, when you build rainbow/Hellman tables, you accumulate chains with distinct end points; the more chains you insert, the higher the probability that the next chain merges with one already in the table, and thus was lost CPU. At some point it no longer is worth it; you'd better start a new table. The "1.7" factor comes from that effect.
comment RFC 6979 - Why not simply hash the message & the private key for deterministic ECDSA?
In their article, the EdDSA authors mostly say that: "Standard PRF hypotheses imply that this pseudorandom session key r is indistinguishable from a truly random string generated independently for each M, so there is no loss of security". This is a bit too terse to be called "extensive analysis" but it makes sense. For more analysis, you may read the Leurent & Nguyen article cited from RFC 6979 (under the reference "LN2009"); that article includes some analysis and pointers.
comment When to use RSA and when ElGamal asymmetric encryption
Considering that RSA, the algorithm, was published and fully described in 1978, several years before RSA, the company, was actually founded (in 1982), your assertion is dubious. It would imply that not only NSA paid the company to modify the algorithm, but also gave them access to some time travel technology so that they may get back to 1978 to enact the said modification. (I guess I am in denial of the NSA time travelling powers. Shame on me.)
comment What is the post-quantum cryptography alternative to Diffie-Hellman?
I am not saying that a "quantum-threatened" asymmetric encryption algorithm can be used safely for key agreement even in the presence of an attacker with a quantum computer. What I am saying is that any asymmetric encryption algorithm can be used for key agreement; so any quantum-safe asymmetric encryption algorithm is also a quantum-safe key agreement algorithm.
comment Three-way hash collision
When $n$ is large, $n^3/6$ and $n(n-1)(n-2)/6$ are almost the same thing. When talking about approximations (as is the case here), this kind of shortening is valid.
comment Openssl & RSA : how many public exponents are possible?
@owlstead: if you use RSA without a proper padding procedure, then it is malleable, and this is easier to exploit if $e$ is small. However, the issue there is not a small $e$, but lack of proper padding.
comment AES-GCM Disadvantage
One may add a performance issue: the not-too-slow implementations of GCM use tables that exhaust L1 caches on small architectures (like the 32-bit Mips found in cheap home routers). It has been reported that on such systems, EAX mode outperforms GCM.
comment Interpretation of the results of NIST (p)NRG suite
Here it is the other way round. Usually, in statistics, you want to detect a non-random effect (e.g. a correlation between a specific gene mutation and a given illness), so you want a small p-value, that would mean "no way this is pure luck, there must be some correlation". Here we really don't want correlations or biases, so we want big p-values.
comment What is the length of an RSA signature?
That trick can be extended; e.g. you can skip a complete byte (8 bits) if the verifier is ready to compute 256 RSA verifications, while it is trying to guess the missing bits. Maybe more importantly, in ISO/IEC 9796-2, part of the signed data can be embedded "for free" in the signature, so while the signature value has size $n$ bits (or $n-1$ with the trick you describe), the overhead implied by the presence of the signature can be substantially smaller, depending on the situation.
comment Efficiently map $2^n$ unique 64-bit vectors to $2^n$ $n$-bit vectors where $n < 64$?
If all possible inputs are known a priori then you can put 64 million entries into exactly 64 million buckets with no collision -- but the mapping will have to know the 64 million entries. And the gist of my answer is that this cannot, in general, be done without using enough ROM or RAM to actually encode the 64 million possible values one way or another.
comment linear computations over bilinear pairings
Two elements in a group are opposite to each other if their product is 1 (or their sum is 0, if you use an additive notation for the group).
comment Point addition equation in projective co ordinates
Yes, you get the same point at the end. That's the idea of non-unique coordinates: you have the choice of representation, but they all stand for the same curve point.
comment Is perfect-forward secrecy achieved with RSA?
One may note that SSL used to support ephemeral RSA keys. It was defined as part of the "RSA_EXPORT" cipher suites, in SSL 3.0 and TLS 1.0 (support was dropped in TLS 1.1). When an RSA_EXPORT cipher suite was chosen and the server's public key length was 513 bits or more, the server had to send a ServerKeyExchange message with a RSA key pair in it. I am not sure many SSL implementations supported it, though.
comment Is RSA of a random nonce with no padding safe?
Using the rightmost (least significant) bits should be safe (the leftmost bits are a bit biased), but the argument is a bit more complex; using a hash function is safer.
Well, don't forget that when you use a hash function as a stream cipher, you are actually trusting two "pieces of software": the hash function itself, and the construction which turns it into a stream cipher. Either may be subject to design and implementation weaknesses.
comment which of these is more secure (bcrypt vs srp)
@owlstead: there are two distinct points: 1. we don't want to store on the server something which is "password equivalent"; 2. the complete processing, from the password to whatever is stored on the server, must be proper "password hashing" with iterations and salts. You can have that with PBKDF2(password) computed on the client side, and SHA-256(PBKDF2(password)) stored on the server. That way, the server-side operation is very fast, and stealing the server's database still does not grant easy entry.
comment Use cases for CMAC vs. HMAC?
Beware: MD hash functions like SHA-1 are built out of a block cipher, but with the data as key, which apparently allows for better bandwidth. At least we can empirically notice that the SHA-3 competition yielded algorithms which are quite faster than all AES candidates on the same hardware. Even AES-based SHA-3 candidates (e.g. ECHO) turned out to be quite faster than AES itself on the same machine.
comment Can ECDSA signatures be safely made “deterministic”?
RFC are immutable; once published they never change.
comment Perfect Forward Secrecy in TLS
The "RSA" in "DH-RSA" qualifies the public key of the CA which issued the server's certificate. From the point of view of the client, a "DH-RSA" cipher suite means: "I want the server to have a certificate with a DH public key, and I am ready to use RSA to validate that certificate". This was supposed to be used in case a server had several DH certificates, signed with either RSA-based or DSA-based CA: the server would then choose the certificate for which the client had relevant support. This has never worked well in practice (but everybody does RSA anyway).