20,795 reputation
32575
bio website
location
age
visits member for 3 years, 4 months
seen 2 days ago

Aug
15
comment Are there any cryptographic flaws in my webhook signing process?
Is there a reason you aren't just using client certificates? They were designed for solving this problem. The TLS folks thought a lot about the security challenges, so you wouldn't have to.
Aug
4
answered Secure MultiParty Computation with secret inputs for secret outputs
Aug
4
awarded  Yearling
Aug
2
comment run length testing
This question looks off-topic to me. The site is for questions about cryptography (see here); your question does not appear to fit the fall within the scope of the site.
Aug
2
comment Theoretical attack on RSA
What's your question, specifically? This is not the place for open-ended questions ("Please leave opinions on that") -- this is for specific, answerable questions. In any case, this is a duplicate of the other question that Ricky Demer identifies.
Jul
31
comment Questions on FHE over the Integers - the question modified!
@JongHyunKim, please don't use comments to ask a new question. Comments should only be used to help the author of the answer improve their answer. (This is not a discussion forum; see the faq for more details on how to use this site.)
Jul
30
awarded  Good Answer
Jul
29
revised How can rainbow tables be used for a dictionary attack?
Incorporate the complexity of these attacks, per a comment from Thomas Pornin.
Jul
29
comment Is it secure to use Diffie-Hellman key agreement to generate a nonce?
@YoavR., it sounds like you are using terminology in a non-standard manner. I don't know what you mean by "this is Nonce - by design it uses counter". I don't understand why you think a MAC "doesn't fit"; your explanation didn't make any sense to me. Again, if you want to receive help, edit your question to specify the security goals you are trying to achieve, what your requirements are, what mechanisms you have considered, what ones you have rejected, and why. I have to say this sounds like an instance of an XY problem.
Jul
29
comment Is it secure to use Diffie-Hellman key agreement to generate a nonce?
@YoavR., no, that is not correct. The purpose of an IV is not to prevent replays. The purpose of an IV is to provide confidentiality (to ensure that if the sender encrypts the same message twice, this won't be apparent to an eavesdropper). If you want to prevent replays, you should use a different mechanism: e.g., sequence numbers and a MAC. Please edit your question to describe what you are trying to achieve, as it looks very much like you are making some (incorrect) assumptions about the best way to achieve it.
Jul
29
comment Is it secure to use Diffie-Hellman key agreement to generate a nonce?
There's no need/reason to use Diffie-Hellman to generate a nonce. Instead, have Alice generate one nonce $N_A$, and have Bob generate another nonce $N_B$, and use both nonces -- or use the hash $H(N_A || N_B)$ as your random value. Alternatively, if all you want is an IV for a symmetric-key cryptosystem, you don't need them to cooperate to form a nonce: just have the sender generate the IV randomly. Both endpoints are presumably trusted (since they both know the shared key) and had better have been authenticated, so there's no need to combine both of their contributions to form the IV.
Jul
28
revised Rainbow table for DES with all-zero plaintext?
deleted 14 characters in body
Jul
28
comment Elliptic Curve Cryptography
What have you tried? Do you know the equation that defines the tangent line?
Jul
28
comment Known plaintext attack on ElGamal encryption
What are your thoughts? What have you tried? Sounds like an exercise. We're not here to do your exercise for you; this is not a site where you can paste your exercise and we'll solve it for you. Instead, we expect you to make a serious effort, to show us what you tried in the question, and to formulate a specific question about a specific aspect of the problem or your approach.
Jul
28
answered Rainbow table for DES with all-zero plaintext?
Jul
28
comment CSPRNG that cannot be used as random extractor
@owlstead, OK, I've edited the answer accordingly, and to try to make it match my understanding. Now the answer makes more sense to me. AES CTR_DRBG is different from AES CTR.
Jul
28
revised CSPRNG that cannot be used as random extractor
Fix typo to clarify what primitive was intended.
Jul
28
comment CSPRNG that cannot be used as random extractor
OK, so I think part of the problem here is that you don't yet have a clear definition of what you mean by CSPRNG: what it is intended to achieve, what its API is, what its security definition is. A PRG is one well-defined notion in cryptography (AES-CTR, RC4, etc. are examples of a PRG). A CSPRNG is another, different primitive (Yarrow, /dev/urandom, etc. are examples of this primitive; it typically must accept non-uniformly distributed inputs, provide robustness to state compromise extension attacks, etc.). See my comment underneath otus's answer for some elaboration.
Jul
28
comment CSPRNG that cannot be used as random extractor
Based upon the answers it has become clear that there is some confusion about what you mean by CSPRNG (e.g., the distinction between CSPRNG and PRG). I suggest you edit the question to give us your definition of what you mean by CSPRNG: do you mean something like Yarrow, /dev/urandom, etc? or something like AES-CTR, RC4, etc.?
Jul
28
revised CSPRNG that cannot be used as random extractor
added 763 characters in body