Reputation
4,050
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
9 30
Newest
 Pundit
Impact
~118k people reached

Apr
29
comment To what extent is WhatsApp's statement on secure messaging realistic?
My assertion is that, given what we know about the situation, it's reasonable to assume that WhatsApp's technical implementation prevents large-scale, firehose-style surveillance. Additionally, it's reasonable to assume that the cost function for conducting surveillance on an individual user is comparatively high (especially given that it poses non-trivial risk of being discovered. Given those assumptions, I think it's a natural conclusion that you'd have to be a high-profile target in order to be overly concerned.
Apr
28
answered To what extent is WhatsApp's statement on secure messaging realistic?
Apr
28
comment To what extent is WhatsApp's statement on secure messaging realistic?
The concern isn't whether or not the data is encrypted. The concern is whether or not it's encrypted in a way that doesn't give WhatsApp or agents with, e.g., subpoena power over WhatsApp access to your messages.
Apr
28
answered Symmetric cipher speed (AES vs Camellia vs Twofish)
Apr
28
comment mode of operation in cryptography
Yes, please just use an off-the shelf transport protocol. Wrap your own application protocol inside of TLS or DTLS.
Apr
27
comment Is regular CTR mode vulnerable to any attacks?
Additionally, CTR with a reused IV is completely broken, complicating its use in full-disk encryption scenarios. Use a mode designed for FDE uses like XTS, as suggested.
Apr
6
comment Is it safe to use the same IV for multiple encryptions in AES CBC mode when you are always encrypting random bytes?
Without further clarification, I don't think you can quite make this claim yet. He says the bytes are random, but he doesn't say how large they are! If he's only encrypting, for example, one byte at a time, this scheme loses indistinguishability. This only retains the full security of AES-128 if he's encrypting at least 16 bytes at a time.
Mar
31
comment Why is it a bad idea to use a UTF-8 derived symmetric key?
Not all random byte strings are valid UTF-8, for starters. Also, I think you may be unclear on exactly what the difference is between an encoding versus the underlying value being encoded.
Mar
25
comment Could a key derivation function be used to encrypt data with a weaker key?
They can't brute force the encrypted key, because the encrypted key is stored in hardware specifically designed to resist extraction of the key. Multiple failed attempts at submitting passwords result in permanent deletion of the key.
Mar
22
comment Could a key derivation function be used to encrypt data with a weaker key?
For example, this ties decryption to a particular device. iOS and OSX use this for their full-disk encryption, which is why the FBI requires Apple's assistance to unlock the San Bernardino shooter's iPhone.
Mar
22
comment What is considered a “weak key” in AES?
Just make sure the array of bytes is the output of a cryptographically-secure random number generator.
Mar
17
comment Is it better to encrypt before compression or vice versa?
A chosen-plaintext attack in the style of CRIME and BREACH are applicable independently of the cipher, as they attack information leaked by the compression algorithm. Both of those are clear instances of exactly the kind of example you are interested in.
Mar
16
comment Is it better to encrypt before compression or vice versa?
And this can be used to completely defeat encryption, if an attacker can control part of the message that gets encrypted.
Mar
14
comment Could a key derivation function be used to encrypt data with a weaker key?
No cryptosystem is useful if an attacker can access the data and key.
Mar
9
comment One-Way property of Random Oracle
Is there a concise explanation of why it's difficult to prove?
Mar
9
answered Better security than SHA1 for signature?
Mar
7
comment Could a key derivation function be used to encrypt data with a weaker key?
Brute forcing data doesn't make sense, and brute forcing a 128-bit key is outside of the realm of plausibility. The point of such a scheme is that an attacker can't simply guess passwords without also having the secret key.
Mar
5
comment Why is OTP not vulnerable to brute-force attacks?
I'm not sure that's the case. It's at least not trivially so.
Mar
4
awarded  Pundit
Mar
3
comment Why is OTP not vulnerable to brute-force attacks?
Why would that matter? If you have 16 bytes of plaintext and a 4-byte checksum, you only "rule out" decryptions where the checksum is incorrect. But there's an equally-plausible decryption with a correct checksum for all $2^{16}$ possible plaintexts. That said, one should always MAC after encryption and not before (for reasons I won't go into here).