2,476 reputation
524
bio website touset.org
location San Francisco, CA
age 30
visits member for 2 years
seen 5 hours ago

Cyclist. Rubyist.


12h
comment How do you test randomness?
You mention that you can only prove with high probability that it wasn't produced randomly or pseudorandomly, but that's not true at all against an intelligent adversary. Any statistical test you perform can be bypassed.
13h
comment Operation which needs much computing power to be created, but just a little to be solved?
Ah, sorry! I had completely inverted his question in my head — he wants the inverse of a trapdoor function. In a sense, he's looking for problems in NP: hard to compute, easy to verify.
14h
comment Operation which needs much computing power to be created, but just a little to be solved?
That's pretty much the basis of much of cryptography.
15h
comment Advantages of combined PRNGs
For what it's worth, combining multiple sources of (potentially-questionable) entropy is exactly what Fortuna is designed to do.
1d
comment What is the use of Mersenne Primes in cryptography
@poncho has a great point. Mersennes can be useful when you need a non-secret prime number that is fast to compute modulo on.
1d
answered What is the use of Mersenne Primes in cryptography
1d
comment Encrypt a file for random access but only after an initial read of the whole file
@CodesInChaos I retract my original statement — you are of course correct; this has the exact properties asked for by the OP.
2d
comment Encrypt a file for random access but only after an initial read of the whole file
That doesn't seem to have the properties that he's asking for.
2d
comment Encrypt a file for random access but only after an initial read of the whole file
You're thinking of an all-or-nothing transform, but something like that fundamentally won't work with random access.
Oct
15
comment What is a tweakable block cipher?
Out of curiosity, what does it mean to say that "changing a key can be expensive"? What does Threefish do differently to AES that makes changing keys "cheap"?
Oct
15
comment Comparing Files: Is it better to use multiple hash algorithms or just one?
What MD5 (or, ideally, a better hash function like SHA-2 or BLAKE2b) gets you is a short token that you can compare to later. Doing a byte-by-byte comparison involves reading both files entire contents from disk in order to compare them. If you, for instance, have 100 files and a new one is uploaded, you would have to compare against all 100 (or if you store them in sorted order, you can use a binary search). With a hash, you read each file once and then compare the short 128-bit or 256-bit string for each of them (again, using a binary search through, e.g., a database index).
Oct
15
comment AES: Guess Password using the unencrypted text?
It's hard to answer this question authoritatively; it really depends upon the specific software you're using. The question is roughly equivalent to, "Will a bridge made out of steel collapse?" The answer is hopefully no, and it should be no, but there are many critical variables besides the particular choice of building material.
Oct
15
comment Create collision examples with MD5 hash with salt
From the Help Center on how to ask a good question: Have you thoroughly searched for an answer before asking your question? Sharing your research helps everyone. Tell us what you found and why it didn’t meet your needs. This demonstrates that you’ve taken the time to try to help yourself, it saves us from reiterating obvious answers, and above all, it helps you get a more specific and relevant answer!
Oct
14
comment Is it true the longer the key length is the more secure the encryption?
To TL;DR the answers you've received so far: increasing key lengths is increasingly pointless, as this defends an otherwise-secure cipher against brute force attacks. But typical key lengths are currently such that brute force attacks are outside the realm of physical possibility. What's important is building ciphers that are more resistant to other kinds of attacks like differential cryptanalysis, timing attacks, etc. Key lengths are already essentially the strongest component of modern cryptography.
Oct
14
comment Create collision examples with MD5 hash with salt
Typically, this community prefers to see that you have put in some effort towards trying to learn the answer on your own, or even to better understand the question you're asking.
Oct
13
comment How to use the key from a Diffie Hellman exchange?
That only works in two scenarios: a one-time pad, and a stream cipher. In the first case, you have to have truly random numbers and not numbers that are pseudorandomly generated. In the other, you would use the key with a preexisting stream cipher (like AES in CTR mode, or Salsa20) to produce a keystream that is later XORed with the plaintext. Regardless, this is something you absolutely should not be doing yourself; it is too easy to get any one of dozens of details wrong, resulting in little to no security at all. Use a library like libsodium or BouncyCastle to do the work for you.
Oct
13
comment How to use the key from a Diffie Hellman exchange?
There are many different symmetric encryption algorithms; their selection, implementation, and use is an enormous topic and warrants another question (or many).
Oct
13
comment How to use the key from a Diffie Hellman exchange?
The answer to this question can range from "extremely simple" to "extremely complicated". The simplest answer is, once two parties share a secret key of sufficient length, they can use pretty much any symmetric-key encryption algorithm to exchange a single message. A lede to the more complicated answer is that if you want to exchange multiple messages, authenticate (one, both, or more) parties, or have other features, the key exchange must be part of a larger protocol such as TLS.
Oct
9
comment Block Cipher Modes
Multiple of those answers are correct.
Oct
6
comment Session based AES with random key and static salt
Why not just use Diffie Hellman?