2,674 reputation
526
bio website touset.org
location San Francisco, CA
age 30
visits member for 2 years, 3 months
seen 5 hours ago

Cyclist. Rubyist.


1d
answered Why can't you just clone encrypted data and use it?
Jan
23
comment Simple message authentication code
RickyDemer's original response, for starters. At a minimum, your construct would require additional properties from the hash function that are unnecessary in HMAC. Additionally, it requires the use of a block cipher which is unnecessary in HMAC. And that block cipher itself has to have certain security properties, which again is unnecessary in HMAC. Even if your construct is secure, it's slower, more complicated, and is less safe in the event that its underlying building blocks become weakened.
Jan
23
comment Simple message authentication code
I'm not certain how either of your questions pertain to my reply. HMAC has a proof of security that only relies on on the underlying compression function being a PRF. It does not rely on any other properties typically expected of a hash function, so any PRF can be used. How this would relate to the security properties of any other MAC or to hash functions in general is lost on me.
Jan
23
comment Simple message authentication code
@RickyDemer is correct. HMAC does not rely on collision resistance of the underlying hash; HMAC-MD5 is still completely sound (although poor taste), outside of its digest length.
Jan
22
comment How does RSA padding work exactly?
RSA encryption does not involve hashing the plaintext message. For messages that are larger than the RSA modulus, typically one generates a random key for a symmetric encryption algorithm, encrypts the plaintext with that, then encrypts the symmetric key using RSA, and sends both the encrypted key and the encrypted plaintext as one bundle. In RSA signing, one hashes the plaintext message before creating the RSA signature using the hash.
Jan
22
comment Secure way to encrypt and decrypt a folder on Mac or Linux?
As a novice, you should be orders of magnitude more worried about something you've implemented yourself by stringing together commands with OpenSSL than in weaknesses in something high-level that tries to make correct decisions for you like VeraCrypt/TrueCrypt. Choosing "good" primitives like AES is only one of many variables that need to be picked correctly.
Jan
22
comment Secure way to encrypt and decrypt a folder on Mac or Linux?
Symmetric encryption algorithms do not work on passwords; they work on keys, which are expected to be random bytes (256 bits worth in the case of AES-256). In the optimal case, you simply store this random key separate from the data it's encrypting. If you want a "password" to protect the data, the two typical approaches are 1) to use a KDF like PBKDF2 to "stretch" the password to increase its effective entropy and distribute its entropy evenly across the number of bits expected by the algorithm, or 2) to use the password (and a KDF) to encrypt an actually random key, a la the first approach.
Jan
21
comment Secure way to encrypt and decrypt a folder on Mac or Linux?
If detection of tampering is important to you, use GCM mode instead of CBC. Also, 256-bit AES will be somewhat slower, and is likely overkill for your scenario. Also, if you keep the key on the same media as the encrypted file, you aren't actually gaining much (if anything). For OSX, you may want to look into encrypted sparseimages which can be made with Disk Utility, but aren't accessible cross-platform.
Jan
21
comment Is RC4 +XOR secure for small data?
This isn't authenticated (a CRC16 is nowhere near strong enough to prevent someone from even just trying all possible values for a packet), so an attacker can almost assuredly flip arbitrary bits at will.
Jan
20
comment Is there a kind of OS entropy pool on Windows systems?
It is not a good idea to use the raw output from hardware RNG instructions; best practice is to mix this with other independent sources of entropy. That said, Windows does have an API for this, as I mentioned in my comment.
Jan
20
comment Is there a kind of OS entropy pool on Windows systems?
The CryptGenRandom function is probably what you're looking for.
Jan
19
comment Verifying identity using a sha-1 hash
I would disagree that it gives any credence whatsoever that he has access to the file. I say this because I have access to that file at that revision, and the SHA1 hash is actually fc4df56ce275e7981ee93a0c3138bfc68aa1d97a.
Jan
16
comment Hash which can be used to verify one of multiple inputs?
Ah, actually, you're right. The attack is actually the one you described, where if you know one of a or b, you can forge a verifier for the other. But I don't think that's actually avoidable in the general case: anyone can create H1(x,y) for arbitrary x, y. If an attacker knows one of those values, regardless of algorithm, they can forge a verifier for the other. If you need it to be authenticated, replacing the hashes with an HMAC is probably necessary.
Jan
15
comment Hash which can be used to verify one of multiple inputs?
I also considered posting a similar answer to this, but it doesn't stand up to the original requirements. It's trivial for an attacker to modify the output such that one of a or b is validated successfully, but the other is not.
Jan
15
comment Hash which can be used to verify one of multiple inputs?
I'd love to see if this can be done.
Jan
14
comment What is a tweakable block cipher?
Gotcha, thanks! I wasn't considering key scheduling.
Jan
10
comment Can you help me with this Random Number Generator function?
I believe he wants successive calls to the generator to produce the demonstrated outputs.
Jan
9
comment Which block cipher mode does the experts use?
The only real downside to CTR is that accidental IV reuse is absolutely catastrophic.
Jan
7
comment Share encrypted files without giving master key
The problem with this approach, obviously, is that once the files are encrypted it's impossible to re-derive the key. So the keys (or the content hashes) must be stored. Unless you're already storing content-hashes, you might as well just be using a random value. This can be faster (no need to hash potentially large files) and more secure in some use-cases (the same file could be encrypted using different keys for different parties).
Jan
7
comment What is the keyspace of ROT-13?
I tend to think differently on this: ROT13 isn't a cipher, in my opinion, precisely because it is unkeyed. Therefore, the question "what is the size of the keyspace of ROT13" is ill-posed, precisely because it has no key (it quite literally has no key parameter in its function signature). I would argue that ROT13 is an encoding, like Base64 or hex. If you don't consider either of those to be a keyed cipher, it makes little sense to me to consider ROT13 to be one. Of course, you can generalize ROT13 to "ROT" encryption, at which point it becomes keyed with a keyspace size of 26.