2,377 reputation
424
bio website touset.org
location San Francisco, CA
age 30
visits member for 1 year, 11 months
seen 37 mins ago

Cyclist. Rubyist.


Jun
20
reviewed Leave Open Is HMAC padding the same as bcrypt?
Jun
20
answered Is HMAC padding the same as bcrypt?
Jun
18
comment Length-preserving all-or-nothing transform
@fgrieu You're right. I'd originally conceived it as doing CBC a second time over the reversal of the ciphertext, but as D.W. explains in his answer, the entire construct is unnecessary in the first place. Oh well.
Jun
18
comment Using PBKDF2 twice with different argument order
Can it? By what property?
Jun
17
reviewed Close How to calculate inverse affine transform in AES from forward affine transform?
Jun
17
comment Does this protocol provide Perfect Forward Secrecy / are there potential security flaws?
Why should anyone bother to analyze this protocol? What advantage does the scheme have over TLS? What problem are you trying to solve, that is not already solved by existing protocols?
Jun
17
reviewed Leave Open Is HMAC needed for a SHA-3 based MAC?
Jun
17
comment Using PBKDF2 twice with different argument order
At best, you're in a situation where you're using the algorithm in a way which hasn't been nearly as thoroughly cryptanalyzed. Better would be to use two separate cryptographically random salts, one for each usage purpose.
Jun
17
comment Length-preserving all-or-nothing transform
I'm sure there's something trivially wrong with that, but perhaps it will stoke some interesting discussion.
Jun
17
comment Length-preserving all-or-nothing transform
I'm thinking something like the following. Given some $i$-block message $m = m_{0} || m_{1} || \cdots || m_{i - 2} || m_{i - 1}$, let $c' = E_{CBC}(k, 0, m_{0} || m_{1} || \cdots || m_{i - 2} || m_{i - 1} || m_{i - 1} || m_{i - 2} || \cdots || m_{1} || m_{0})$. The ciphertext is $c = c'_{i} || c'_{i + 1} \cdots || c'_{i * 2 - 2} || c'_{i * 2 - 1}$.
Jun
12
comment Given $n$ bits, how many “truly random” sequences/numbers can be constructed?
Many well-designed PRNGs are capable of generating the full $2^n$ bits of their output space, even if they are not cryptographically secure. The important property of a CPRNG is that the next bit is always computationally indistinguishable, even if you have all of the previous generated bits.
Jun
11
comment Why must IV be sent with each packet?
To be clear, CBC does randomize subsequent blocks by XORing previous blocks within a message. A single message consists of one or more blocks, and each message needs its own unique (and random) IV.
Jun
11
comment Why does PBKDF2 xor the iterations of the hash function together?
Can you explain further what a "rho" structure is? It seems counterintuitive that this is a strong protection against a short cycle. If some $U_n, U_{n+1}, \cdots, U_{n+k-1}, U_{n+k}$ exist such that $U_{n+k+1}$ = $U_{n}$, it seems trivial that their XOR pattern will cycle through $2k$ unique values beginning at $U_{n}$.
Jun
11
comment Why does PBKDF2 xor the iterations of the hash function together?
Feeding the password back in doesn't negate the possibility of some $U_n$, $U_{n+1}$ existing such that $U_{n} = PRF(password, U_{n+1})$ (creating an extremely short cycle).
Jun
11
reviewed No Action Needed How can a digital signature algorithm incorporate a random data if it is to be authenticated on a separate system
Jun
11
reviewed Close What does it mean that a protocol realizes “strong mutual authentication”?
Jun
8
comment AES-128-CTR message integrity: Construction of HMAC
The HMAC only need be constructed over the whole message (e.g., $H(k, n || m)$).
Jun
5
comment One Time Pad for large changing files
I disagree that the information-theoretic property still holds. For example, one could determine through the pattern of flipped bits, whether or not the contents are likely to be (for instance) ASCII data (say if every 8th bit never changes).
Jun
4
comment AES/CBC fixed Initial vector use-case
To questions like this, I always have to ask: why? Why try to be clever? Why play with fire when it's so patently unnecessary? To save 16 bytes per request? Surely there are dozens of vastly more important things you can be spending your development energies on. Use a (cryptographically) random IV every request, slap an HMAC authentication tag on it, and move on to problems actually worth solving.
Jun
2
comment How do I produce a stream of secure random numbers from AES-Counter mode?
Since I'm feeling generous, I'll throw two more leading questions out there. What is the source of randomness for your cryptographic keys? How are you generating nonces, and how are you ensuring you're not using the same nonce twice?