Reputation
3,035
Top tag
Next privilege 3,500 Rep.
Protect questions
Badges
6 27
Newest
 Informed
Impact
~59k people reached

Jan
21
comment Is RC4 +XOR secure for small data?
This isn't authenticated (a CRC16 is nowhere near strong enough to prevent someone from even just trying all possible values for a packet), so an attacker can almost assuredly flip arbitrary bits at will.
Jan
20
comment Is there a kind of OS entropy pool on Windows systems?
It is not a good idea to use the raw output from hardware RNG instructions; best practice is to mix this with other independent sources of entropy. That said, Windows does have an API for this, as I mentioned in my comment.
Jan
20
comment Is there a kind of OS entropy pool on Windows systems?
The CryptGenRandom function is probably what you're looking for.
Jan
19
comment Verifying identity using a sha-1 hash
I would disagree that it gives any credence whatsoever that he has access to the file. I say this because I have access to that file at that revision, and the SHA1 hash is actually fc4df56ce275e7981ee93a0c3138bfc68aa1d97a.
Jan
16
comment Hash which can be used to verify one of multiple inputs?
Ah, actually, you're right. The attack is actually the one you described, where if you know one of a or b, you can forge a verifier for the other. But I don't think that's actually avoidable in the general case: anyone can create H1(x,y) for arbitrary x, y. If an attacker knows one of those values, regardless of algorithm, they can forge a verifier for the other. If you need it to be authenticated, replacing the hashes with an HMAC is probably necessary.
Jan
15
comment Hash which can be used to verify one of multiple inputs?
I also considered posting a similar answer to this, but it doesn't stand up to the original requirements. It's trivial for an attacker to modify the output such that one of a or b is validated successfully, but the other is not.
Jan
15
comment Hash which can be used to verify one of multiple inputs?
I'd love to see if this can be done.
Jan
14
comment What is a tweakable block cipher?
Gotcha, thanks! I wasn't considering key scheduling.
Jan
10
comment Can you help me with this Random Number Generator function?
I believe he wants successive calls to the generator to produce the demonstrated outputs.
Jan
9
comment Which block cipher mode does the experts use?
The only real downside to CTR is that accidental IV reuse is absolutely catastrophic.
Jan
7
comment Share encrypted files without giving master key
The problem with this approach, obviously, is that once the files are encrypted it's impossible to re-derive the key. So the keys (or the content hashes) must be stored. Unless you're already storing content-hashes, you might as well just be using a random value. This can be faster (no need to hash potentially large files) and more secure in some use-cases (the same file could be encrypted using different keys for different parties).
Jan
7
comment What is the keyspace of ROT-13?
I tend to think differently on this: ROT13 isn't a cipher, in my opinion, precisely because it is unkeyed. Therefore, the question "what is the size of the keyspace of ROT13" is ill-posed, precisely because it has no key (it quite literally has no key parameter in its function signature). I would argue that ROT13 is an encoding, like Base64 or hex. If you don't consider either of those to be a keyed cipher, it makes little sense to me to consider ROT13 to be one. Of course, you can generalize ROT13 to "ROT" encryption, at which point it becomes keyed with a keyspace size of 26.
Jan
4
comment How does ECDH arrive on a shared secret?
Wait, so if Alice has to calculate $g^a$ by dotting $g$ with itself $a$ times... why can't an attacker just do the same? Dot $g$ with itself, check if the result matches, if not repeat? I assume this is because one can calculate $g^a$ for large enough $a$ much faster than linearly?
Jan
4
comment Why are there no MACs inspired by block cipher modes other than CBC and CFB?
Your clarification only seems to have furthered the misunderstanding.
Jan
3
answered what is it called when encrypt('a') + encrypt('a') == encrypt('aa')?
Dec
22
awarded  Nice Question
Dec
15
awarded  Nice Answer
Dec
5
answered Is the salt used with PBKDF2 secret?
Dec
2
comment Is double hashing collision resistant?
What specific threat do you expect to mitigate by hashing twice?
Dec
2
comment Definition of “pepper” in hash functions
The short of it is that there is no widely-agreed upon use of the word "pepper" when it comes to cryptography.