Reputation
3,427
Top tag
Next privilege 3,500 Rep.
Protect questions
Badges
6 28
Newest
 Nice Answer
Impact
~70k people reached

1d
comment What is the advantage of AEAD ciphers?
Could you elaborate on this point? It doesn't have to be at length, just enough to have an idea of the problems you're speaking of.
Jul
18
comment 64bit nonce in AES-CTR, why not 128?
As a trivial example, if you use an incrementing counter for your IV, and that counter is further incremented for each "block" (as defined by CTR mode), the second block of your first plaintext and the first block of your second plaintext will use the same effective IV. Likewise with the third block of your first plaintext, the second block of your second plaintext, and the first block of your third plaintext (and so on).
Jul
10
comment Does AES(x || x) provide secure message authentication when message fits in a single block?
Note that I make no claims about the overall security of the scheme, those are just the immediate concerns I noticed. I suspect that AES being a PRP (and therefore a PRF) ensures that an attacker cannot break this scheme in less than $\DeclareMathOperator{\O}{O}\O(2^{64})$, but I'll wait for actual cryptographers to state that definitively. That said, if you're having to ask questions like these, it's undoubtedly simpler to just use AES-GCM and not try to be clever.
Jul
10
comment Does AES(x || x) provide secure message authentication when message fits in a single block?
This scheme loses semantic security — if you ever encrypt the same message twice with the same key, an attacker can see that the message was replayed (likewise, an attacker can themselves replay messages). You will also at best case only have a 64-bit MAC, which is considered within the realm of brute force. Note also that this scheme is equivalent to padding with 64 bits of zeroes and checking the decrypted text for that value.
Jul
6
comment SHA-256 exhaustive search
Importantly, the hashing algorithm is irrelevant, outside of having a constant (negligible) work factor. The only important part is the entropy in the passwords, which is catastrophically weak and results in only a few million "operations" needing to be performed.
Jul
2
comment Is this client-side password hash scheme secure?
Agreed. At a minimum, PBKDF2 should be used to stretch the user-provided passphrase with a random salt, then HDKF can be used for deriving the encryption key and the password verifier (using a different info string for each). Once the verifier is sent to the server, it can simply be hashed once (SHA-2, BLAKE2b, whatever) before being stored.
Jun
26
comment Prime factorization
I can factor $2^n$ for arbitrary $n$. You might want to clarify the question to ask for the factorization of a random semiprime with $p$ and $q$ of a given size.
Jun
25
comment Establishing encryption key using shared secret
Sure it can. Use the PSK to simply authenticate a DH session whose keys are discarded after use.
Jun
25
comment Establishing encryption key using shared secret
This does not provide forward secrecy.
Jun
25
comment Why is HMAC-SHA1 still considered secure?
No, otherwise that would be the advice. SHA-1's collision resistance is only broken in a theoretical sense right now. No known collisions have yet been found, although the current best attack is just on the edge of feasibility.
Jun
25
comment Why is HMAC-SHA1 still considered secure?
It's generally advised to move away ("walk", not "run") from SHA-1. That said, the specific construct of HMAC-SHA1 is still considered safe to use (assuming a secret key) due to the security proof for HMAC which does not rely on collision resistance of the underlying PRF. When in doubt, move to SHA-2.
Jun
19
comment Is secure communication without public-key crytography feasible?
Or simply symmetric crypto? I don't see anything in the question that rules that out.
Jun
19
comment What's the GCM-SHA 256 of a TLS protocol?
Probably answered in this question on the security.SE.
Jun
18
comment 3DES over Galois Counter Mode (GCM) for authenticated encryption
Alternatively, you could use the answer to this question to turn 3DES into a 128-bit block cipher.
Jun
16
comment SHA512 faster than SHA256?
SHA-256 performs 64 rounds of its compression function over 512 bits (its blocks size) at a time. SHA-512 on the other hand performs 80 rounds of the compression function, but over 1024 bits at a time. So yes, SHA-512 performs more calculations in a single invocation, but it does so over a larger quantity of data at a time.
Jun
15
comment Compression in Symmetric-Encryption?
Compressing can leak far more than that, as evidenced by the CRIME and BREACH attacks against compressed TLS connections.
Jun
11
comment simple algorithm to encrypt/decrypt a text file
Just keep in mind that RC4 is not suitable for production use. It sounds like this is an assignment for a class or something similar, in which case that's not a problem. But it's worth noting.
Jun
5
comment Is the one-time-pad a secure system according to modern definitions?
What? That's not even remotely correct. An attacker, even in a modern context, with the ciphertext and key can recover the plaintext.
Jun
4
comment How do we know a cryptographic primitive won't fail suddenly?
And there may be as-yet unconsidered notions of security that we only begin to realize the importance of some time in the future.
Jun
4
comment Is it OK to use a hash of the key as nonce for AES GCM?
The nonce is typically transmitted along with the ciphertext — there is no requirement for it to be kept secret. Given what I provided above, it should be painfully obvious why you would want to use a variable nonce: to encrypt more than one plaintext with a single key. If any {key,nonce} pair is ever reused (particularly in CTR-based modes), secrecy of the messages the pair was used for is completely lost.