Reputation
3,585
Top tag
Next privilege 4,000 Rep.
Access 'trusted user' tools
Badges
6 29
Newest
 Nice Answer
Impact
~75k people reached

Aug
28
comment Are there ANY text strings that will generate the same SHA-512 Hash output?
Good point. I've edited the answer to reflect that.
Aug
27
comment Ensuring integrity and confidentiality together with symmetric encryption
Integrity is in no way guaranteed by your protocol, unless you are using an authenticated mode. In many non-authenticated modes, depending on the particular use-case, confidentiality might not even be guaranteed (e.g., CBC and padding oracles). So yes, there is a problem with the given protocol.
Aug
24
comment Client login without sending a password
That said, you should almost certainly not attempt to implement SRP yourself.
Aug
20
comment Combining several symmetric ciphers using XOR
There is no indication whatsoever that they have. And if they have, the ability to do so is far too valuable to disclose by decrypting your data (unless you happen to be, say, Abu Bakr al-Baghdadi). Furthermore, the more you try to glue your own crypto together, the more likely it is for you to commit a mistake that weakens your overall security rather than strengthens it. Modern crypto is already the strongest weapon in our arsenal; it's infinitely more likely you'll get popped by using crappy passwords, poor op-sec, failing to update software, etc.
Aug
17
comment Is it possible to get an RSA encryption key by comparing the unencrypted and encrypted file?
One thing that you should consider is that in most real-world cryptosystems built on RSA, the public key of the recipient is explicitly included. So even if the "textbook" answer were "no", the answer in the real-world is almost assuredly "yes".
Aug
17
comment Is there a formal definition of what a distinguisher is?
The Wikipedia article on cryptographic advantage may be of use.
Aug
15
comment Hash and salt or salt and hash?
You should not be writing code to hash passwords yourself. Use bcrypt or scrypt and you won't have to care about details like these. Bindings are available for virtually any language you wish.
Aug
14
comment Is (AES-)GCM parallelizable?
Thanks for the correction! I've updated my answer to refer to yours.
Aug
13
comment Chopping off SHA256 entropy?
"More than one in a million" is probably really bad — especially because this number will grow very quickly as the size of data grows.
Aug
5
comment Extension of a password hashing algorithm using Fibonacci
@Yatiac The first step to making something harder is to understand why it's weak in the first place. Trying to harden the non-invertability of SHA-1 is trying to improve its strongest feature for the task of password hashing.
Jul
31
comment What is the advantage of AEAD ciphers?
Could you elaborate on this point? It doesn't have to be at length, just enough to have an idea of the problems you're speaking of.
Jul
18
comment 64bit nonce in AES-CTR, why not 128?
As a trivial example, if you use an incrementing counter for your IV, and that counter is further incremented for each "block" (as defined by CTR mode), the second block of your first plaintext and the first block of your second plaintext will use the same effective IV. Likewise with the third block of your first plaintext, the second block of your second plaintext, and the first block of your third plaintext (and so on).
Jul
10
comment Does AES(x || x) provide secure message authentication when message fits in a single block?
Note that I make no claims about the overall security of the scheme, those are just the immediate concerns I noticed. I suspect that AES being a PRP (and therefore a PRF) ensures that an attacker cannot break this scheme in less than $\DeclareMathOperator{\O}{O}\O(2^{64})$, but I'll wait for actual cryptographers to state that definitively. That said, if you're having to ask questions like these, it's undoubtedly simpler to just use AES-GCM and not try to be clever.
Jul
10
comment Does AES(x || x) provide secure message authentication when message fits in a single block?
This scheme loses semantic security — if you ever encrypt the same message twice with the same key, an attacker can see that the message was replayed (likewise, an attacker can themselves replay messages). You will also at best case only have a 64-bit MAC, which is considered within the realm of brute force. Note also that this scheme is equivalent to padding with 64 bits of zeroes and checking the decrypted text for that value.
Jul
6
comment SHA-256 exhaustive search
Importantly, the hashing algorithm is irrelevant, outside of having a constant (negligible) work factor. The only important part is the entropy in the passwords, which is catastrophically weak and results in only a few million "operations" needing to be performed.
Jul
2
comment Is this client-side password hash scheme secure?
Agreed. At a minimum, PBKDF2 should be used to stretch the user-provided passphrase with a random salt, then HDKF can be used for deriving the encryption key and the password verifier (using a different info string for each). Once the verifier is sent to the server, it can simply be hashed once (SHA-2, BLAKE2b, whatever) before being stored.
Jun
26
comment Prime factorization
I can factor $2^n$ for arbitrary $n$. You might want to clarify the question to ask for the factorization of a random semiprime with $p$ and $q$ of a given size.
Jun
25
comment Establishing encryption key using shared secret
Sure it can. Use the PSK to simply authenticate a DH session whose keys are discarded after use.
Jun
25
comment Establishing encryption key using shared secret
This does not provide forward secrecy.
Jun
25
comment Why is HMAC-SHA1 still considered secure?
No, otherwise that would be the advice. SHA-1's collision resistance is only broken in a theoretical sense right now. No known collisions have yet been found, although the current best attack is just on the edge of feasibility.