2,951 reputation
526
bio website touset.org
location San Francisco, CA
age 31
visits member for 2 years, 6 months
seen 2 hours ago

Cyclist. Rubyist.


Mar
10
comment Known plaintext, unknown 128 bit block cipher
If you can control part of the plaintext that gets encrypted, you can potentially break this trivially.
Mar
10
comment CTR HMAC SHA256 implementation
Great, just checking.
Mar
10
comment CTR HMAC SHA256 implementation
What would you be adding a salt to? This sounds worryingly offhand, as if randomly tossing in a salt here and there might improve security.
Mar
8
comment how to integrate 2-3 algorithms to encrypt large data fastly and securely insted using AES?
Additionally, no modern cryptographic algorithm will perform differently based on what type of data it's operating on. Video, audio, text, and anything else is irrelevant, because modern ciphers operate on raw bytes.
Mar
5
comment How to compare between two cryptographic algorithms in terms of security?
Outside of simply misusing the primitives are flaws derived from not understanding the security model. Replay attacks, for example.
Mar
5
comment How to compare between two cryptographic algorithms in terms of security?
The odds are virtually infinitesimal if you're actually implementing the cryptographic primitives yourself. If you're "simply" gluing together existing primitives, the odds are merely severely stacked against you. c.f., every password hashed with MD5/SHA, keys and data appended and hashed for a poor man's (broken) MAC, timing attacks against MACs compared for equality, encrypt-then-mac and mac-and-encrypt schemes, use of unauthenticated encryption modes, IV reuse, rand, etc. There are uncountably infinite ways to get it wrong, and precious few to get it right.
Mar
4
comment How difficult is it to get a key using simple XOR
"Only" 256 bits long.
Feb
23
comment AES ECB experiment
For starters, key derivation from a password is outside of the scope of encryption modes. Simply assume that the user has provided you with a cryptographically-strong encryption key of the appropriate length. Second, it's better to start out by understanding the weaknesses that ECB mode has and composing a solution that directly addresses them, rather than taking a stab in the dark and asking "is this secure?"
Feb
13
comment Why is Poly1305 popular given its 'sudden death' properties?
HMAC is not based on any particular hash function. In fact, any PRF may be used as the underlying primitive for an HMAC.
Feb
13
comment Why is Poly1305 popular given its 'sudden death' properties?
And that has little to do with the actual question. HMAC is a provably secure construct, even assuming many kinds of broken hash function. The security of HMAC is under no doubt whatsoever by the cryptographic community.
Feb
13
comment Why is Poly1305 popular given its 'sudden death' properties?
This doesn't attempt to answer the question actually asked. It also asserts motivations of DJB that are completely unsupported.
Feb
8
comment Are passwords generated from sine vulnerable to certain attacks?
Yes, easily. Calculate sin(x) for 0 through 179. Try six through twenty digits for each of them, plus try including and removing the decimal. 5,400 guesses, and I have the password. In fact, now that you know this, you could easily script up something to figure out his password. Worst of all is that this results in the same password for every site.
Feb
5
comment Size of a MAC for a quickly checked message?
For a short enough tag, an attacker can just start over and try again from scratch every second without much penalty.
Jan
23
comment Simple message authentication code
RickyDemer's original response, for starters. At a minimum, your construct would require additional properties from the hash function that are unnecessary in HMAC. Additionally, it requires the use of a block cipher which is unnecessary in HMAC. And that block cipher itself has to have certain security properties, which again is unnecessary in HMAC. Even if your construct is secure, it's slower, more complicated, and is less safe in the event that its underlying building blocks become weakened.
Jan
23
comment Simple message authentication code
I'm not certain how either of your questions pertain to my reply. HMAC has a proof of security that only relies on on the underlying compression function being a PRF. It does not rely on any other properties typically expected of a hash function, so any PRF can be used. How this would relate to the security properties of any other MAC or to hash functions in general is lost on me.
Jan
23
comment Simple message authentication code
@RickyDemer is correct. HMAC does not rely on collision resistance of the underlying hash; HMAC-MD5 is still completely sound (although poor taste), outside of its digest length.
Jan
22
comment How does RSA padding work exactly?
RSA encryption does not involve hashing the plaintext message. For messages that are larger than the RSA modulus, typically one generates a random key for a symmetric encryption algorithm, encrypts the plaintext with that, then encrypts the symmetric key using RSA, and sends both the encrypted key and the encrypted plaintext as one bundle. In RSA signing, one hashes the plaintext message before creating the RSA signature using the hash.
Jan
22
comment Secure way to encrypt and decrypt a folder on Mac or Linux?
As a novice, you should be orders of magnitude more worried about something you've implemented yourself by stringing together commands with OpenSSL than in weaknesses in something high-level that tries to make correct decisions for you like VeraCrypt/TrueCrypt. Choosing "good" primitives like AES is only one of many variables that need to be picked correctly.
Jan
22
comment Secure way to encrypt and decrypt a folder on Mac or Linux?
Symmetric encryption algorithms do not work on passwords; they work on keys, which are expected to be random bytes (256 bits worth in the case of AES-256). In the optimal case, you simply store this random key separate from the data it's encrypting. If you want a "password" to protect the data, the two typical approaches are 1) to use a KDF like PBKDF2 to "stretch" the password to increase its effective entropy and distribute its entropy evenly across the number of bits expected by the algorithm, or 2) to use the password (and a KDF) to encrypt an actually random key, a la the first approach.
Jan
21
comment Secure way to encrypt and decrypt a folder on Mac or Linux?
If detection of tampering is important to you, use GCM mode instead of CBC. Also, 256-bit AES will be somewhat slower, and is likely overkill for your scenario. Also, if you keep the key on the same media as the encrypted file, you aren't actually gaining much (if anything). For OSX, you may want to look into encrypted sparseimages which can be made with Disk Utility, but aren't accessible cross-platform.