2,377 reputation
424
bio website touset.org
location San Francisco, CA
age 30
visits member for 1 year, 10 months
seen 16 hours ago

Cyclist. Rubyist.


Jul
3
comment SHA256 output to 0-99 number range?
This only works if he doesn't require integers.
Jul
3
comment Is SHA256 good enough to shrink a key?
Since you have PBKDF2, you can also just do one iteration of that using both the keys as input, and the specified length as output. But SHA-256 works too.
Jun
30
comment Pi Message Encryption
@otus This doesn't really solve that issue anyway, since related-key attacks are trivial; even if you wanted to keep the spirit of this approach, you'd want to feed the output through a PRG anyway to avoid close keys effectively becoming two-time pads.
Jun
30
comment Pi Message Encryption
I agree. That said, I think it's important to be clear where this approach falls in the general spectrum of security. This approach will not likely benefit from repeating a cycle of pointing out weaknesses and "patching" them.
Jun
30
comment Pi Message Encryption
Even then, there are catastrophic flaws in the implementation. No use of initialization vectors. No authentication of the ciphertext. Operation on characters rather than bytes. This is something you might use to "encrypt" notes passed around in high school, and no more.
Jun
30
comment Pi Message Encryption
Any sane encryption algorithm shouldn't care about "characters" anyway. It should care about bytes.
Jun
30
comment Pi Message Encryption
This is a poor idea simply because you gain nothing by choosing an offset of $\pi$. Even assuming $\pi$ is unpredictably random, the "key" is the index of the starting digit of pi you wish to use, and to meet modern security expectations, it would need to be at least 128 bits long. But if you already have a 128-bit random key, you're done — you don't need to index into pi to get random digits!
Jun
26
comment Is it possible to get better randomness by using multiple PRNGs?
I must confess I took the assumption about being seeded from individual sources for granted; thanks for pointing it out! Actually, an even better example would be two identical PRNGs seeded from the same TRNG — they would produce the same bit sequence, and thus their XOR would be all zeroes.
Jun
26
comment Is it possible to get better randomness by using multiple PRNGs?
No need to do any kind of complex decision-making logic. Simply XORing PRNG outputs will do; at worst, the result has the same entropy as the most entropic of the inputs. For instance, if one of the inputs is truly random, and the other is completely attacker-controlled, the XOR of the two is still completely random and unpredictable to an attacker.
Jun
25
comment Using PBKDF2 twice with different argument order
You appear to have edited the response, but still only assert that $a = b$ is disastrous. How can an adversary subversively choosing their own password lead to the compromise of other parties' keys, as you claim?
Jun
20
comment How big an RSA key is considered secure today?
While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes.
Jun
18
comment Length-preserving all-or-nothing transform
@fgrieu You're right. I'd originally conceived it as doing CBC a second time over the reversal of the ciphertext, but as D.W. explains in his answer, the entire construct is unnecessary in the first place. Oh well.
Jun
18
comment Using PBKDF2 twice with different argument order
Can it? By what property?
Jun
17
comment Does this protocol provide Perfect Forward Secrecy / are there potential security flaws?
Why should anyone bother to analyze this protocol? What advantage does the scheme have over TLS? What problem are you trying to solve, that is not already solved by existing protocols?
Jun
17
comment Using PBKDF2 twice with different argument order
At best, you're in a situation where you're using the algorithm in a way which hasn't been nearly as thoroughly cryptanalyzed. Better would be to use two separate cryptographically random salts, one for each usage purpose.
Jun
17
comment Length-preserving all-or-nothing transform
I'm sure there's something trivially wrong with that, but perhaps it will stoke some interesting discussion.
Jun
17
comment Length-preserving all-or-nothing transform
I'm thinking something like the following. Given some $i$-block message $m = m_{0} || m_{1} || \cdots || m_{i - 2} || m_{i - 1}$, let $c' = E_{CBC}(k, 0, m_{0} || m_{1} || \cdots || m_{i - 2} || m_{i - 1} || m_{i - 1} || m_{i - 2} || \cdots || m_{1} || m_{0})$. The ciphertext is $c = c'_{i} || c'_{i + 1} \cdots || c'_{i * 2 - 2} || c'_{i * 2 - 1}$.
Jun
12
comment Given $n$ bits, how many “truly random” sequences/numbers can be constructed?
Many well-designed PRNGs are capable of generating the full $2^n$ bits of their output space, even if they are not cryptographically secure. The important property of a CPRNG is that the next bit is always computationally indistinguishable, even if you have all of the previous generated bits.
Jun
11
comment Why must IV be sent with each packet?
To be clear, CBC does randomize subsequent blocks by XORing previous blocks within a message. A single message consists of one or more blocks, and each message needs its own unique (and random) IV.
Jun
11
comment Why does PBKDF2 xor the iterations of the hash function together?
Can you explain further what a "rho" structure is? It seems counterintuitive that this is a strong protection against a short cycle. If some $U_n, U_{n+1}, \cdots, U_{n+k-1}, U_{n+k}$ exist such that $U_{n+k+1}$ = $U_{n}$, it seems trivial that their XOR pattern will cycle through $2k$ unique values beginning at $U_{n}$.