Reputation
Top tag
Next privilege 250 Rep.
View close votes
Badges
7
Newest
 Commentator
Impact
~312 people reached

  • 0 posts edited
  • 10 helpful flags
  • 240 votes cast
Apr
15
comment Is it possible to brute-force a hash algorithm of 32 bits
Collisions are irrelevant for attacking password hashes. You already have the hashes, so what you need is to find the pre-images for those hashes.
Apr
11
comment Is GCM still recommended?
@AnthonyKraft Another approach to mitigating repeating IV issues is a nonce-misuse-resistant construction. For AES-GCM, this comes in the form of AES-GCM-SIV.
Apr
4
comment How to reverse engineer a cryptography algorithm if some input-output pair is known.
I would not vote to migrate this question, as it demonstrates a lack of understanding of basic cryptanalysis techniques.
Mar
4
comment Confidentiality then Integrity with different keys
This is, in fact, a cross post of the question @SEJPM links to.
Mar
2
comment Dangers of using CTR mode for encryption
So, I wouldn't say that "it is never suggested" but rather that "it is catastrophic."
Mar
2
comment Building multiple keys from the same input using a KDF
Iteration count is irrelevant when a high entropy key is the input. If the input is no easier to guess than the output, you don't need iterations to add work factor to the generation process. And this is not a new construct, though oddly implemented. Generally speaking, this is how a KBKDF is used.
Mar
2
comment Building multiple keys from the same input using a KDF
If you have a high entropy secret, use a KBKDF (key-based KDF) not a PBKDF (password-based KDF)
Feb
22
awarded  Commentator
Feb
22
comment How to correctly encrypt data with proper authentication using AES-256-CBC in php?
And from @ArtjomB.'s second link, if you're using PHP 5.4 or above, just use: github.com/defuse/php-encryption
Feb
17
comment Why was AES limited by NIST to a 128-bit block size, although Rijndael could support more?
128 bits was a reasonable block size in 1997, when the AES competition was announced. (Remember, AEAD didn't even exist at that point.) Allowing for an two block sizes in the final approved configuration would have required twice the analysis required for a given confidence level, and there was no practical need at the time.
Feb
17
answered Unclear about the importance of Initialization Vectors
Jan
8
comment Is it secure to use hexadecimal data for IV instead of raw binary?
@StephenTouset Sure...I would generally use the term nonce in that case, rather than IV, but that's splitting hairs.
Jan
8
revised Is it secure to use hexadecimal data for IV instead of raw binary?
edited body
Jan
8
answered Is it secure to use hexadecimal data for IV instead of raw binary?
Sep
30
awarded  Critic
Aug
21
revised zendo data size restrictions
Fix typo
Mar
26
comment zendo data size restrictions
@Gilles I don't know for sure, but since as you say, not all phones have a hardware RNG, I don't see how it can be anything else. Additionally, since it is not under the control of the application, as you point out, they can't reasonably claim that it is a true OTP, because they don't have the required level of control to provide that guarantee.
Mar
26
awarded  Teacher
Mar
25
answered zendo data size restrictions
Mar
25
comment zendo data size restrictions
There is no OTP in any case. As I understand it, the entropy on modern mobile devices depends on a CSPRNG, not (only) a source of true randomness, making this an implementation of a stream cipher, not an OTP. They don't actually know what they're doing, in other words.