meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 7 months |
| seen | yesterday | |
| stats | profile views | 4 |
|
Apr 29 |
comment |
Custom crypto library in C I don't understand how the sleep function can help you prevent timing attacks : how do you know how much time you need to sleep ? Also if your using the worst case running time as a reference you need to know what it is precisely on the platform your library is running which requires fine tuning after every install which. May I ask why you're not using and existing library (NaCl, openssl ect) ? |
|
Mar 6 |
comment |
Is this encryption algorithm build from MD5 secure? Look at the effect of flipping a bit in the last ciphertext block, if I understood the algorithm correctly this only flips the corresponding bit in the last plaintext block which might be useful if you know the format of the message even if you don't know the content |
|
Feb 23 |
comment |
Why nobody considers counter re-keying as a standard Block Cipher Mode? Interestingly those approaches are looked at carefully in the context of side channel attacks : this prevents differential power analysis (since we cannot get traces on the same key) and the counter measures for SPA are well understood |
|
Feb 15 |
comment |
Encrypting a key with the same key Practically speaking it's so unlikely that it cannot be called "insecure". Theoritically speaking, if you take a look at the insides of aes you'll see that the first operation is xoring the plaintext with the key, effectively cancelling the state whatever the key. From then on the only difference between $AES_K(K)$ and $AES_{K'}(K')$ will come from the difference in the key scheduling of both keys. Hope it helps |
|
Feb 9 |
comment |
Name for identical operations for encryption and decryption What you consider a weakness can also become a strenght in some contexts. For example, embedded designs have very strict space requirements : having a encryption algorithm that is its own inverse is then something really valuable. Even in software it can be thought of as a good idea : less code means easier maintainability. Anyways I would say that while you're not wrong, if you can avoid it, do not give an encryption oracle to your adversary in the first place ! |
|
Jan 24 |
comment |
Super-symmetric Stream cipher It means that if done well you have to independant stream ciphers |
|
Jan 23 |
comment |
Initialize a PRNG with a password I think I understand but generating with weak randomness isn't worth the fact that you don't have to store your keys. If I could store 256 bytes I rather seed my DPRNG with actual randomness then use [tools.ietf.org/html/rfc2898#section-6.2] to protect the key ? |
|
Dec 19 |
comment |
AES vs Blowfish taking key-length into account When considering the margin of security one should not forget that AES is THE target for more than 10 years now while the cryptanalitic effort on blowfish is not as strong nowadays |
|
Dec 18 |
comment |
Good enough deterministic PRNG based on hashes Good point, I forgot about the key reduction step |
|
Dec 17 |
comment |
Good enough deterministic PRNG based on hashes "In particular if the seed is longer than 128 bytes it becomes totally insecure" why ? |
|
Dec 13 |
comment |
Probability that an attacker wins the discrete logarithm game when exponents are drawn from a subset There's even a tradeoff between the running time of your algorithm and the success probability since instead of failing if the input doesn't fall in the acceptable subset you can randomize your input via a multiplication by $g^r$ (with random $r$) and run it again. I think that's called Random Self Reducibility |
|
Dec 7 |
comment |
RSA 4096 bit key benchmark I guess it's just vocabulary here but rather than ECDH an elliptic curve alternative for mary would be ECIES which uses ECDH as a key establishment scheme |
|
Dec 7 |
comment |
using Post-quantum asymmetric ciphers instead of RSA @CodeInChaos what construction were you thinking about ? I don't think composition is a terrible idea but there are exemples in which it breaks. Maybe pick $r$ at random then $m_0\gets r\oplus m$ and $m_1 \gets r$ ? |
|
Dec 7 |
comment |
Why are protocols often proven secure under the random oracle model instead of a hash assumption? Interestingly enough while a construction $H^2:x\to H(H(x))$ does not have this length extension property it is still distinguishable from a RO H^2 & HMAC |
|
Dec 7 |
comment |
Factorize RSA knowing several N and E Yeah, like CodesInChaos I would have tried gcd on the modulis... |
|
Dec 7 |
comment |
using Post-quantum asymmetric ciphers instead of RSA Hasn't NTRU been broken several time by Faugère's work on Gröbner basis ? |
|
Dec 6 |
comment |
Securing a lookup table I think we can sum up Thomas's questions by What security goal are you actually trying to achieve ? |
|
Nov 29 |
comment |
How to prove membership of a list without disclosing the list members? @poncho When you say there's a leak of information you mean that statistically don't you ? In which case the unlikelihood of a collision becomes irrelevant since statistical operators like correlation do not care about computational hardness. Also I might be mistaken in my reasonning but there is an infinity of $R2'$ such that $hash(A||R2||hash(m))=hash(A||R2'||hash(m))$ and unless the $Ri$'s have a specific structure an attacker would be unable to tell apart the actual $R2$ from any of the other $R2'$. |
|
Nov 28 |
comment |
How to prove membership of a list without disclosing the list members? @poncho or we just found a collision for hash... |
|
Nov 27 |
comment |
Safety of DSA key parameters sharing Thanks for the reference and for the precision |
