273 reputation
112
bio website
location Sweden
age 41
visits member for 1 year, 7 months
seen Apr 17 at 13:08

Aug
13
awarded  Popular Question
Jul
2
awarded  Curious
Dec
31
awarded  Yearling
Jul
31
accepted Authenticated DH, what protocols are secure?
Jul
30
comment Why use variable p, q, g for Diffie-Hellman?
@mikeazo what's typically used?
Jul
30
comment Why use variable p, q, g for Diffie-Hellman?
@mikeazo any examples of systems using fixed p/q/g and systems that generate them?
Jul
30
comment Why use variable p, q, g for Diffie-Hellman?
@mikeazo given that one uses safe primes, what's the risk of a trapdoor? That it isn't a strong prime?
Jul
23
comment Using same AES-GCM setup for multiple packets?
@archie Oh, nice spotted. I was using 1.46 where no key would throw a nullpointer exception. 1.49 worked nicely though. Interestingly BC's AES-GCM is about equivalent (for small packets) to AES-CTR + HMAC-MD5, which is about twice the speed of AES-CTR + HMAC-SHA256. Which in turn makes AES-GCM about 6-7 times slower than the JCE AES-CTR.
Jul
22
comment Secure Sketch Construction
@owlstead the reason why I suggest this, is because we can scramble the password using a hash and the algorithm would still work as long as we then scramble s00, s01, s10 and s11 in the same manner.
Jul
22
comment Secure Sketch Construction
@owlstead I updated my answer somewhat. But basically I want to take the grid width x height and reduce it to width / precision x height / precision. If we imagine each selection being precision x precision large, then they will reduce to 4 points on the reduced grid. Alternatively you don't reduce the grid and simply check against all precision x precision points. You can use a circle too of course, that would be more exact, although less efficient to calculate - and more useful when you don't reduce the grid.
Jul
22
revised Secure Sketch Construction
Corrected formula for points.
Jul
22
comment Is this an acceptable authenticated encryption?
I'm aware of Bouncy Castle of course, but the tests I've made so far left me with a feeling that the cipher implementations vary greatly in quality and reliability.
Jul
22
comment Is this an acceptable authenticated encryption?
@Reid if there was an easy way to combine SSL with a lightweight TCP/IP protocol, I'd do that. In my case the servers are running Java. As of 1.7 java cryptography still doesn't support GCM, so I'm unsure if the java SSLEngine provides it. In any case, the SSLEngine hooks are a very bad match for async IO, which is pretty much a requirement for the type of connections we have. On top of this I also need to build resource exhaustion DoS mitigation strategies . All of this adds layers brittleness and complexity, which by far is a worse threat than a security breach due to broken protocol design.
Jul
21
comment Is this an acceptable authenticated encryption?
@Reid finally, since this question is particularly aimed at creating an encryption+authentication primitive, is really SSL a good thing to point to? I mean, given the poor reputation the authenticate-then-encrypt of SSL has. Or is this your way of suggesting I use AtE?
Jul
21
revised Is this an acceptable authenticated encryption?
Added code sample for HMAC comparison.
Jul
21
comment Is this an acceptable authenticated encryption?
I know that there are many, many subtle problems when creating the overall protocol, but even so, establishing a solid, efficient, AE primitive is an important step in the overall performance of encryption.
Jul
21
comment Is this an acceptable authenticated encryption?
(3) Are there any security issues with CMAC?
Jul
21
comment Is this an acceptable authenticated encryption?
(1) What nonce? There are two nonces, but they are used to derive IV/key/sign key. Modifying either nonce would break all signing.
Jul
21
comment Is this an acceptable authenticated encryption?
@owlstead There are no passwords, just a shared secret which - as I write - has a 24 hour lifetime and is randomly generated. As for salts, in step (1) I write that I use a salt. So the KDF could (for example) be HMAC(Secret, Client Nonce || Server Nonce || "KeyIVServer") and HMAC(Secret, Client Nonce || Server Nonce || "KeyIVClient") respectively.
Jul
21
comment Is this an acceptable authenticated encryption?
@Reid yes there is a protocol behind this, basically split into a SIGMA protocol with only one side authenticated against a login server. That server provides a Kerberus-style ticket which is used to login to the real game servers. I could go into details, but it should be sufficient to say that it's not very good to use the full SSL/TLS connecting to the game servers directly.