2,529 reputation
414
bio website
location Leiden, Netherlands
age 19
visits member for 1 year, 3 months
seen Apr 18 at 2:26

Computer Science student and cryptography enthusiast.

You can contact me at orsonpeters@gmail.com.


Dec
30
comment A timestamping authority (digital notary)
This service is a pretty popular one and has been up for a long time. It's not an "instant" API though, it uses emails and it seems to send your stamp at the end of the day.
Dec
30
comment Are hash trees an alternative, quantum-resistant signature scheme which can replace RSA?
@Reid I did some searching and found the paper. It's exactly what I remembered. Bernstein argues that BHT will never be superior to Grover's in price/performance thanks to the largely inferior memory usage. Running parallel instances of Grover is more cost effective, making BHT obsolete.
Dec
29
comment Are hash trees an alternative, quantum-resistant signature scheme which can replace RSA?
@Reid If I recall correctly Daniel Bernstein analyzed the two algorithms and concluded that no attack will ever be cheaper using Brassard-Hoyer-Tapp then Grover's due to the memory requirements, therefore only $2^{n/2}$ should be taken account for in terms of security levels.
Dec
27
comment Keeping IV secret for AES CFB mode
@M.C. Please stop. There's too many factors/details that can go wrong so I can't simply say your usage is secure. I'd have to look at the actual code/application (and sorry, I'm not doing free work). I'm answering crypto questions in my free time, not doing security audits. I have given you the parameters for correct CFB usage in my answer - it's your job to make it so. And please do not use weasel words while communicating about crypto - there's no such thing as a "cryptographically secure algorithm" that generates IVs and keys. Did you mean a CSPRNG?
Dec
27
comment Keeping IV secret for AES CFB mode
@M.C. Depends on how you use it. Sorry.
Dec
27
comment Keeping IV secret for AES CFB mode
@M.C. With all due respect, I'm going to refrain from saying "the best" about this. Most things are secure if used properly, but what defines properly changes from mode to mode. I can't say what the best mode is for 32 byte data encryption because it's a non-existing question. There's always many other considerations such as speed, parallelizability, changing keys/iv's, database capacity, latency, cipher requirements, etc, etc. It always depends on the application.
Dec
26
comment Proof of shared secret through key derivation
@Reid I already said that "as long as you always use a constant size key and tag". Otherwise you can use HMAC, yes.
Dec
26
answered Proof of shared secret through key derivation
Dec
25
comment Keeping IV secret for AES CFB mode
@M.C.: What makes you think I think that CFB is not secure?
Dec
22
answered Keeping IV secret for AES CFB mode
Dec
22
answered What's the alternative should PKI collapse?
Dec
20
comment How to use HKDF to combine two keys
@user10988 In your scenario HKDF basically comes down to a HMAC-SHA-256 call. HMAC has no advantage compared to SHA in this scenario, because the input is of constant length, so you might as well hash.
Dec
20
answered How to use HKDF to combine two keys
Dec
17
answered What does pseudo pre-image of a hash function mean?
Dec
16
awarded  Custodian
Dec
16
revised Is AES still secure considering all this NSA/Snowden scandal?
added 479 characters in body
Dec
16
answered Is AES still secure considering all this NSA/Snowden scandal?
Dec
15
comment Are IVs and salts the same and usable for each other uses?
@Max13 There's a subtle difference. You only need an IV for encryption algorithms if you encrypt multiple messages under one key. You're not doing that so you don't need one. You're not really "feeding your salt as an IV" or "feeding your IV into PBKDF", you're just generating an unique key for each file by having an unique salt - thus you don't need an IV. Hence my suggestion of setting the IV to 0.
Dec
15
comment Are IVs and salts the same and usable for each other uses?
@Max13 If you're using a per-file salt I'd suggest you to feed that into PBKDF. Since then you have an unique key for each file that's only used once you don't need to have an unpredictable IV at all (which is only relevant when encrypting multiple messages). I'd suggest you to use an IV of 0 instead in that scenario.
Dec
15
comment Are IVs and salts the same and usable for each other uses?
@Max13 The randomness quality is not the problem. The problem is that if you are using a PBKDF on the password with a salt you are probably not changing the salt. This means that the IV doesn't change, which is detrimental to security. See this question as well: crypto.stackexchange.com/questions/5868/…