Reputation
2,728
Top tag
Next privilege 3,500 Rep.
Protect questions
Badges
6 18
Newest
 Caucus
Impact
~52k people reached

Mar
27
asked Is this a valid scheme to authenticate through a 'human-readable' certificate?
Feb
21
comment Anonymous Gravatar Problem
The ephemeral key is generated by the site that wants to embed a gravatar. They may choose to cache it for future use, or generate a new one for every gravatar. They shouldn't leak the private key however, as this will expose the hash of the user's email address. The public key is included in the gravatar URL, as said in the answer, so it's public knowledge. The difference between my answer and CodeInChaos's is that I explicitly give a scheme for the URL, display the primitives used and use ECDH rather than ECC.
Feb
17
answered Anonymous Gravatar Problem
Jan
16
comment Why is EdDSA collision-resilient with SHA-512?
Reference to herding attack, pretty easy to understand: cs.haifa.ac.il/~orrd/HashFuncSeminar/OhadLutzky.pdf
Jan
12
comment Where are the ChaCha20 test vectors/examples?
You can generate your own test vectors with the reference implementation.
Jan
7
awarded  Yearling
Oct
28
comment Can you help me understand PFS and wPFS?
@T.B I don't know - I do not have access to that specification (and I'm not going to pay for it, sorry).
Sep
30
awarded  Explainer
Jul
2
awarded  Curious
May
1
comment Is AES still secure considering all this NSA/Snowden scandal?
@JW. Optimized code is more difficult to understand, that is correct. But there should be no excuse for "accidently branching ons secret data". It's very hard to justify any form of branching in crypto code, as often everything is unrolled anyway, and the very few places where you do branch should be on loops with arbitrary data length. There is no excuse for incorporating legacy code that does not follow the same design principles. These are the burdens you take onto you when you write crypto code, but that doesn't make it "hard", or "almost certainly broken with side channels".
Mar
14
comment How is a public key actually used to encrypt something?
@fgrieu I was only explaining to the asker how it would be possible to exponentiate a word document, I did not mean to suggest that it's either secure or practical.
Mar
12
comment How is a public key actually used to encrypt something?
@TylerDurden A form of encryption where you have a small shared secret (the private key - there is no public key), and use that small shared secret to encrypt any amount of data. Examples of such algorithms include AES, Salsa20, and more historic examples are Blowfish and (3)DES.
Mar
12
answered How is a public key actually used to encrypt something?
Mar
9
awarded  Announcer
Feb
27
comment Non-standard signature security definition conforming ed25519 malleability
Another attack: github.com/jedisct1/libsodium/issues/112
Feb
11
comment How can we sign a contract digitally between two parties?
@RickyDemer Sadly, I have lost said device. Oh and I had written down the password on a post-it attached to the device. What a shame...
Feb
3
comment Is 80 bits of key size considered safe against brute force attacks?
This question appears to be off-topic because the crux of the question is opinion, because what you consider safe is different from someone else. And the nature of the question is not related to cryptography regardless - this is simply calculating the cost of an attack, basic math.
Jan
26
comment Can curve25519 keys be used with ed25519 keys?
@sellibitze Eehm maybe you misunderstood me, that was exactly my point.
Jan
24
comment Keeping IV secret for AES CFB mode
@DmitryKhovratovich Any "impossible to predict" algorithm, such as a random number generator, might also generate previously encrypted intermediate blocks as IVs. It's irrelevant to the choice of generating IVs - it's a weakness of CFB in general. But this is no reason to downvote my perfectly valid answer.
Jan
24
comment Keeping IV secret for AES CFB mode
@DmitryKhovratovich I don't think my answer is incorrect. I clearly stated in my answer that the IV may not be chosen by an attacker. So the attack "Consider, for instance, that you choose one of intermediate..." does not apply.