Reputation
2,683
Top tag
Next privilege 3,500 Rep.
Protect questions
Badges
5 16
Newest
 Yearling
Impact
~49k people reached

Mar
30
comment Is this a valid scheme to authenticate through a 'human-readable' certificate?
While I do not 100% agree with your notions in point #1 and #2, I did not consider the attack where Eve swaps out questions for those she knows the answer with. Do you know of any secure scheme where two human users can prove their identity to eachother through some means without having shared a cryptographical certificate/secret beforehand? Is it possible at all?
Mar
30
comment Is this a valid scheme to authenticate through a 'human-readable' certificate?
You have no idea how much entropy there is with question/answers, it could be an arbitrary amount. Could you elaborate on your replay attack? I don't fully understand what Eve would replay, and how it would affect security.
Mar
30
comment Is there an existing authorative definition of the cryptographic term 'pepper'
@RichieFrame Forgive me, but isn't giving an advantage to systems with more cores the opposite of what you want? The less parallel an attack, the more expensive it becomes.
Mar
27
comment Is this a valid scheme to authenticate through a 'human-readable' certificate?
@RickyDemer I clarified in the question that Eve does not know the answer to the questions at least until the long-term exchange of certificates has completed.
Mar
27
comment Is this a valid scheme to authenticate through a 'human-readable' certificate?
@RickyDemer It is right there: "let's assume that Eve does not know the answer to the questions at the time of the exchange". This excludes being able to guess the answers in the timeframe of the exchange.
Mar
27
comment Is this a valid scheme to authenticate through a 'human-readable' certificate?
@RickyDemer Just like it's infeasible to guess the private key, I assume the questions are of sufficient quality it's infeasible to guess them, at least within the timeframe of the exchange. The questions I used as an example are weak toy questions. $H$ is a slow hash function, like scrypt.
Mar
27
comment Is this a valid scheme to authenticate through a 'human-readable' certificate?
@RickyDemer If bruteforce on the answers is the strongest attack on this scheme, that would qualify it as 'secure', wouldn't it? Your argument could also be used to say public signatures are insecure, because it allows you to check your guesses for the private key.
Feb
21
comment Anonymous Gravatar Problem
The ephemeral key is generated by the site that wants to embed a gravatar. They may choose to cache it for future use, or generate a new one for every gravatar. They shouldn't leak the private key however, as this will expose the hash of the user's email address. The public key is included in the gravatar URL, as said in the answer, so it's public knowledge. The difference between my answer and CodeInChaos's is that I explicitly give a scheme for the URL, display the primitives used and use ECDH rather than ECC.
Jan
16
comment Why is EdDSA collision-resilient with SHA-512?
Reference to herding attack, pretty easy to understand: cs.haifa.ac.il/~orrd/HashFuncSeminar/OhadLutzky.pdf
Jan
12
comment Where are the ChaCha20 test vectors/examples?
You can generate your own test vectors with the reference implementation.
Oct
28
comment Can you help me understand PFS and wPFS?
@T.B I don't know - I do not have access to that specification (and I'm not going to pay for it, sorry).
May
1
comment Is AES still secure considering all this NSA/Snowden scandal?
@JW. Optimized code is more difficult to understand, that is correct. But there should be no excuse for "accidently branching ons secret data". It's very hard to justify any form of branching in crypto code, as often everything is unrolled anyway, and the very few places where you do branch should be on loops with arbitrary data length. There is no excuse for incorporating legacy code that does not follow the same design principles. These are the burdens you take onto you when you write crypto code, but that doesn't make it "hard", or "almost certainly broken with side channels".
Mar
14
comment How is a public key actually used to encrypt something?
@fgrieu I was only explaining to the asker how it would be possible to exponentiate a word document, I did not mean to suggest that it's either secure or practical.
Mar
12
comment How is a public key actually used to encrypt something?
@TylerDurden A form of encryption where you have a small shared secret (the private key - there is no public key), and use that small shared secret to encrypt any amount of data. Examples of such algorithms include AES, Salsa20, and more historic examples are Blowfish and (3)DES.
Feb
27
comment Non-standard signature security definition conforming ed25519 malleability
Another attack: github.com/jedisct1/libsodium/issues/112
Feb
11
comment How can we sign a contract digitally between two parties?
@RickyDemer Sadly, I have lost said device. Oh and I had written down the password on a post-it attached to the device. What a shame...
Feb
3
comment Is 80 bits of key size considered safe against brute force attacks?
This question appears to be off-topic because the crux of the question is opinion, because what you consider safe is different from someone else. And the nature of the question is not related to cryptography regardless - this is simply calculating the cost of an attack, basic math.
Jan
26
comment Can curve25519 keys be used with ed25519 keys?
@sellibitze Eehm maybe you misunderstood me, that was exactly my point.
Jan
24
comment Keeping IV secret for AES CFB mode
@DmitryKhovratovich Any "impossible to predict" algorithm, such as a random number generator, might also generate previously encrypted intermediate blocks as IVs. It's irrelevant to the choice of generating IVs - it's a weakness of CFB in general. But this is no reason to downvote my perfectly valid answer.
Jan
24
comment Keeping IV secret for AES CFB mode
@DmitryKhovratovich I don't think my answer is incorrect. I clearly stated in my answer that the IV may not be chosen by an attacker. So the attack "Consider, for instance, that you choose one of intermediate..." does not apply.