879 reputation
114
bio website
location
age
visits member for 1 year, 11 months
seen 22 hours ago

May
28
revised How to verify a shared secret using only AES?
specify size of P to avoid mode issues
May
28
comment How to verify a shared secret using only AES?
Indeed; suggested update to answer to make that constraint clear.
May
28
suggested approved edit on How to verify a shared secret using only AES?
May
28
comment How to verify a shared secret using only AES?
Be careful if you choose an unauthenticated mode to encrypt P_own||P_other - for example if you use CTR (or CFB with a 1 block size message) an attacker can subvert the protocol by computing E(k, P_b||P_a) from P_a, P_b and E(k,P_a||P_b); if using ECB and P_a and P_b are each a multiple of the block size, a trivial rearranging of the messages is all that is needed.
May
28
answered Which keys are necessary to decrypt Application data in a SSL connection?
May
19
comment Is this algorithm secure?
That's right; provided the password is there in full in the input to HMAC (if HMAC is being used with a standard hash algorithm), adding additional entropy-less data doesn't lower the entropy of the output.
May
19
answered Is this algorithm secure?
May
18
revised Is Base64(SHA1(GUID)) still unique like the original GUID?
remove length per Paulo's comment
May
18
comment When truncating an AES MAC value by “w” , how do I justify that “w” is still negligible?
Thanks Watson, please do edit the answer.
May
17
answered Is Base64(SHA1(GUID)) still unique like the original GUID?
May
17
answered When truncating an AES MAC value by “w” , how do I justify that “w” is still negligible?
May
16
revised Help me describe/identify this challenge-response protocol/algorithm?
defaultdict
May
16
awarded  Editor
May
16
revised Help me describe/identify this challenge-response protocol/algorithm?
generate random vector
May
16
answered Help me describe/identify this challenge-response protocol/algorithm?
Feb
25
awarded  Critic
Feb
25
comment Deriving HMAC key and cipher key from passphrase?
Never roll your own crypto.
Feb
24
answered Bad/Crackable Encryption Example?
Feb
16
answered Is it possible to generate an RSA SHA1 signature only from a public key?
Jan
25
answered Secure communication between multiple peers on a public channel