Reputation
2,952
Top tag
Next privilege 3,000 Rep.
Cast close & reopen votes
Badges
4 17
Newest
 Yearling
Impact
~62k people reached

5h
awarded  Yearling
2d
comment NIST HMAC Test vectors
Good answer. The NIST CAVP test vectors are based on values they have chosen to be generated. These four values chosen are example. It is not feasible to have all the possible values in the test vectors so they need to pick some. However, when a cryptographic product is validated (in Cryptographic Algorithm Validation Program, such as for FIPS 140-2), it is possible to select specific key sizes, which will be tested.
Jan
21
comment Understanding ransomware – What makes plain-text-attacks or brute-forcing so hard?
Concerning discussion on RSA private key vs. public key length: RSA private exponent is typically much larger than public exponent, so private key if it includes modulus will still be larger than public key. However, storing material that allows quick computation of modulus and private exponent will allow RSA private keys presented in as many bytes as RSA public key or even less. For example, e.g., storing these values: $p$, $q$, $e$, will take pretty identical space to $n$, $e$.
Jan
12
revised Are the SHA family hash outputs practically random?
fixed first sentence
Jan
6
comment Difference between a nonce and IV
There is no safe maximum. You need to choose what probability is sufficient for you (or maybe there is a relevant standard for your application). See birthday attack on Wikipedia for table of collision probabilities.
Nov
17
comment Will our app be FIPS 140-2 compliant if we use our own AES algorithm implementation?
The correct phrase is FIPS 140-2 validated, see FIPS 140-2 Logo program. It is Certification Mark of NIST. The FIPS 140-2 compliant term is occasionally misused.
Sep
24
comment Secure method for encrypting 32 byte private keys
32 byte (or 256-bit) key is approximately equivalent to approx 43 characters randomly chosen from all alpha numeric characters. Even with a very good password-based key derivation function (PBKDF), you can expect the strength of the password to be weak compared to the keys.
Sep
23
answered Why a key pair is used in OpenSSL ECDSA_sign or ECDSA_do_sign instead of only private key ?
Sep
17
comment Obtain 384 bits from a 256bit MasterSecret
Is there a good reason to require exactly 128-bit IV? The default IV length for AES-GCM is 96 bits. Larger IV lengths than that will be (a bit) less efficient. See NIST SP 800-38D, section 8 for some discussion on choosing IV for GCM.
Sep
5
answered What are the strenghts and weaknesses of Whirlpool Hashing Algorithm
Jun
22
comment Practical disadvantages of GCM mode encryption
There are at least two GCM IV reuse vulnerabilities: key-recovery of H and losing confidentiality of the cipher text (common for all modes that use counter mode). You may want to look at Rogaway's excellent paper Evaluation of Some Blockcipher Modes of Operation, which contains very good description of security features of GCM and other NIST recommended block cipher modes of operation and references to papers further describing these reuse vulnerabilities.
Apr
16
comment What is a Key Derivation Function?
Hugo Krawczyk has defined HKDF, which is intended to be a practical KDF based on HMAC. He wrote paper on subject: Cryptographic Extraction and Key Derivation: The HKDF Scheme. Because goals of KDF are not often well pronounced, this paper formalizes model for Key Derivation Functions (page 6). The formalized model from this paper could be suitable definition sufficient for your purposes.
Apr
15
comment Asymmetric encryption that is secure for (almost) any foreseeable future
@HadrienG: These proofs of 128-bit security being strong enough assume that brute force is only possible approach. Unfortunately, given long enough time, it is not sure if brute force remains the only possibility, one hundred years is such time.
Apr
15
awarded  Nice Answer
Apr
5
comment Removing “security by obscurity” from port knocking
en.wikipedia.org/wiki/Password-authenticated_key_agreement
Apr
5
comment Removing “security by obscurity” from port knocking
Why use 2048-bit shared key? The protocol could use 2048-bit public keys instead. With those you could implement a PAKE scheme. It is kind of possible to use PAKE scheme to "fix" "security by obscurity" aspect of port knocking, but the communication will become less efficient than in some other means. (In the end protocol likely becomes e.g. non-interactive zero knowledge proof.)
Mar
18
revised Creating a small number from a random octet string
fixed accidental double inverse
Mar
18
answered Creating a small number from a random octet string
Mar
5
answered Will SHA1 or Other Hash Functions Ever Contain Quotes
Mar
2
comment 128 bit 3DES Key and AES Key: what's the difference?
I feel it is partially misleading to claim NIST has deprecated Triple DES. According to NIST Special Publication 800-131A: Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths Two-key Triple DES Encryption (i.e., Triple-DES with 128-bit key) has been deprecated (i.e. restricted use), and will be disallowed after the end of 2015. However, the Triple-DES variant with 192-bit key, is acceptable.