2,604 reputation
216
bio website
location
age
visits member for 1 year, 8 months
seen 12 hours ago

22h
comment AES-GCM Disadvantage
One factor reasonable for consideration could be size of implementation: AES-GCM consists of two significantly different cryptographic functions, AES and GHASH. Compared to some other authenticated encryption algorithms, this means it potentially takes more code or gates to implement AES-GCM than e.g. AES-CCM.
Oct
12
comment Do passphrases need to be run through PBKDF2? Almost impossible to brute force?
6 words randomly chosen from 10000 word dictionary are still below 80 bit strength, i.e. less than minimum key strength recommended for cryptographic uses nowadays. Furthermore, it may be very hard to ensure in practice that all users use keys this strong.
Oct
8
comment How exactly does AES-NI work?
Actually, ciphers (such as AES) tend to be more power efficient in hardware implementation than software implementation. This often also means faster, but not necessarily (the clocks for main cpu and crypto HW can be different).
Oct
2
awarded  Nice Answer
Sep
29
comment Is there any area where AES-CBC cannot be used ? If so, why ?
Error Oracle Attacks on CBC Mode: Is There a Future for CBC Mode Encryption? and Evaluation of Some Blockcipher Modes of Operation also seem to conclude that CBC mode is legacy with little future, and point out many of these shortcomings. For some areas the resources mentioned may provide useful additional information.
Sep
29
comment Why should CAST5 and 3DES not be used for encrypting files over 4GB?
This limit (which can be e.g. 4GB, depends on what chance of collision you are willing to risk) is per key. Therefore this limit is only if single key per encrypted file is used. Similarly, if multiple files are encrypted with same key, the upper bound is not size of any single file, but the size of the files combined.
Sep
25
comment What is the (uncompressed) x,y-representation of a curve point on the P-256 NIST elliptic curve?
The public key contains octet 04 followed by two 32 byte big endian unsigned integers representing a point on the curve in affine coordinates. 04 is identifier of the uncompressed presentation. Private key is just a big endian integer. Curve parameters are found from e.g. appendix D.2.3 of FIPS 186-4: Digital Signature Standard.
Sep
23
comment Is there any area where AES-CBC cannot be used ? If so, why ?
dm-crypt used to do AES-CBC-ESSIV. For this reason, the most versions of Linux and the most versions of Android use it. The latest dm-crypt on Linux has switched to XTS. I also tend to prefer XTS, then again, in some ways wide block modes (XCB, EME2) would be superior to XTS, but most wide block modes modes have not been sufficiently properly studied, standardized, or accredited to get commonly implemented. Anyway, this is a side-track. My intent was just to point out that CBC mode has it uses in disc encryption.
Sep
23
comment Is there any area where AES-CBC cannot be used ? If so, why ?
In disc encryption, it is actually relatively common to use CBC. (For example when complemented with Encrypted salt-sector IV).
Sep
23
comment Is there any area where AES-CBC cannot be used ? If so, why ?
An important consideration related to the sequential nature is performance. AES-CTR may be significantly, possibly multiple times, faster than AES-CBC encryption.
Aug
12
comment SHACAL in SHA-256
Very good answer. There are two additional advantages of SHACAL-2, I would like to highlight: First: On small microprocessors it could be desirable to implement just one function. It is easy to implement just SHACAL-2 and use it for hash and block cipher. Secondly: On some platforms it is hard to implement AES efficiently without timing side channel. SHACAL-2, on the other hand, is commonly easy to implement without timing side channel.
Jul
18
comment How vulnerable is the C rand() in public cryptography protocols?
There are practically no rand() implementations which would give random numbers useful in cryptographic applications no matter how many bits are skipped. So it is incorrect to claim somebody could adopt rand() for cryptographic purposes.
Jul
3
comment SHA256 output to 0-99 number range?
I have tested all possible SHA-256 hashes which are larger than $100\lfloor \frac {2^{256}}{100}\rfloor$. None of them produce number larger than $100\lfloor \frac {2^{256}}{100}\rfloor$ when hashed the second time. However, double hashing does not remove the bias, the biased numbers are just different.
Jul
3
comment Public and Private key encryption in simple math
RSA algorithm is explained pretty well at RSA Algorithm. It contains both example with small numbers (suitable for calculator) and large numbers. Even with simple numbers it's more convenient if you have advanced calculator as operations common in discrete mathematics are not found on simple calculators. However, RSA with insecurely small numbers is possible to calculate using mental arithmetic.
Jun
13
comment Given $n$ bits, how many “truly random” sequences/numbers can be constructed?
Program "ent" (available on e.g. many lines) uses various algorithms to statistically estimate entropy. Maybe it has some tests you'd like, but as mentioned already, it is not possible to be able to tell for sure (maybe deterministic sequence just looks random or random sequence is randomly looking very deterministic).
Jun
12
awarded  Nice Answer
May
31
comment Creating a license system based on asymmetric encryption (RSA or ECDSA)
For scenario #4, approach that is simple and has been used in practice is whitelisting. Note: The whitelist can get very large.
May
27
awarded  Custodian
May
19
comment Why is XOR preferred over XNOR?
ARMv8 has EON instruction. SPARC has XNOR instruction. Then again, few other processors have it.
May
9
comment Regain 3DES ECB key, assuming I have both encrypted and decrypted text
There are $2^{168}$ possible keys for 24 byte 3DES. It is possible to attack such key with around $2^{112}$ steps, which saves time compares to brute forcing all the possible keys. (But it is still unpractical.)