3,394 reputation
720
bio website ripple.com
location Oakland, CA
age 45
visits member for 3 years, 4 months
seen Nov 10 at 2:19

I am Chief Cryptographer at Ripple Labs and one of the architects of the Ripple payment system.


Mar
18
comment Where to store the private key and the public key in a communication protocol
@TalehIbrahimli: To give you an analogy, think of a guy building a suspension bridge to carry trucks who says, "The design of other suspension bridges is too complicated for me to understand and customize, I'll just design a bridge from scratch." Would you drive over that bridge?!
Mar
18
comment Where to store the private key and the public key in a communication protocol
@TalehIbrahimli: Honestly, your reasoning is so unbelievably disconnected from reality that you have no business choosing or implementing a security scheme. I'm not trying to be mean, I'm trying to protect you (and anyone who relies on your software) for disaster. If you find using SSL properly too hard, you have absolutely no business attempting the much, much harder task of implementing the encryption scheme itself, much less designing one.
Mar
11
comment Where to store the private key and the public key in a communication protocol
@CodesInChaos: Sure, you can take SSL and improve it by removing legacy issues, but then it won't be better because it's "unknown to cryptanalyst". It will be better because it is based on structures that are very well known and well understood. And I'd still worry about the risk that you'll create new, and much more serious, vulnerabilities.
Mar
11
comment Where to store the private key and the public key in a communication protocol
"I think custom protocol is unknown to cryptanalyst. And for this reason , it will be more secured." If the protocol is unknown to cryptanalysts, then there is no way to know how secure it is. By contrast, SSL was carefully constructed by industry experts to be as secure as humanly possible and has been extensively analyzed and tested. The odds that you implement something more secure than SSL are essentially zero. Most likely, it would turn out to be horribly broken (as early versions of SSL turned out to be).
Feb
21
answered Why do we assume un-security of communication channel on every cryptography system
Feb
18
comment what kind of hash function can provide a short hash and be collision resistant?
@jug: That would be vastly inferior because an attacker using custom hardware on an algorithm that requires only a small amount of space and no decision-making can build his customized hardware such that is many orders of magnitude faster than the CPU we presume legitimate users are going to use. This seriously reduces the security margin. It's much harder to make memory or general-purpose computing devices orders of magnitude faster than commodity memory and CPUs. (If we could, we already would.)
Feb
18
comment Is it possible to generate an RSA SHA1 signature only from a public key?
What would be the point of a signature that anyone could make? What purpose would it serve?
Feb
18
comment Why is RSA encryption significantly faster than decryption?
I just benchmarked OpenSSL and the ratio was around 14 to 1.
Feb
15
comment Encrypting a key with the same key
@madhukar2k2: No, that would not make the system insecure. If you pick a random 128-bit number, you might pick zero, and an attacker might start searching at zero. But if you exclude zero as "insecure", then an attacker doesn't have to start at zero and the problem repeats for one. You only want to exclude unsafe choices if they have a high enough probability that the benefit from excluding them exceeds the cost. Reducing the search space by excluding a matching key has a cost (reducing an attacker's search space) greater than the benefit (eliminating one unsafe random key).
Feb
15
comment Encrypting a key with the same key
This question makes no sense. You're asking us why something would be insecure without telling us why you want to do it. Something can't be insecure unless there's something you're trying to prevent that would constitute a security failure. Without requirements whose violation would constitute a security problem, it's logically impossible for something to be "insecure".
Feb
13
comment Is signing a hash instead of the full data considered secure?
The great thing about standards is that there are so many to choose from.
Feb
13
comment md5: is reverse length-extension attack possible?
It is important to understand that Merkle–Damgård hashes were never designed to resist attacks of this type. Any properties like this that they have are just the result of pure luck.
Feb
13
answered Is signing a hash instead of the full data considered secure?
Feb
9
comment Is Convergent Encryption really secure?
@PeterDolberg: You are correct. If you use AES-CBC, the IV has to be derived the same way as the key.
Feb
7
comment How to check the strength of an encryption algorithm?
Your question seems to be confusing two different things. The question itself asks how to check the strength of an algorithm. But the body says you want to check if an application is secure. These are two totally different questions with totally different answers. (And the algorithm has to be known secure before there's a chance the application is secure, so one comes before the other.)
Feb
5
comment Source for examples with broken cryptography
@CodesInChaos: +1. Great link. There are some 10 SHA-3 candidates which were completely broken.
Feb
5
comment Why does the recommended key size between symmetric and assymetric encryption differ greatly?
Short answer: In order to provide comparable levels of security.
Jan
29
comment Is there a length-preserving encryption scheme?
To 100% clarify, you are looking for an encryption algorithm that maps every possible binary input with an integral number of bytes to a encrypted output of the same length. Is that correct? And you understand the inherent security problems with such an algorithm? (No defense against corruption, replay attacks, and so on.)
Jan
19
comment Is it safe to use RSA as a proof-of-work system?
In the vast majority of realistic applications, any proof of work system can be parallelized simply by requesting many challenges from the server.
Jan
19
comment Is it safe to use RSA as a proof-of-work system?
Another option is to have the server generate two primes and give the client the product of the two primes. The client must factor the product and return the smaller prime.