Max Krohn
Reputation
Top tag
Next privilege 250 Rep.
 Sep24 awarded Autobiographer May20 comment How can one encrypt with RSA (or ElGamal) without revealing whom the ciphertext is intended for? This is a great pointer. For RSA: "Our variant simply repeats the ciphertext computation, each time using new coins, until the ciphertext $y$ satisfies $1 \le y \le 2k−2$, where $k$ is the length of $N$." For PGP, we'd need to assume the same proof works for EME-PCKS#1-v1.5 as works for OAEP. Their construction works with preexisting decryptors, which is nice. Their other claim is that ElGamal already has key privacy. May20 asked How can one encrypt with RSA (or ElGamal) without revealing whom the ciphertext is intended for? Nov19 comment A key-derivation function that is as strong as the stronger of PBKDF2 and scrypt I prefer the simplicity of your construction, but I wonder why $H(salt)$ as an input to PBKDF2? Is the idea to have independent inputs to the two functions? If so, the first step in both scrypt and PBKDF2 is HMAC-SHA256, so we can get away something like: $k = \mathrm{scrypt}(key||\mathtt{0x1},\,salt||\mathtt{0x1}) \oplus \mathrm{PBKDF2}(key||\mathtt{0x2},\,salt||\mathtt{0x2})$ Nov19 revised A key-derivation function that is as strong as the stronger of PBKDF2 and scrypt Remove thanks for style reasons. Nov19 comment A key-derivation function that is as strong as the stronger of PBKDF2 and scrypt Right, there are two uses of PBKDF2 --- the first to stretch the original key into $128rp$ bytes to seed $\mathrm{smix}$, and the second to stretch the output of $\mathrm{smix}$ into $\mathrm{dkLen}$ bytes. In both cases, the iteration count is $c = 1$. If you ask for $\mathrm{dkLen} \le 32$, then the second call to PBKDF2 is simply a call to HMAC-SHA-256. Nov19 asked A key-derivation function that is as strong as the stronger of PBKDF2 and scrypt Oct3 awarded Supporter Sep16 comment Integer factorization based password authentication Check out the Secure Remote Password Protocol (SRP). It's the "right" way to do password authentication with small shared secrets, and has the additional benefit that the user can authenticate the server in the process. Sep14 comment HMAC construction based on the combination of two hash functions Ricky, any more clues? Sorry to be slow. Thanks. Sep14 comment HMAC construction based on the combination of two hash functions Right, I was hoping to avoid the output size inflation. Moreover, what about using this HMAC in PBKDF2? If using the HMAC(H_1) || HMAC(H_2) construction, some output bits will be functions only of HMAC(H_1), and others only of HMAC(H_2). Sep13 awarded Editor Sep13 revised HMAC construction based on the combination of two hash functions Add "$1$" and "$2$" to the outer hashes to prevent an answer of $0$ when the same hash is used for $H_1$ and $H_2$. Thanks to Paŭlo Ebermann for pointing out that corner case. Sep13 comment HMAC construction based on the combination of two hash functions That's a great point, thanks. Sep13 awarded Student Sep13 asked HMAC construction based on the combination of two hash functions