156 reputation
4
bio website
location
age
visits member for 1 year, 8 months
seen Jun 26 at 14:33

Co-Founder and CTO of SparkNotes, TheSpark.com and OkCupid. Author of IcedCoffeeScript, OKWS, Tame for C++, TameJS, and OneShallPass.com.


Sep
24
awarded  Autobiographer
May
20
comment How can one encrypt with RSA (or ElGamal) without revealing whom the ciphertext is intended for?
This is a great pointer. For RSA: "Our variant simply repeats the ciphertext computation, each time using new coins, until the ciphertext $y$ satisfies $1 \le y \le 2k−2$, where $k$ is the length of $N$." For PGP, we'd need to assume the same proof works for EME-PCKS#1-v1.5 as works for OAEP. Their construction works with preexisting decryptors, which is nice. Their other claim is that ElGamal already has key privacy.
May
20
asked How can one encrypt with RSA (or ElGamal) without revealing whom the ciphertext is intended for?
Nov
19
comment A key-derivation function that is as strong as the stronger of PBKDF2 and scrypt
I prefer the simplicity of your construction, but I wonder why $H(salt)$ as an input to PBKDF2? Is the idea to have independent inputs to the two functions? If so, the first step in both scrypt and PBKDF2 is HMAC-SHA256, so we can get away something like: $k = \mathrm{scrypt}(key||\mathtt{0x1},\,salt||\mathtt{0x1}) \oplus \mathrm{PBKDF2}(key||\mathtt{0x2},\,salt||\mathtt{0x2})$
Nov
19
revised A key-derivation function that is as strong as the stronger of PBKDF2 and scrypt
Remove thanks for style reasons.
Nov
19
comment A key-derivation function that is as strong as the stronger of PBKDF2 and scrypt
Right, there are two uses of PBKDF2 --- the first to stretch the original key into $128rp$ bytes to seed $\mathrm{smix}$, and the second to stretch the output of $\mathrm{smix}$ into $\mathrm{dkLen}$ bytes. In both cases, the iteration count is $c = 1$. If you ask for $\mathrm{dkLen} \le 32$, then the second call to PBKDF2 is simply a call to HMAC-SHA-256.
Nov
19
asked A key-derivation function that is as strong as the stronger of PBKDF2 and scrypt
Oct
3
awarded  Supporter
Sep
16
comment Integer factorization based password authentication
Check out the Secure Remote Password Protocol (SRP). It's the "right" way to do password authentication with small shared secrets, and has the additional benefit that the user can authenticate the server in the process.
Sep
14
comment HMAC construction based on the combination of two hash functions
Ricky, any more clues? Sorry to be slow. Thanks.
Sep
14
comment HMAC construction based on the combination of two hash functions
Right, I was hoping to avoid the output size inflation. Moreover, what about using this HMAC in PBKDF2? If using the HMAC(H_1) || HMAC(H_2) construction, some output bits will be functions only of HMAC(H_1), and others only of HMAC(H_2).
Sep
13
awarded  Editor
Sep
13
revised HMAC construction based on the combination of two hash functions
Add "$1$" and "$2$" to the outer hashes to prevent an answer of $0$ when the same hash is used for $H_1$ and $H_2$. Thanks to Paŭlo Ebermann for pointing out that corner case.
Sep
13
comment HMAC construction based on the combination of two hash functions
That's a great point, thanks.
Sep
13
awarded  Student
Sep
13
asked HMAC construction based on the combination of two hash functions