625 reputation
211
bio website
location Helsinki, Finland
age 34
visits member for 2 years, 8 months
seen Mar 25 at 7:44

Feb
10
comment What security do Cryptographic Sponges offer against generic quantum attacks?
Switching accepted answers as this is new information that changes the answer.
Feb
10
accepted What security do Cryptographic Sponges offer against generic quantum attacks?
Oct
13
comment What is the post-quantum cryptography alternative to Diffie-Hellman?
If there is some secure asymmetric encryption protocol, one end can send an authenticated asymmetric encryption key and the other end can just send a random symmetric key encrypted to that key.
Oct
12
awarded  Nice Question
Oct
8
awarded  Nice Question
Aug
16
awarded  Yearling
May
19
awarded  Popular Question
Dec
15
awarded  Self-Learner
Aug
16
awarded  Yearling
Oct
21
comment uniquely identify a symmetric key
Hashing is meant to be secure in this case. If the key is actually generated from randomness (and not a password or something similar), reversing the hash is the classical pre-image attack and well covered by hash function security.
Sep
22
comment Converting a stream cipher into a block cipher
You are right, any old stream cipher won't do and it isn't trivial, so it is not a generic solution.
Sep
21
comment Designing a key expander out of ciphers
If a hash algorithm is used to expand the key, then that hash algorithm can be attacked to gain knowledge of all the keys - in effect, if your hash algorithm isn't stronger than all the ciphers, the hash algorithm becomes the weakest link. Alternatively, if your hash algorithm is stronger than all the ciphers, you can just use the hash algorithm for encryption (although that is somewhat non-trivial to do securely if your hash algorithm isn't really good).
Sep
21
comment Designing a key expander out of ciphers
This works. Alternatively, any all-or-nothing transform could be used, such as OAEP, but then that transform could be attacked. XOR is only weak in the sense that knowing the first byte of every plaintext reveals the first byte of the key - but hopefully the ciphers used are not weak like this.
Sep
20
comment Converting a stream cipher into a block cipher
Using Salsa20 and a three round feistel in BEAR/LION style constructs one can achieve a block cipher of small block size (say 128-bit) with around a 15x slowdown compared to the stream cipher. For Salsa20 or similar, this could be only a few times slower than AES in software. For larger block sizes, the slowdown is even less. I would consider them practical and not very slow if you actually have the need - but obviously a real block cipher is always faster.
Sep
20
awarded  Critic
Sep
20
comment Is Convergent Encryption really secure?
Great answer. However, one more attack: an attacker can guess plaintexts and test if you have that file. This attack will reveal passwords in configuration files that haven't been modified otherwise, for example.
Sep
20
comment Is Convergent Encryption really secure?
You should explain your notion of "secure", as convergent encryption is either secure or not secure depending on your definition.
Sep
20
comment Is Convergent Encryption really secure?
This same question is asked here: security.stackexchange.com/questions/7142/…
Sep
18
answered What is the post-quantum cryptography alternative to Diffie-Hellman?
Sep
10
comment SHA1 usage for passwords, alternatives and advantages?
@Niklas R: Please read the comments and the links and try to read things a bit more carefully. Your comments are pretty much all over the place. crypt is not only DES and you are mixing up the hash algorithm with the "operating mode". PBKDF2 may use SHA1 internally and it is as secure as any. The point is not to use simple concatenation of salt and password hashed, but something more complex - the point is not to change the actual hash function used.