625 reputation
211
bio website
location Helsinki, Finland
age 34
visits member for 2 years, 8 months
seen Mar 25 at 7:44

Aug
25
comment What is the post-quantum cryptography alternative to Diffie-Hellman?
Like said in the message, I know that asymmetric encryption can be used for key agreement. But "just" encrypting a random key is far from a proper cryptographic protocol enforcing PFS etc. and evaluating protocol security is not trivial either.
Aug
20
comment Any good file format alternative to PGP for encrypting data at rest?
If you have manual key entry, then you have to be prepared for typing errors. This means that typing errors should usually be caught before going through the entire file. This means that there should be some pre-verifier for the key only. This, combined with the need for some key derivation, complicates the protocol enough that I would definitely recommend sticking with a "standard" file format, even though they are complex.
Aug
19
comment Any good file format alternative to PGP for encrypting data at rest?
Your file format does not need an IV if the same key is only used to encrypt a single file. If the key is shared, you need to make sure the IV isn't repeated. Also, if you have a separate MAC for authentication, it needs a separate key - or you have to specify a key derivation function as well. You could get away with sharing the key, but you probably shouldn't do it. For passphrase to key bytes function, you need to decide how long it can take. 5 seconds of PBKDF2 is probably good, but there's probably no command-line utility for it...
Aug
19
comment Any good file format alternative to PGP for encrypting data at rest?
Do you want symmetric encryption only? Is the thing you are encrypting with going to be a password/passphrase or an actual key?
Aug
17
comment What security do Cryptographic Sponges offer against generic quantum attacks?
Actually, I was mostly looking an answer that would be a generic attack against Keccak (or actually, against any sponge function built with a permutation), not for a quantum attack that would utilize the structure of the actual Keccak permutation.
Aug
17
comment What security do Cryptographic Sponges offer against generic quantum attacks?
That is exactly what I thought, but wanted confirmation that I'm not missing some crucial tidbit why it wouldn't be so. Thank you!
Aug
17
comment How can my application make sure the right symmetric key is used for decryption?
You got that part right, but you missed one part: "Do not encrypt the key without authenticating it." The HMAC-SHA256 part will tell you if the key is correct or not with overwhelming probability. This is almost the same as encrypting a fixed string - or encrypting a crc - just that the authenticator is cryptographic and covers the key as well.
Aug
16
comment How can SSL secure a two-way communication with only one key-pair?
Not all of them rely on authentication of at least one side. There are "DH_anon" algorithms which do not authenticate either side - these are not enabled normally. These are obviously vulnerable to man-in-the-middle if there is nothing else validating the peer.
Aug
16
comment How can SSL secure a two-way communication with only one key-pair?
In TLS 1.2, there is a special "signature_algorithms" extension, which specifies the possible signature types. That supercedes the definition of the signature algorithm inside the key exchange name. Hence, the key exchange algorithms in TLS 1.2 could be just "DH" and "ECDH". That's why the *DH_* names are historical - the algorithms themselves are not deprecated in any way.