912 reputation
26
bio website
location
age 44
visits member for 2 years, 8 months
seen 3 hours ago
programs in C and Perl, mostly

3h
comment Are the MD5 constants an S-Box?
More original than AES was the use of S-boxes in DES. But the term predates even that, I think.
Mar
2
comment File Encryption (EFS method)
And, as an afterthought, DPAPI has a mechanism to avoid re-encryption of secrets (like RSA private keys) protected by it, when a user changes its password. This is an added benefit.
Mar
1
comment File Encryption (EFS method)
DPAPI has several purposes in Windows besides encrypting the RSA private key (to encrypt other secrets like WiFi passwords, and IE account passwords etc.); moreover the hash from the password is used only after thousands of iterations (and a random salt) provided by the DPAPI API. This slows down direct cracking attacks on the encrypted secret key, if the NTHash is not available, e.g.
Dec
11
comment RC2, RC4, RC5 key length
RC2 does have a single bit resolution: it is possible to have a key of length 8 bytes (64 bits) and an effective key length (as it is called in the specification) of 42 bits, say. The RFC has some test vectors for such cases.
Dec
11
comment AES column mixing and S-Box confusion
@figlesquidge Well, the S-box is defined in terms of the field operation ($\frac{1}{ax+b}$, for some $a,b$, defining $\frac{1}{0}$ as $0$...) But I mentioned it because I need it for the mix column anyway.
Dec
10
comment How is the MD2 hash function S-table constructed from Pi?
Also note that RC2 (in RFC2268) also has a permutation supposedly based on the digits of $\pi$ in its key schedule. The final table in that RFC is also unexplained (and used in other algorithms from RSA as well). These were also never explained, AFAIK.
Dec
8
comment How is the MD2 hash function S-table constructed from Pi?
I recall having read it, it was using some RC4 like thing, updating a permutation. I don't recall where, though.
Aug
13
comment Is truncating a SHA512 hash to the first 160 bits as secure as using SHA1?
Note that SHA-224 is not a simple truncated version of SHA-256: the IV is different. SHA-224 is computed like SHA-256 and then truncated, but as the IV is different, the intermediate 256 bit result of SHA-224 is totally different (in general) than the SHA-256 computation. The same goes for SHA-384 vs SHA-512.
Jun
12
comment How to choose the appropriate public (i, m) and private (j, m) keys?
Mostly people choose some $i$ that has no divisors in common with $\phi(m)$ (in this case 64), and this is easy to check (Euclid's algorithm) and then $j$ is its inverse (also found by the (extended) Euclidean algorithm). We can choose any such $i$ (and keep its inverse $j$ secret). Often $i=3$ or $i=2^{16}+1$ is chosen, but we need not do that. It's the same for bigger numbers.
Jun
12
comment How to choose the appropriate public (i, m) and private (j, m) keys?
We can use either one, both work. Either $(p-1)(q-1)$ or the least common multiple of $(p-1)$ and $q-1$. And you just pick any $i$ that has an inverse $j$ modulo that number.
Jun
9
comment How does Scrypt use Salsa?
The compression is as seen from the point of view of the message, not of the state. The state stays the same size, and the message bytes are all used, as many as we have. We output the state at the end, which is often a lot shorter than the message, which has been mixed into the state iteratively.
Jun
9
comment How does Scrypt use Salsa?
Study the SHA-1 spec. The work is done mostly in a function that transforms the 20 byte state to another 20 byte state with the message as "key" (this component is the blockcipher SHACAL). So at the core of SHA-1 is a block transform as well, and this is the one used. The whole hash is the function with the fixed input state, and message padding added, plus the iterative application of this transform for successive blocks.
Jun
8
comment Is symmetric key encrypted with server's public key secure
If they already share a secret password, cannot they base their scheme on that? Like SRP? Why bother with the RSA?
Jun
8
comment Is symmetric key encrypted with server's public key secure
What identification scheme? Based on the supposed shared secret that they think they have? Then how does Bob distinguish Mallory from Alice, if the former does an active attack on both phases?
Jun
8
comment How does Scrypt use Salsa?
It is, but it is not a hash in the traditional sense. It's a cryptographic mixing function, normally used as a component in the stream cipher Salsa20. The use in scrypt is different from its use in the stream cipher, and the author in the scrypt paper shortly discusses that too.
Jun
5
comment IV Security Clarification
From what I see online (I don't know the implementation, but let's trust Microsoft here), yes, that is the right function to use. E.g. stackoverflow.com/a/2530643/342544
Jun
5
comment IV Security Clarification
Yes, I would say that. You use good sources of randomness I suppose?
Mar
12
comment computing inverses in truncated polynomial rings manually for NTRU encryption
Pretty sure, if I have more time, I'll try to compute it too, by hand, of course.
Mar
12
comment computing inverses in truncated polynomial rings manually for NTRU encryption
@SuniaRaharja yes, the polynomial $x$ (bad choice of notation) is indeed the inverse, and then you need to reduce mod 11. If all is well, you shouls get $a^{-1}$ or an equivalent (mod 11) polynomial.
Mar
11
comment computing inverses in truncated polynomial rings manually for NTRU encryption
Basically, using Extended Euclidean, do the inverse computation of $a$ in $\mathbb{Z}[X]$, doing the gcd with $X^7 - 1$, and reduce the coefficients modulo 11 afterwards.