Reputation
25,305
Next tag badge:
391/400 score
76/80 answers
Badges
2 32 104
Impact
~371k people reached

1d
comment Cannot verify rsa signature on Android
I'm OK with the new intro; I had issue with version 1 of the answer because I see no sign that the code in the question is " generating a new public key in the verification method "
2d
revised P10 to P8 in S-DES
Explain role of P10 and P8
2d
comment Cannot verify rsa signature on Android
@user3685322: make sure to post the input values to whatever builds signModulus, signExponent, signPublicExponent; the problem might be there.
2d
comment Cannot verify rsa signature on Android
No. RSAPublicKeySpec has parameters, and the question states that they have been generated in C#.
2d
revised P10 to P8 in S-DES
number rounds correctly
2d
comment P10 to P8 in S-DES
One should not learn P10 and P8, but understand how they are used. S-DES is not a standard; it's a toy cipher.
2d
revised P10 to P8 in S-DES
typo
2d
answered P10 to P8 in S-DES
2d
revised Is there a way to use bcrypt with passwords longer than 72 bytes securely?
strike extra word in quote
2d
answered Why exactly Blowfish max key length is 448
2d
comment Severity of Cooking NIST P Curve Constants
Closely related (slight specialization of?) Is there a feasible method by which NIST ECC curves over prime fields could be intentionally rigged?. Also related to Should we trust the NIST-recommended ECC parameters?
May
20
revised Order of cascaded ciphers
Add note
May
20
revised Is the HMAC construction really neccessary for a fixed length message?
Point that the attack described is generic.
May
20
comment Building a combined encryption scheme from two encryption schemes that's secure if at least on of them is secure
@Ricky Demer: indeed if the first and non-CPA-secure encryption scheme causes an expansion of 1000 bytes for plaintext that starts with the string "fubar", cascaded encryption is insecure, but the answer gives a CPA-secure scheme. Good catch; I will remember considering leaks by size in questions on cascaded encryption.
May
19
revised Is One Time Pad considered Chosen-Plaintext Attack Secure?
fix typo
May
19
comment Building a combined encryption scheme from two encryption schemes that's secure if at least on of them is secure
While this certainly is valid, and matches the hint given in the question before it vanished, I do not see anything wrong with cascaded encryption (using independent keys), which does not depend on a random generator, and has shorter ciphertext.
May
18
revised Are there any digital signature algorithms in common use that result in 32-byte signatures?
fix a typo
May
18
comment Could this alternative hash based MAC construction be as, or even more secure than an HMAC?
@Anon2000: in crypto perhaps more than elsewhere, the devil is in the details. If you look closely at a typical SHA-1 implementation, the state has the 160-bit chaining variable so far, the length so far (usually 64-bit, could be in bits or bytes), and the message-block-not-hashed-yet (usually up to 511-bit, which length may or may not be tracked separately). If you want a portable implementation enciphering or hashing that, you need to care of all these details, including endianness and order of the various fields. If you consider only the chaining variable, you must be careful about padding.
May
18
comment Could this alternative hash based MAC construction be as, or even more secure than an HMAC?
(continued) if for some reason the length of the message is not known at the beginning of the MAC, there's the more elaborate CMAC; or OMAC2. Do not use straight CBC-MAC with a variable-length message.
May
18
comment Could this alternative hash based MAC construction be as, or even more secure than an HMAC?
If you are concerned with speed of a MAC and have hardware-accelerated AES encryption, you definitely want to consider CBC-MAC with the length of the message at start, and right-padding of the message with zeroes; this is demonstrably secure (when using a key dedicated to MAC), and even standardized as ISO/IEC 9797-1:2011 Padding Method 3. As they put it: "The [first] block consists of the binary representation of the length (in bits) of the unpadded [message], left-padded with as few (possibly none) ‘0’ bits as necessary to obtain a [128-]bit block".