Reputation
26,464
Next tag badge:
411/400 score
78/80 answers
Badges
2 36 109
Newest
 Revival
Impact
~397k people reached

Jun
17
comment How HMAC.Update function works?
@Acetylator: Notice that if/when Key is longer that the block size (64 bytes for SHA-1 and SHA-256, 128 bytes for SHA-512), the hash of Key (rather than Key extended to a block when Key is smaller than a block) shall be used as K. $\;$ Independently: some implementations deffer initialization of H2 until Final, instead keeping K (or K XOR OPAD) for this purpose; this avoids multiple active instances of the hash, which typically conserves memory.
Jun
17
comment How to quickly detect incorrect password in encrypted file without compromising security?
I do not see that this RNCyptor solves the problem of fast check for incorrect password in its password variant (or that it can be done). Incidentally, there's a funny security near miss in rnc_isEqualInConsistentTime, supposed to compare the equality of bytestrings of variable length with resistance to timing attack: if self.lengthwas 256 (or a multiple of that), then empty otherData would be a match. It does not degenerate into a security problem in the context, since we do not use 2048-bit MACs.
Jun
16
comment How HMAC.Update function works?
I don't see that it makes sense to pass a key to HMAC.Update, and neither of your references does. Equivalent uses HMAC.Init('key'); HMAC.Update('abc'); HMAC.Update('def'); Result1 = HMAC.Digest and HMAC.Init('key'); HMAC.Update('abcdef'); Result1 = HMAC.Digest seem more logical to me; and then I do not get what you ask.
Jun
16
comment An electronic voting system
@Mary Star: hopefully your latest comment is now addressed in the second paragraph of the answer.
Jun
16
comment An electronic voting system
@Mary star: standard terminology is that the signing algorithm of X can only be run by X; in the sentence you quote, X is the voter and the signature is made by the the voter (using hardware she or he trusts), not by the voting centers (which are not individually trusted). How a voter is supposed to trust said hardware is beyond me (because that's my area of expertise, contrary to most people promoting electronic voting, which area of expertise tends to be politics or sales).
Jun
16
comment Is the HMAC construction really neccessary for a fixed length message?
I do agree that HMAC is technically superfluous when the hash is Keccak/SHA-3 (perhaps subject to padding key to a sponge step). $\;$ I do not adhere to the HMAC criticism: there are plausible defects in compression functions that do not open to attack in Merkle-Dåmgard hashes for their definition of security (collision, preimages), but open to attack in H(Key||Data) for fixed-size data (I tentatively exhibit an example in the last paragraph of my answer); HMAC masks these defects well; and I see no definitive argument that SHA-256's compression function does not have such defect.
Jun
15
comment Is the HMAC construction really neccessary for a fixed length message?
@eBusiness: read the last paragraph again! I exhibit a hash that is just fine (when the desired properties of the hash are collision-resistance, first preimage resistance, and second preimage resistance) according to your own "if it's not broken, then it's fine" line of thought ; but such that I effortlessly break the MAC constructions in the question according to the standard definition (that you give). $\;$ Beside, your reasoning does not invalidate my "rather be safe with a proof than sorry with an attack that surfaces" attitude.
Jun
15
comment How to quickly detect incorrect password in encrypted file without compromising security?
I think that is valid only if " long, random passwords" is really long and random enough to be a key not needing stretching; e.g. has 22 letters randomly chosen among 0…9A…Za…z, giving next to 131 bits of entropy. I fear this solution (perhaps any) seriously cuts corners on security for anything a human can be expected to memorize, or routinely key-in.
Jun
15
comment Is there a scheme that allows to use RSA based challenge response protocol limited to signing only 8 bytes to create a secure signature of any data?
@Ricky Demer: if $K$ is predictable, the schemes becomes brittle, especially if $P$ is not purposely slow. In particular the adversary can (with effort about $2^{62}$ evaluations of $P$) find $m$ such that $P(K,m)$ for the predicted next $K$ has an $x_i$ of the adversary's choice, and make an existential forgery with about $2^{64}$ evaluations of $P$ and 4 queries to the broken signer with predictable $K$.
Jun
11
comment How are primes generated for RSA?
@mikeaso: I doubt that the bias that I describe can lead to any security problem. That could be a certification issue, however; knowing a moderate number of RSA private keys, this bias is computationally detectable from the distribution of the number of consecutive composites below the primes forming the factors of the moduli.
Jun
11
comment How to prove the hardness of Rabin's function?
Hint: choose a random $r$ with $0<r<n$, apply the hypothetic square root finding method to $r^2\bmod n$
Jun
11
comment Can a combination of encryption algorithms weaken the overall encryption?
@Nova: here's an counterexample: the first algorithm is GPG with the common option of plaintext compression before encryption, and the second is AES-CTR with random IV; the ciphertext for a 1MB text document will be recognizable from the ciphertext for a 1MB mp3 file (the former will be much smaller than the later), which is at least a theoretical weakness; when the second algorithm alone does not exhibit this leak. Other counterexamples are possible if we consider timing or side-channel attacks on the first algorithm.
Jun
11
comment How are primes generated for RSA?
The algorithm (as it stands now) generates primes with significantly biased distribution: primes with a long gap of composites just below them are significantly more likely than other primes. It is common to first choose a moderately large random secret $s$ and replace $p=p+2$ in step 3 by $p=p+2s$. It is enough that $s\approx\log_2(p)$ to mostly avoid that bias. In practice, $s$ is often the product of two much larger secret auxiliary prime $p_1$ and $p_2$ chosen such that we'll end with $p\equiv1\pmod{p_1}$ and $p\equiv-1\pmod{p_2}$.
Jun
11
comment Rationale for use of right-shift (rather than rotate) in SHA-2?
@Richie Frame: Indeed, the message schedule of SHA-1 is linear:$$W_t=\operatorname{ROTR}^{31}(W_{t-3}\boxplus W_{t-8}\boxplus W_{t-14}\boxplus W_{t-16})\;\text{ for }16\le t\le79$$and further a rotation in input translates to a corresponding rotation of output. Neither weakness holds for the message schedule of SHA-2, including modified to use only $\operatorname{ROTR}$. Still, reducing odds of the second property might be the motivation I'm asking for. $\;$ I guess that should be turned into an answer.
Jun
10
comment Rationale for use of right-shift (rather than rotate) in SHA-2?
@LightBit: that applies to a linear transformation. In SHA-2, the key schedule is not linear, thanks to the alternation of ⊕ in the σ functions, and ⊞ in the message schedule. Thus I do not think that the reasoning applies, at least to a comparable degree. Something on that tune would indeed apply if we changed ⊞ to ⊕, so perhaps the desire to better guard against an approximation of ⊞ by ⊕ may have been in the mind of the designers. $\;$ Thanks for the contribution!
Jun
10
comment Residue requirements of Rabin-Williams primes?
In " minimum requirements " and " I'm not sure it's forbidden ", the crucial point is: required/forbidden BY WHAT? A standard? A particular implementation (or definition) of RW? The feasibility of a working implementation (or definition) of RW using $p\;q$ as the public modulus?
Jun
5
comment What's the inverse function of this decryption function?
For the very reason outlined in the question, it is not possible to make en encryption function accepting any arbitrary input (in particular with bytes in the 0x54 to 0x5B range, that is TUVWXYZ[ in ASCII) and such that the supplied decryption function will output the original plaintext.
Jun
5
comment Is the one-time-pad a secure system according to modern definitions?
@Bardi Hardborow: chacha20 as used e.g. in Chrome is a stream cipher (which keystream generator is generated by a CSPRNG, which is a PRF applied to a counter and a key); it is not an OTP, which keystream is true random, rather than derived from a key.
Jun
5
comment How do we know a cryptographic primitive won't fail suddenly?
" There is only a single cryptographic algorithm that is mathematically proven secure: the one-time pad. " requires an unusual definition of one-time pad to become true: it is easy to define a mathematically proven secure algorithm, as long as it require at least as much key material as the plaintext length. We can use a variety of substitute to XOR. It is even possible to make one where some of the key material is reused (e.g: XOR plaintext with pad used in previous session, then XOR with fresh pad of current session)
Jun
2
comment Advantages/Disadvantages of Bcrypt vs. hash/salt
Yes. In a nutshell, SHA3-512 has not work factor parameter, which is of paramount importance for password storage; and uses little RAM, which in this application is a drawback.