13,292 reputation
32967
bio website paul-ebermann.tumblr.com
location Berlin, Germany
age
visits member for 3 years, 1 month
seen 19 hours ago

Don't fear to edit my posts: even if I have more reputation than you, I do make mistakes.

I'm now also a Moderator Pro Tempore (= until the first elections) at Cryptography Stack Exchange: feel free to come around and ask some cryptography questions.


My personal name is spoken as /ˈpawlo/ (IPA), in English this would be written similar to Powlo, I think (i.e. the vowels are ow and o), with an accent on the before-last syllable (which is the first in this case). It's the Esperanto form of my given name.

The photo shows my shadow, taken at night. My camera sometimes seems to forget all the other frequencies and only stores the green ones.

My current main private programming project is the game of fencing, an online abstract turn based strategy game. Implemented as a Java applet, using git as a version control system.


Some more links:


Mar
15
answered Reusing AES-CTR Keys and IVs for File Encryption
Mar
13
comment Why does SHA-1 have 80 rounds?
You are right, not every "round" function is a bijection. I generalized too much from AES here, I suppose.
Mar
13
comment Why does SHA-1 have 80 rounds?
In a block cipher, each round function is actually a bijection, and often the inverse is (almost) as easy to calculate as the original one. In hash functions based on block ciphers (like SHA-1 and SHA-2), it is the same.
Mar
12
awarded  Nice Answer
Mar
10
comment What is the best way to share a shared secret key over HTTPS to be used for HMAC authentication?
It depends on the actually used cipher suite ... make sure it is not NONE, for example. Also, if you are just defining the protocol (i.e. no existing application to be compatible to), and don't have a highly performance critical or resource limited application, don't use SHA-1, use one of the SHA-2 variants instead in your HMAC.
Mar
10
comment Is AES in CBC mode secure if a known and/or fixed IV is used?
They both fulfill the same purpose, but are usually used in different contexts. An IV is used for an encryption algorithm (like a mode of operation of a block cipher), while a salt is used in key derivation or password hashing and similar. But the word usage varies a bit, and the border is not well-defined.
Mar
9
comment Reseeding a PRNG with the generated PRN
I suppose this depends on both the seed and the rand part of the algorithm.
Mar
6
comment How to calculate the maximum output size for data encrypted with a RSA Private Key?
Please note that what you are doing here is not actually an "encryption" algorithm, because there is no way to decrypt it. It looks a bit similar to a signature algorithm, though.
Mar
6
comment why inverse in diffie-hellman protocol will not give same value?
If you don't know $b$, how do you want to use $b^{-1}$?
Mar
6
comment why inverse in diffie-hellman protocol will not give same value?
Yes, like @neverwalkaloner mentioned, your exponentiation formula is not really clear. Please add some parentheses to make the order clear.
Mar
6
comment Hashing fundamentals
To reach a longer loop size (longer than the expected value in relation to the total state space), you'll need more structure in your processing function, which might make your total hash function attackable. Also, the hash of a "ones-only" or "zeros-only" string of really long length is not really representative, or more important than other strings.
Mar
5
answered Hashing fundamentals
Mar
4
comment Hashing fundamentals
Your "not so sure" properties don't work as well when including a counter to the state.
Mar
4
comment Hashing fundamentals
The initial state is usually not random, but fixed in the specification. Also, often the input is also padded at the end.
Mar
4
comment Is it possible to calculate the 'skeleton key' for DUAL_EC_DRBG? What would it take?
Please don't understand me wrong: I don't recommend using Dual_EC_DRGB, even if one is not considering NSA a potential attacker. It is a bad PRNG anyways (compared to existing alternatives based on symmetric crypto), even if it would be secure. And actually I have no idea how hard your problem is – I hope someone answers.
Mar
4
comment Is it possible to calculate the 'skeleton key' for DUAL_EC_DRBG? What would it take?
I suppose it is easier to first have the skeleton key and from them generate those "fixed constants".
Mar
4
comment Is it possible to calculate the 'skeleton key' for DUAL_EC_DRBG? What would it take?
At least is is not that easy that everybody can do it, otherwise the skeleton key would already be public, and the Dual_EC_DRGB not only "potentially undermined by NSA", but actually undermined by everyone.
Mar
4
revised Is it possible to calculate the 'skeleton key' for DUAL_EC_DRBG? What would it take?
edited tags
Mar
4
comment Why is H(k||x) not a secure MAC construction?
@owlstead I added the information about SHA-2 and SHA-3 to the answer.
Mar
4
revised Why is H(k||x) not a secure MAC construction?
added 985 characters in body