Reputation
14,601
Next tag badge:
62/100 score
18/20 answers
Badges
1 17 64
Newest
 Necromancer
Impact
~307k people reached

Jun
4
comment Why is TLS SRP verifier based on user name?
@simbo1905: The compromised server wants to know if Alice and Bob have the same password. So, when Alice tries to log in, the server looks up Bob's authentication data $(s_{\rm Bob}, v_{\rm Bob})$ and sends Alice $s=s_{\rm Bob}$ and (in SRP-6) $B=3v_{\rm Bob}+g^b$, gets back $M_1$ and verifies that it equals $H(A,B,S)$, $S=(Av_{\rm Bob}^u)^b$. If it does, Alice has just successfully authenticated herself as Bob, which (with overwhelming likelihood) means they must have the same password $P$ and identifier $I$. Assigning each user a separate $I$ (typically, their username) plugs this hole.
Jun
1
revised Correct way to read a given permutation cipher?
needs more t
Jun
1
answered Correct way to read a given permutation cipher?
Jun
1
reviewed Leave Open How Does Progressive Hashing Work?
Jun
1
reviewed Leave Open Why would splitting a password output be better than separate HMACs for encryption/authentication key derivation?
Jun
1
revised Choice of MAC and handling it correctly
being privacy-preserving is not enough
May
31
comment Encryption of log files
Using a stream cipher (or a block cipher in CTR mode) would be tempting, but would be vulnerable to an attack where the attacker deliberately truncates the log file before letting your program append to it, in order to obtain multiple logs encrypted with the same keystream. Still better than just XOR with a static key, though.
May
31
answered Choice of MAC and handling it correctly
May
31
revised How can one parallelize tasks in CTR-AES for maximum performance?
edited body
May
31
answered How can one parallelize tasks in CTR-AES for maximum performance?
May
31
reviewed Close How small are we talking about when defining the small public/private key exponent
May
31
comment Why is plain-hash-then-encrypt not a secure MAC?
@D.W.: I agree that these questions have substantial overlap, but it's not obvious which one(s) of them should be deemed canonical. In particular, given that this question seems to have the most thorough and highly voted answer (not that the others don't have good answers too), there's an argument to be made for closing both of the earlier questions as duplicates of this one.
May
31
reviewed Leave Open Reductionist proofs of decisional problems to computational
May
25
comment Common password derivation function for different encryption methods
Even with Grover's algorithms, you're still looking at $2^{128}$ quantum operations, which is still damn hard, even if you assume that quantum computing becomes as easy as classical. If you assume that a 128-bit keyspace is safe against any foreseeable classical attacks (which I think most cryptographers would), then you should consider a 256-bit keyspace safe against quantum attacks too.
May
24
reviewed Close Is a Mersenne-twister cryptographically secure if I truncate the output?
May
24
comment Is a Mersenne-twister cryptographically secure if I truncate the output?
This does not seem to be a real question, but rather an attempt to argue a point or to discuss the merits of a novel cryptographic primitive. As such, it is off-topic for Cryptography Stack Exchange, as described in our help center.
May
24
comment Common password derivation function for different encryption methods
However, if you need more key material simply because you need multiple keys (say, a MAC key and an encryption key, and maybe something else too), then PBKDF2+HKDF with a 256-bit hash is perfectly fine. Or you could always use SHA-512 to widen the "bottleneck" to 512 bits.
May
24
comment Common password derivation function for different encryption methods
It kind of depends on why you want that much key material. If it's because you think a 256-bit key is too short to be secure, then, indeed, you should not have a 256-bit bottleneck in your KDF. (But if you really think someone could brute-force a 256-bit keyspace, then you obviously know something the rest of us don't. Also, considering that key-stretching rarely adds more than 30 bits of entropy, where are you getting a password with over 226 bits of entropy from?)
May
24
comment Common password derivation function for different encryption methods
For some strange reason, if you ask PBKDF2 for more than one hash output block's worth of key material, it repeats the whole key-stretching process several times. This severely slows down the key derivation for legitimate users, whereas attackers typically don't suffer at all (since they only need to derive one output block to confirm their guess). PBKDF2+HKDF doesn't have that issue.
May
23
comment Which tamper-protection algorithm provides the shortest output?
... Hence, we just slapped a MAC onto any serialized data items, without any associated data; if users wanted to poke into the HTML code and replace one serialized string with another, that was fine with us, as long as we knew they couldn't pwn the server by feeding in some serialized code and telling the deserializer to overwrite a common library function with it.