191 reputation
7
bio website
location
age
visits member for 7 months
seen Apr 5 at 11:26

Mar
27
comment How useful is NIST's Randomness Beacon for cryptographic use?
It is too convenient to claim it is a 'prototype' or 'research' project. I think it was released at a time before the NSA leaks and designed to prey on the gullibility of users who might be inclined to use it due to NIST's trusted name stamped on it. The many unknowns about its inner workings, potential for insider knowledge of numbers before they are available, potential for insider manipulation of the numbers, potential use of a Dual EC DRBG standard for generating the numbers that can contain a kleptographic backdoor, all have the trademark signatures of NSA involvement from the start...
Mar
27
comment How useful is NIST's Randomness Beacon for cryptographic use?
The "seedValue" is the hashed output of the entropy source and DRBG. This must be the random 512 bits that the users of the system want. This seedValue is what could be replaced entirely by an insider. It's not needed to manipulate the entropy input into the DRBG. The "signatureValue" is an RSA signature computed over the version, frequency, timeStamp, randomValue, previousHashValue & errorCode. The "outputValue" is the SHA-512 hash of the "signatureValue" as a 64 byte string. They can not be expecting users to use the "outputValue" (the hash of an RSA signature as their "random bits")...
Mar
27
comment How useful is NIST's Randomness Beacon for cryptographic use?
It gets new entropy from the entanglement source to form the next seed for the dubious Dual EC DRBG, which then outputs the new 512 bits of entropy. Surely it hashes and signs only the most recent 512 bits of DRBG output with the past random bits and current timestamp to form a MAC. In which case the output of the DRBG being assumedly random could be replaced without anyone knowing. Surely it doesn't include the past outputs of random bits, current timestamp and signature as part of the seed into the next DRBG output... If it was doing that, then it sounds more like a PRNG rather than a TRNG.
Mar
26
comment How useful is NIST's Randomness Beacon for cryptographic use?
Good answer. I think there is another security problem. Within the 60s delay period, NIST would have access to the system and source code thus they could strategically alter the future random output to whatever they wanted suit their purpose. Even with the 'Unpredictable Sampling' applications linked above I could imagine a few scenarios where a company could pay off an employee inside the NIST to cook the next number and have a particular item/location scanned/checked. Even other agencies like the DEA might have need of "parallel constructions" under the pretense of "random" searches.
Mar
25
awarded  Critic
Mar
20
comment CryptoJS.AES result always has same first few bytes?
Wouldn't that be a pretty easy distinguisher to tell if they're using this library and algorithm (AES) if it's always appending that text to the front of the ciphertext?
Mar
1
answered Estimating random number entropy for input into 256 bit hash
Feb
7
comment Is 80 bits of key size considered safe against brute force attacks?
See Bruce Schneier's quote "It took the academic community two decades to figure out that the NSA "tweaks" actually improved the security of DES. This means that back in the '70s, the National Security Agency was two decades ahead of the state of the art." NSA knew about differential cryptanalysis in the 70s and IBM who were assisting NSA at the time with security clearance.
Feb
7
comment Is 80 bits of key size considered safe against brute force attacks?
When or how a secret national surveillance agency (pun intended) with a $10.8B pa. black budget will or will not have a QC is just speculation and hearsay really. There's no way to know what their secret quantum computing capabilities at Oak Ridge or Ft. Meade really are. Guessing is pointless. The point is that they are storing all data. Encrypted data is flagged and if they can't decrypt it immediately they store it until they can. So when they do have a QC, your data will be decrypted eventually if using small key lengths.
Feb
7
answered Is 80 bits of key size considered safe against brute force attacks?
Nov
22
comment Is there a companion algorithm for OTP to ensure integrity and/or authentication?
@Ricky, wouldn't you just assign part of the key for encrypting the message and part of it for encrypting the MAC tag? It's not wasteful. Why not UMAC? "UMAC, is a type of message authentication code calculated choosing a hash function from a class of hash functions according to some secret (random) process and applying it to the message. The resulting digest or fingerprint is then encrypted to hide the identity of the hash function used." If you're encrypting the MAC tag with part of the one-time pad then it too will be information-theoretically secure.
Oct
25
awarded  Commentator
Oct
25
comment Is there a companion algorithm for OTP to ensure integrity and/or authentication?
Use a MAC then encrypt the MAC with part of the one-time pad.
Oct
25
comment Hypothetical unknown cipher - security in obscurity?
D.W. your comment is not very helpful. Lets assume for now that "alien" can be replaced with "attacker that does not know the algorithm/details of encryption used". That might be common for an attacker if the protocol is new/unknown/uncommon. I think these are some interesting questions regardless and deserve an answer.
Oct
16
comment Solid summary of what encryption remains strong after recent events
@Ivarpoiss Exactly. It appears the NSA/NIST guys here are rather unhappy with this answer. I can imagine they would be seeing they're out of a job already with the government shutdown furloughs and their future prospects are looking pretty grim if no-one trusts their work anymore. If they left the NSA/NIST for a security company would anyone consider hiring them? You would need to ascertain where their loyalties lie. I'm sure there's a few trustworthy ones that don't agree with mass surveillance and are just following orders. However the recent scandal paints them all in a bad light.
Sep
27
comment Is modern encryption needlessly complicated?
@Arturo - Sorry your argument doesn't make sense. This method is for future communications. If a person generates enough key data for many messages (e.g. megabytes or gigabytes worth) then delivers the key data via a secure channel (e.g. in person) to the recipient, then this in effect establishes a new secure channel for future communications and they can depart from one another to different parts of the globe and still send as many messages as they want, up to the length of the key data that was originally transferred.
Sep
26
answered With a true random number generator at hand, how to implement one-time pad?
Sep
21
comment Why is AES considered to be secure?
From the time between when the winner Rijndael was selected and when AES was published as a standard, what changes were made to the algorithm by NIST? Rijndael won not because it had the best security but because it was slightly faster and because of other "design considerations". What were these other considerations and why are they more important than security? If high security was priority, Serpent or Twofish should've been chosen regardless of if they were a bit slower. It's interesting to note that Keccak (the SHA3 winner) also had Daemen as an author. Winning twice in a row seems odd...
Sep
21
comment Is it possible to find a preimage for a reduced size hash?
Ok many thanks for your answers tylo.
Sep
21
awarded  Scholar