305 reputation
17
bio website
location
age
visits member for 1 year
seen Aug 21 at 4:35

2d
awarded  Yearling
Aug
21
comment Does SHA-1024 hash exist?
If you really need a cryptographic hash function with a large output you could try Skein-1024. It has the added advantage of not being designed by NSA.
Jul
31
comment Using Lattice-based cryptography for TLS\SSL
Secondly, the drawback that they've been studied less than RSA or ECC is true, but how can you quantify what is a safe time period to wait in order for them to be considered "well studied"? 10 years? 20 years? 30 research papers? Perhaps what we need is a more open competition like AES or SHA3 where the better algorithms will get some proper cryptanalysis. However lets not let the NIST run it, but an international organisation of reputable cryptographers. Otherwise NSA will just co-opt the standard again.
Jul
31
comment Using Lattice-based cryptography for TLS\SSL
It doesn't make sense to wait until there's significant evidence that a quantum computer capable of breaking current crypto is practical. Why? Because the first people who will likely get one are NSA. They have a yearly budget of $11.7B and they don't share their research or what goes on inside that place. Nobody except NSA will know when one is operational. In fact it's likely already operating right now. Refer to the Utah data center. A move to post quantum crypto for all protocols is necessary now. Not when it becomes available to the general public. By then it's too late.
Jul
28
comment True Random Number Generator by milliseconds per keystroke (TRNG-Kms)
I would first eliminate repeating timings that are the same in case a user held down the same key for a long time. Then I would use a hash (e.g. Keccak) as a randomness extractor to get a more uniform distribution. For the low end you could assume each collected timing number has 1 bit of entropy, at the high end maybe 1 byte of entropy. For every 256 bits of estimated entropy, run them through the Keccak-256 hash and the digest is 256 bits of usable key material. Concatenate all the digests together. I wouldn't rely on key strokes alone, there are other physical inputs you can include too.
Jul
7
comment How does Web Cryptography API produce secure PRNG?
I don't think this answer quite goes into enough detail. For instance, the crypto.getRandomValues method fills a typed array e.g. Uint32Array with random numbers. However if it was using the OS's underlying CSPRNG e.g. /dev/urandom, that would return random bytes - so how does it turn those bytes into numbers that fit into the size of the typed array? Can you expand on that?
Jul
5
comment Is SHA256 good enough to shrink a key?
For SHA2, a 2011 attack breaks preimage resistance for 57 out of 80 rounds of SHA-512, and 52 out of 64 rounds for SHA-256. Pseudo collision attack against up to 46 rounds of SHA-256. That doesn't sound amazing. Also you can't use SHA2 as a MAC on its own because of length extension attacks, you have to use it in a special HMAC construction to counter its shortfalls as a hash function. Regarding SHA2 having 13 years of cryptanalysis, that does not count for much if NSA cryptanalysis is 20 years ahead of everyone else. Skein, Keccak or a few other SHA3 candidates are better choices in 2014.
Jul
5
comment Is SHA256 good enough to shrink a key?
Do you work for the NSA Stephen? When using an algorithm from an author it requires a fair amount of trust in their work. When that author has been shown to be backdooring and weakening crypto standards (Dual EC DRBG and more) also their game plan to do exactly this in leaked documents then it's a fair assumption their other work may contain issues. For instance, where is the design document for how SHA2 was designed and the reasons for decisions made, e.g. choice of IVs etc? If I read the specs for Skein and Keccak they detail their decision making process and reasons for every small detail.
Jul
4
comment Is SHA256 good enough to shrink a key?
You haven't said what your use is, but there are better and newer hash algorithms available that aren't written by the NSA - Skein and Keccak come to mind. Use the 256 bit variant of them instead.
Jul
2
comment RSA 896 vs 1024 vs 2048 in Javascript?
My understanding of unsafe curves means that secure implementations of those curves are theoretically possible but very hard. Thus you are likely to mess it up and make your software exploitable by real attackers. Also most of the unsafe curves have erroneous efficiency constraints that make some of them bad for security. It would seem to make implementation easier and your software more secure to ignore the unsafe curves and simply use the safe ones.
Jul
2
comment RSA 896 vs 1024 vs 2048 in Javascript?
Try e.g. the BrainpoolP256r1 named curve. The curve you mentioned seems to be listed on the SafeCurves site as unsafe.
Jul
1
comment RSA 896 vs 1024 vs 2048 in Javascript?
If you are waiting 6 seconds for a key to be generated, that is not actually that bad. I would never reduce your security level to 1024 bits, I would in fact increase it to 3072 bits or even 4096 bits for RSA. Otherwise you risk making your whole protocol crackable by intelligence agencies. It still won't help if they have a quantum computer though. If generation, encryption, decryption or signing is taking too long and blocking the UI, then try putting that code inside a Web Worker and putting some kind of loading spinner gif on the client side so the user can wait patiently.
Jun
24
comment What is the quantum-resistant signature scheme with the smallest signature + pubkey?
There is an interesting article with some comparisons with ECDSA and quantum resistant schemes.
Mar
27
comment How useful is NIST's Randomness Beacon for cryptographic use?
It is too convenient to claim it is a 'prototype' or 'research' project. I think it was released at a time before the NSA leaks and designed to prey on the gullibility of users who might be inclined to use it due to NIST's trusted name stamped on it. The many unknowns about its inner workings, potential for insider knowledge of numbers before they are available, potential for insider manipulation of the numbers, potential use of a Dual EC DRBG standard for generating the numbers that can contain a kleptographic backdoor, all have the trademark signatures of NSA involvement from the start...
Mar
27
comment How useful is NIST's Randomness Beacon for cryptographic use?
The "seedValue" is the hashed output of the entropy source and DRBG. This must be the random 512 bits that the users of the system want. This seedValue is what could be replaced entirely by an insider. It's not needed to manipulate the entropy input into the DRBG. The "signatureValue" is an RSA signature computed over the version, frequency, timeStamp, randomValue, previousHashValue & errorCode. The "outputValue" is the SHA-512 hash of the "signatureValue" as a 64 byte string. They can not be expecting users to use the "outputValue" (the hash of an RSA signature as their "random bits")...
Mar
27
comment How useful is NIST's Randomness Beacon for cryptographic use?
It gets new entropy from the entanglement source to form the next seed for the dubious Dual EC DRBG, which then outputs the new 512 bits of entropy. Surely it hashes and signs only the most recent 512 bits of DRBG output with the past random bits and current timestamp to form a MAC. In which case the output of the DRBG being assumedly random could be replaced without anyone knowing. Surely it doesn't include the past outputs of random bits, current timestamp and signature as part of the seed into the next DRBG output... If it was doing that, then it sounds more like a PRNG rather than a TRNG.
Mar
26
comment How useful is NIST's Randomness Beacon for cryptographic use?
Good answer. I think there is another security problem. Within the 60s delay period, NIST would have access to the system and source code thus they could strategically alter the future random output to whatever they wanted suit their purpose. Even with the 'Unpredictable Sampling' applications linked above I could imagine a few scenarios where a company could pay off an employee inside the NIST to cook the next number and have a particular item/location scanned/checked. Even other agencies like the DEA might have need of "parallel constructions" under the pretense of "random" searches.
Mar
25
awarded  Critic
Mar
20
comment CryptoJS.AES result always has same first few bytes?
Wouldn't that be a pretty easy distinguisher to tell if they're using this library and algorithm (AES) if it's always appending that text to the front of the ciphertext?
Mar
1
answered Estimating random number entropy for input into 256 bit hash