423 reputation
210
bio website mattnordhoff.com
location
age
visits member for 1 year, 3 months
seen 4 hours ago

Nov
2
comment Is a RSA 2048 bits public key secure
What kind of explaining would it take to convince you? You've already read explanations. What can we say? Have you read other related questions on this website or IT Security?
Nov
2
comment Is a RSA 2048 bits public key secure
FYI, the extra 14 bytes are due to the file format used to store the key, as explained here.
Oct
9
comment Do Export Restrictions Still Apply To The Key Length of RC4?
Given that RC4 is a horrible cipher, with worrisome public cryptanalysis and plausible rumors that NSA can break it, they would likely be quite happy for you to use it, regardless of key size.
Sep
20
answered Why is the P-521 elliptic curve not in Suite B if AES-256 is?
Sep
19
awarded  Yearling
Aug
23
comment RSA and ECDSA Certificate Sizes
Ohhh. I totally misunderstood your question. I'm sorry. I think there have been one or two certificate size-related questions here or Crypto, but I don't have any information off the top of my head. I suppose you could create some certs and find out. It can be pretty variable depending on the meta data in the cert, no? (e.g. the length of your domain, of the CA's name...).
Aug
22
comment Is this a plausible PBKDF?
I'm not encouraging you to use unproven schemes, but if you're interested in learning, you might like to follow the Password Hashing Competition. You might find the submissions interesting, and a couple years from now there should be some nice new password hashing algorithms available. For now, use PBKDF2, bcrypt or scrypt, of course.
Aug
21
awarded  Informed
Aug
21
answered Private Key - Memory Lifecycle
Aug
6
comment How many degrees of freedom up my sleeve?
@owlstead I'm having trouble finding what I was thinking of. There's been so much arguing about curves, after all. DJB's post at the top of the page, A few good primes, discusses choices of primes, and I recently read an older post on the curves list by Trevor Perrin listing variables in a Brainpool-style curve.
Aug
6
comment How many degrees of freedom up my sleeve?
There's been a similar discussion of elliptic curve "rigidity" recently. If you're curious, look for one of the CFRG threads where DJB kicks someone's butt, IIRC.
Jul
7
awarded  Critic
Jul
7
awarded  Citizen Patrol
Jun
21
comment DH “prime size” security in OpenSSL
By the way, you don't need to generate your own parameters. You can use, for example, get_rfc3526_prime_2048 to load some standard ones.
Jun
16
comment AES VS PRNG+HASH+XOR
You've invented a slightly odd and complicated stream cipher. It would be simpler to use an actual stream cipher (e.g. ChaCha or AES-CTR ;-) instead of the undefined "PRNG" and remove the hashing. (I'm avoiding subject of authenticated encryption.)
Jun
13
comment Why does AES-GCM need MAC? (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
The hash function is also used to authenticate the handshake in the Finished message; see section 7.4.9.
May
31
comment Update to “Cryptographic Right Answers”
To clarify: AES-CTR authenticated with HMAC-SHA256 using Encrypt-then-MAC is still a Good Idea. (AEADs like AES-GCM or AES-OCB are also a Good Idea. As Percival wrote then, it was and still is complicated and debatable, and the field is still evolving. You have to be different kinds of careful in every case.) Unauthenticated AES-CTR -- or unauthenticated anything else -- is always an awful idea.
May
21
comment Simple way to extend AES to 256-bit block size
FYI, Rijndael was originally defined with multiple block sizes, including 256 bits; this was left out of the AES specification, as NIST was uninterested. I'm not sure these variants have received enough cryptanalysis, and I'm not implicitly endorsing this endeavor (or dis-endorsing it either).
May
11
comment Security of KDF1 and KDF2 (hash based KDF's)
@owlstead I don't get it, though. $c|K$ and $K|c$ would be equally vulnerable to a length extension attack as long as $OtherInfo$ comes last, wouldn't they? In other words, KDF3 is equally vulnerable, if that's the "possible security issue".
May
11
comment Security of KDF1 and KDF2 (hash based KDF's)
I should, perhaps, have mentioned the optional "OtherInfo" concatenated on, e.g. $H(x | y | OtherInfo)$.