413 reputation
210
bio website mattnordhoff.com
location
age
visits member for 1 year
seen 10 hours ago

2d
answered Why is the P-521 elliptic curve not in Suite B if AES-256 is?
2d
awarded  Yearling
Aug
23
comment RSA and ECDSA Certificate Sizes
Ohhh. I totally misunderstood your question. I'm sorry. I think there have been one or two certificate size-related questions here or Crypto, but I don't have any information off the top of my head. I suppose you could create some certs and find out. It can be pretty variable depending on the meta data in the cert, no? (e.g. the length of your domain, of the CA's name...).
Aug
22
comment Is this a plausible PBKDF?
I'm not encouraging you to use unproven schemes, but if you're interested in learning, you might like to follow the Password Hashing Competition. You might find the submissions interesting, and a couple years from now there should be some nice new password hashing algorithms available. For now, use PBKDF2, bcrypt or scrypt, of course.
Aug
21
awarded  Informed
Aug
21
answered Private Key - Memory Lifecycle
Aug
6
comment How many degrees of freedom up my sleeve?
@owlstead I'm having trouble finding what I was thinking of. There's been so much arguing about curves, after all. DJB's post at the top of the page, A few good primes, discusses choices of primes, and I recently read an older post on the curves list by Trevor Perrin listing variables in a Brainpool-style curve.
Aug
6
comment How many degrees of freedom up my sleeve?
There's been a similar discussion of elliptic curve "rigidity" recently. If you're curious, look for one of the CFRG threads where DJB kicks someone's butt, IIRC.
Jul
7
awarded  Critic
Jul
7
awarded  Citizen Patrol
Jun
21
comment DH “prime size” security in OpenSSL
By the way, you don't need to generate your own parameters. You can use, for example, get_rfc3526_prime_2048 to load some standard ones.
Jun
16
comment AES VS PRNG+HASH+XOR
You've invented a slightly odd and complicated stream cipher. It would be simpler to use an actual stream cipher (e.g. ChaCha or AES-CTR ;-) instead of the undefined "PRNG" and remove the hashing. (I'm avoiding subject of authenticated encryption.)
Jun
13
comment Why does AES-GCM need MAC? (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
The hash function is also used to authenticate the handshake in the Finished message; see section 7.4.9.
May
31
comment Update to “Cryptographic Right Answers”
To clarify: AES-CTR authenticated with HMAC-SHA256 using Encrypt-then-MAC is still a Good Idea. (AEADs like AES-GCM or AES-OCB are also a Good Idea. As Percival wrote then, it was and still is complicated and debatable, and the field is still evolving. You have to be different kinds of careful in every case.) Unauthenticated AES-CTR -- or unauthenticated anything else -- is always an awful idea.
May
21
comment Simple way to extend AES to 256-bit block size
FYI, Rijndael was originally defined with multiple block sizes, including 256 bits; this was left out of the AES specification, as NIST was uninterested. I'm not sure these variants have received enough cryptanalysis, and I'm not implicitly endorsing this endeavor (or dis-endorsing it either).
May
11
comment Security of KDF1 and KDF2 (hash based KDF's)
@owlstead I don't get it, though. $c|K$ and $K|c$ would be equally vulnerable to a length extension attack as long as $OtherInfo$ comes last, wouldn't they? In other words, KDF3 is equally vulnerable, if that's the "possible security issue".
May
11
comment Security of KDF1 and KDF2 (hash based KDF's)
I should, perhaps, have mentioned the optional "OtherInfo" concatenated on, e.g. $H(x | y | OtherInfo)$.
May
11
comment Security of KDF1 and KDF2 (hash based KDF's)
Your "this page" says, nebulously, that $H(K | c)$ has "a possible security issue" fixed by using $H(c | K)$ instead. The former is used by ISO KDF1 and KDF2, the latter by KDF3 and NIST SP 800-56A. Does it matter?
Apr
23
comment Is it necessary to use single hash function for signature generation and HMAC?
@owlstead But they don't win hands down in my heart. :'(
Apr
23
awarded  Revival