821 reputation
312
bio website
location Europe
age
visits member for 3 years, 3 months
seen 10 hours ago

Aug
29
comment Choice of authenticated encryption mode for whole messages
@e-sushi The GCM spec may be biased when it comes to painting the benefits of GCM against other modes. In my experience, the Galois multiplication is very tricky to implement, especially because of the pre-compuetd tables necessary to speed it up and the awkward bit ordering. As Adam Langley puts it "GCM is fundamentally unsuitable for software implementation". EAX is a more straightforward combination of CTR and OMAC.
Apr
20
comment Diffusion in Shamir's secret sharing scheme
Thanks, I didn't know about CSS. Yet, I think you response does not explain the behaviour of ssss' code. In that case, the secret is still smaller than each share. In addition to that, the transformation I see being applied is not really an encryption. It is just a fixed permutation.
Apr
20
comment Diffusion in Shamir's secret sharing scheme
I replaced p with q to avoid confusion.
Apr
17
comment AES-SIV security
Probably not. One example is McOE though I don't know its patent status and it may not have been reviewed long enough yet.
Sep
1
comment How to renew keys for a statically-encrypted database
@brent-longborough If you are sure 100% sure your nonce does not repeat (it does not necessarily needs to be random) GCM is perfectly fine and as good as SIV, with the benefit that you need just 1 AES key. GCM is quite difficult to implement in software though. If your security module does not support it already, maybe you could consider CCM and EAX: they are much simpler (EAX especially) but as secure as GCM.
Feb
27
comment Why are RSA keys encoded with ASN.1 for TLS?
There are exploits that target buggy implementations of ASN.1, but not ASN.1 itself. In the same way, there are also exploits for XML implementations, but that does not mean that XML is bad. There could be also exploits for you custom hex encoding, no matter how simple.
Nov
4
comment RSA and prime difference
I tried to clarify more.
Nov
3
comment RSA and prime difference
DSS does not cover DSA only anymore. It has been extended to include RSA and ECC. Indeed my question may be academic but I find it interesting. To say, what tells me that a 1026-bit $p$ and a 1022-bit $q$ are not actually more secure?
Sep
25
comment How practical are side-channel attacks and how much of a concern are they?
Uhm. You link two articles that advocate for more widespread measures against side channel attacks. However, both are authored by a company (now acquired) that sells such measures via patent licensing. Such company is (or was) definitely a serious and respectable one, but to me it does not look like a totally objective point of view.
Sep
12
comment How practical are side-channel attacks and how much of a concern are they?
I agree the risk should be assessed (with the threat agent possibly being a market competitor) but that does not automatically imply that you will find a good motivation to address side-channel attacks. It's very hard to receive bad publicity out of a breach due to side channels attacks (which are today perceived as sophisticated attacks since they require some knowledge of statistics in most cases) unless the product is very widespread and there is a real brand to defend.
Sep
12
comment How practical are side-channel attacks and how much of a concern are they?
@fgrieu I have not used the word "econonomically" but only "rewards". Academic attacks, script kiddies, terrorists and so on don't go after money but they can still be modeled while doing risk analysis. Implementation of countermeasures is expensive, so I don't think they should be implemented "just in case".
Aug
16
comment What is the actual difference between security through obscurity and true encryption?
@stephen-harris Side channel attacks on cryptographic systems (which are nowadays a big threat, maybe more than cryptanalysis) are based on a priori knowledge of the cryptographic algorithm. If the algorithm is secret, SCAs become a lot harder (yet not impossible).
Aug
6
comment How long does it take to extract a key from a FIPS-140 Level 2 device?
This question belongs to security.SE
Aug
3
comment Which of these 3 AES 128 symmetric encrypt/decrypt routines is most secure?
The comparison was between GCM and CTR/CBC+HMAC, not between GCM and pure CTR/CBC. In that sense, oracle attacks are defeated in all three cases, isn't it?
Aug
2
comment Entropy of system data - use all and hash, or trim least significant bits?
Where should the randomness for deciding the length of the sampling period come from? I agree with the approach from a practical standpoint, even though I doubt it will increase the amount of actual entropy being collected (you say it will produce "more random data").
Jul
5
comment Using a derived key for CMAC
+1 and good links for KDFs. Another one is this.
Jun
30
comment Using bad generator in ElGamal Encryption
If the generator has not order p, you don't have Elgamal, but a variant of it I would say. Apart from that, leakage of the Jacobi symbol applies to RSA as well. Using an appropriate plaintext encoding is the correct solution in both cases.
Jun
11
comment Hash function in PBKDF2
You got me there. I didn't know this attack happened. However, from the little I can see, the only consequence (when used for compression) is that the password space may be reduced by a couple of bits. Other constructions will be better, but I don't see it as a dramatic problem in this case.
May
30
comment are CFB and OFB really meant for streaming?
True, but then you have a non-compliant CFB implementation.
May
30
comment Which MACs can be converted into a secure unkeyed hash function?
I ask the question for two reasons:i) Curiosity ii) To know the limitation of the MACs and avoid an error that quite often people tend to do. One practical reason could also be that sometime you don't have the luxury of having the whole crypto zoo available. In some constrained systems, you may only pick one or two primitives. A MAC that can be turned into a (non-standard) secure unkeyed hash is beneficial in those cases.