SquareRootOfTwentyThree

514 reputation

bio	website
	location	Europe
	age
visits	member for	1 year, 7 months
	seen	1 hour ago
stats	profile views	9

	514 reputation	bio	website		visits	member for	1 year, 7 months
18 badges		location	Europe		seen	1 hour ago

summary answers questions tags badges favorites bounties reputation activity

22 Comments

suggestions reviews revisions comments badges posts accepts all

Feb 27	comment	Why are RSA keys encoded with ASN.1 for TLS? There are exploits that target buggy implementations of ASN.1, but not ASN.1 itself. In the same way, there are also exploits for XML implementations, but that does not mean that XML is bad. There could be also exploits for you custom hex encoding, no matter how simple.
Nov 4	comment	RSA and prime difference I tried to clarify more.
Nov 3	comment	RSA and prime difference DSS does not cover DSA only anymore. It has been extended to include RSA and ECC. Indeed my question may be academic but I find it interesting. To say, what tells me that a 1026-bit $p$ and a 1022-bit $q$ are not actually more secure?
Sep 25	comment	How practical are side-channel attacks and how much of a concern are they? Uhm. You link two articles that advocate for more widespread measures against side channel attacks. However, both are authored by a company (now acquired) that sells such measures via patent licensing. Such company is (or was) definitely a serious and respectable one, but to me it does not look like a totally objective point of view.
Sep 12	comment	How practical are side-channel attacks and how much of a concern are they? I agree the risk should be assessed (with the threat agent possibly being a market competitor) but that does not automatically imply that you will find a good motivation to address side-channel attacks. It's very hard to receive bad publicity out of a breach due to side channels attacks (which are today perceived as sophisticated attacks since they require some knowledge of statistics in most cases) unless the product is very widespread and there is a real brand to defend.
Sep 12	comment	How practical are side-channel attacks and how much of a concern are they? @fgrieu I have not used the word "econonomically" but only "rewards". Academic attacks, script kiddies, terrorists and so on don't go after money but they can still be modeled while doing risk analysis. Implementation of countermeasures is expensive, so I don't think they should be implemented "just in case".
Aug 16	comment	What is the actual difference between security through obscurity and true encryption? @stephen-harris Side channel attacks on cryptographic systems (which are nowadays a big threat, maybe more than cryptanalysis) are based on a priori knowledge of the cryptographic algorithm. If the algorithm is secret, SCAs become a lot harder (yet not impossible).
Aug 6	comment	How long does it take to extract a key from a FIPS-140 Level 2 device? This question belongs to security.SE
Aug 3	comment	Which of these 3 AES 128 symmetric encrypt/decrypt routines is most secure? The comparison was between GCM and CTR/CBC+HMAC, not between GCM and pure CTR/CBC. In that sense, oracle attacks are defeated in all three cases, isn't it?
Aug 2	comment	Entropy of system data - use all and hash, or trim least significant bits? Where should the randomness for deciding the length of the sampling period come from? I agree with the approach from a practical standpoint, even though I doubt it will increase the amount of actual entropy being collected (you say it will produce "more random data").
Jul 5	comment	Using a derived key for CMAC +1 and good links for KDFs. Another one is this.
Jun 30	comment	Using bad generator in ElGamal Encryption If the generator has not order p, you don't have Elgamal, but a variant of it I would say. Apart from that, leakage of the Jacobi symbol applies to RSA as well. Using an appropriate plaintext encoding is the correct solution in both cases.
Jun 11	comment	Hash function in PBKDF2 You got me there. I didn't know this attack happened. However, from the little I can see, the only consequence (when used for compression) is that the password space may be reduced by a couple of bits. Other constructions will be better, but I don't see it as a dramatic problem in this case.
May 30	comment	are CFB and OFB really meant for streaming? True, but then you have a non-compliant CFB implementation.
May 30	comment	Which MACs can be converted into a secure unkeyed hash function? I ask the question for two reasons:i) Curiosity ii) To know the limitation of the MACs and avoid an error that quite often people tend to do. One practical reason could also be that sometime you don't have the luxury of having the whole crypto zoo available. In some constrained systems, you may only pick one or two primitives. A MAC that can be turned into a (non-standard) secure unkeyed hash is beneficial in those cases.
May 28	comment	RSA/DSA: Wouldn't it make sense to sign using decoding the data hash? In PKCS#1 (the RSA standard), the term "encoding" clearly indicates all the various steps (including padding) that turn the message into an integer suitable for the RSA algorithm. I would not say that the terminology is irrelevant, at least if we give a value to the ability to be understood by the rest of the world...
May 28	comment	Which MACs can be converted into a secure unkeyed hash function? An attack on the hash does not automatically apply to the HMAC construction (used as an unkeyed hash). To say, the hash could be broken in that you can construct collisions for messages that follow a certain structure. If you cannot efficiently force the hash to produce digests according to said structure, the attack won't apply to the HMAC construction. So, IMO iterating the hash function twice might foil certain attacks the original hash function is subject to.
May 28	comment	Which MACs can be converted into a secure unkeyed hash function? @MartinSuecia You are totally right. I edited the question. However, I believe an HMAC (used really as a MAC) can be more secure than the underlying hash. It really depends on how broken the hash is. To say, MD5 is broken, but HMAC-MD5 is not currently deemed to be so (although it is not a brilliant idea to use it for new designs). RFC6151 explains it better than I can.
May 24	comment	Is it secure to use the hash of key as the IV in AES encryption? @Lacek Reusing an IV in CBC and CFB is not as bad, but it is still insecure. ECB should simply not be used. An example of mode which is in most cases still secure enough even if the IV is wrong or abused, is SIV.
Apr 30	comment	How to collect, process, and transmit data securely? I mostly disagree. Examples exist of protections based on obfuscation that practically withstood RE for years. Skype's protocol is one example: it was released 10 years ago and although some clever people published some partial analysis, and some others claimed to have partially reversed it, it is still considered unbroken in practice. Anyway, I don't believe obfuscation is cryptographically secure (so it's off topic here). I would rather say it could be made economically secure, if done properly.