Luis Casillas
  • Member for 5 years, 9 months
  • Last seen this week
Is it safe to convert a 256-bit nonce into a 192-bit nonce by SHA-256ing and then truncating it?
Accepted answer
4 votes

I'd expect a 196-bit nonce derived from a 256-bit nonce by computing the SHA-256 hash and then truncating it to 24 bytes to behave like an approximately uniformly randomly generated 196-bit nonce [...]...

View answer
Can the input to a one way function be pseudorandom?
4 votes

The definition of a one=way function, according to Wikipedia, is: A function $f : \{0,1\}^* \to \{0,1\}^*$ is one-way if $f$ can be computed by a polynomial time algorithm, but any polynomial time ...

View answer
SHA256 output to 1-6 number range?
4 votes

The approximate way You don't need to be perfectly even if you can make the unevenness small enough to be undetectable. So you can realistically do this: take the first 128 bits (16 bytes) from the ...

View answer
PBKDF2 with SHA-256/512 for low entropy input?
Accepted answer
4 votes

I've seen one case mention that using SHA-512 would increase the memory requirements for attackers. In some cases, I know that increasing memory requirements will make GPU hashing less effective. Not ...

View answer
Do you really need a KDF when you have a PRF?
4 votes

Yet, I am not sure there are modern symmetric algorithms that require the secret to be uniformly distributed. Sure their security might be defined with a uniform key, [...] While people normally say ...

View answer
Does there exist a mode of operation that forces mac-then-decrypt?
4 votes

There is a type of AEAD construction, exemplified for example by the CAESAR candidate AEZ, which splits up into two components: An enciphering scheme: "an object that is like a conventional ...

View answer
Why would my certificate's signature algorithm differ from its keys' signature algorithms?
Accepted answer
4 votes

I can't get my head around why the certificate itself has one signature algorithm, but the same certificate's public and private keys have a different signature algorithm. A certificate is a document ...

View answer
Using AWS KMS to manage secret keys
4 votes

AWS is complicated, and most of the details are not in scope for this site. We will need to store AWS credentials in plain text on servers (our server as well as client's) to call KMS, how is it ...

View answer
Is an AEAD the recommended method to add encryption + HMAC to a protocol?
4 votes

I think you're a bit unclear about the factoring and abstraction layers here. A correctly designed AES + HMAC construction is AEAD. This is because AEAD is about what interface and contract the ...

View answer
Is HMAC a suitable substitute for HKDF?
4 votes

HKDF is itself built from HMAC, so your question strikes me as a false dilemma. If you have HMAC, HKDF Is just a handful of HMAC calls; you could just implement your own. Yes, I know that "don'...

View answer
Why this complexity defining AES-GCM counter block?
Accepted answer
4 votes

Knowing that it does not need to be secret and its only required property is to be unique, why not use a 128 bits true random number for the whole block? The counter instead of starting at 0 will ...

View answer
Why does md5_crypt move bytes around?
4 votes

One of the candidate answers you should consider is "for no good reason." As Provos and Mazières put it in the bcrypt USENIX paper (section 6.1.2): Some steps in the algorithm make it doubtful ...

View answer
Can I reuse a nonce to retransmit the same packet using ChaCha20-Poly1305?
Accepted answer
4 votes

I understand the "sudden death" implications of reusing a nonce with ChaCha20-poly1305, but I believe this rule doesn't apply if you are transmitting exactly the same packet. There are two aspects to ...

View answer
Is it secure to use so many iterations of AES-CBC as a KDF so that it's slow even using AES-NI?
4 votes

Here's an answer that takes your question down a different path. RFC 2898, "PKCS #5: Password-Based Cryptography Specification: Version 2.0" is the document that defines the PBKDF2 function, ...

View answer
Does a practical collision attack on a cryptographic hash function also mean it fails “indistinguishable from random data”?
Accepted answer
4 votes

Does a practical collision attack on a cryptographic hash function also mean we can (or should) consider it to fail “indistinguishable from random data”? Or does a collision attack have no influence ...

View answer
What are the vulnerabilities of this OTP-like system?
Accepted answer
4 votes

I've read that a OTP is only perfectly secure if the key is perfectly random, and the pad is never reused. But you've left out the most important condition: the key space must be as large as the ...

View answer
Does there exist a deterministic, invertible function $\{0,1\}^n \rightarrow \{0,1\}^n$ that is not a bijection?
4 votes

Does this have to be explicitly said? You stripped the preceding context from that quote: Let $F$ be a mapping $\{0,1\}^n × \{0,1\}^s → \{0,1\}^n$. $F$ is a PRP if For any $K ∈ \{0,1\}^s$, ...

View answer
Password Entropy in bits for passwords of a certain structure
Accepted answer
4 votes

Is my caculation and conclusion (S~40) correct? Yes, but it's important to state the premises behind these calculations and not relegate them to a footnote. Namely, that each character in the ...

View answer
usefulness of a collision attack that's not also a 2nd pre-image attack
Accepted answer
4 votes

What would be the usefulness of a pure collision attack where you have no control over $m$ or $m'$? One example is when $m$ and $m'$ are or contain randomly selected material. If they're using ...

View answer
AES-256-ECB to encrypt VOIP audio-stream?
4 votes

I would be very scared about using ECB with audio (or anything really). Note for example that attacks have been demonstrated on variable bitrate compressed encrypted audio: Despite the rapid ...

View answer
HMAC with secret hash constants
4 votes

Here it helps to understand the history, internals and rationale for HMAC and Merkle-Damgård hash functions in a bit more depth. In the M-D construction, the IV is used as the chaining argument to ...

View answer
How much original entropy is lost if a part of the hash is known?
4 votes

So you have a random string $Input$ with $n < 512$ bits of entropy. Thinking of it as a game, it's one where on each turn the adversary offers a guess for the value of $Input$, and if that guess ...

View answer
How is the quality of a password calculated and what does it mean?
4 votes

The first thing to say is you shouldn't automatically trust password strength meters without knowing their methodology and verifying whether it's a good one. Many are really terrible. Keepass' isn't ...

View answer
Why is ISAAC not a pseudo random number generator?
4 votes

I've certainly been confused over the definitions and scope of these terms as well. Over time, as I've learned more, I've come to see it in terms of two use cases. The first is when two parties ...

View answer
Basic encryption question: Why does 128/256 bit encryption have set length keys?
4 votes

The first thing that you really need to understand is that cryptographic keys are not the same thing as passwords. Many newcomers to cryptography are familiar with passwords, and identify keys as an ...

View answer
Which password generation method could provide better security?
4 votes

The ideal password would be: Secure: Randomly drawn with equal probability from a sufficiently large set; Usable: Easy for a human being to memorize and input into their device. These two goals are ...

View answer
Should I use “modes of operation” for a single block of data?
4 votes

The generic advice, which is more likely applicable than not, is that you should use something that provides both authenticity and confidentiality. Since neither ECB (or equivalently your "modeless" ...

View answer
How to securely combine multiple sources of entropy?
Accepted answer
4 votes

If your keys, taken together, have sufficient entropy to support your desired security level, then HKDF (paper) is a conservative solution here, because it assumes that the input keying material to ...

View answer
Why does entropy halve during its extraction?
4 votes

I'm sure that somebody can give a better answer, but I can at least point the HKDF paper as containing some references that you might want to chase. See, e.g., Section 2, "Statistical and ...

View answer
Why bcrypt is one-way while Blowfish is reversible?
4 votes

Because bcrypt uses Blowfish as a component inside an irreversible algorithm. This is very common—many variable-input length cryptographic algorithms are built from smaller, fixed-input-length ...

View answer
1 2 3
4
5
10