# Henrick Hellström

reputation
1311
bio
website
location
age
member for     1 year, 3 months
seen           1 hour ago
profile views  29

|             |                  | bio     | visits   |            |                  |
|-------------|------------------|---------|----------|------------|------------------|
|             | 2,521 reputation | website |          | member for | 1 year, 3 months |
| 1311 badges | location         |         | seen     | 1 hour ago |                  |

# 177 Comments

|       |         |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
|-------|---------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Mar12 | comment | Diffie-Hellman key agreement with both Server Authentication and Perfect Forward SecrecyI guess you meant to describe a repeated adaptive attack that would reduce the security bounds, rather than an immediate break? Choosing 2048/256 bit DH parameters and a properly designed HMAC-SHA256 based KDF, seeding AES-GCM, would seem to be adequate for at least 100 bits of CCA2 security. Would anything be gained by changing the key derivation step 4, in such way that the server hello message includes a random nonce that is mixed in with the Diffie-Hellman shared secret $M^1_{tmp}$ when $k_{tmp}$ is derived? |
| Mar11 | comment | Diffie-Hellman key agreement with both Server Authentication and Perfect Forward SecrecyThank you for you comments. Regarding step 4, Diffie-Hellman works like this: Client calculates $M^1_{tmp} \leftarrow (S^0_{publ})^{C^1_{priv}}$ and server calculates $Mî_{tmp} \leftarrow (C^1_{publ})^{S^0_{priv}}$                                                                                                                                                                                                                                                                                                                |
| Mar11 | comment | Diffie-Hellman key agreement with both Server Authentication and Perfect Forward SecrecyI think you might have to spell out the steps involved in this attack. The presumption is that $Adversary$ might see $C^1_{publ}$, but not $C^1_{priv}$. How does $Adversary$ make $Client$ perform step 4 based on $S^0_{publ}$ and $Adv^1_{priv}$, which seems to be necessary in order for the client to perform step 7 without failure, given that the step 6 has been injected by $Adversary$ in the way you describe?                                                                                                           |
| Mar11 | comment | Diffie-Hellman key agreement with both Server Authentication and Perfect Forward SecrecyWell, fwiw, I have already done that. (Read it, analyzed it, implemented it.) But that is largely beside the point, since TLS 1.2 clearly isn't the protocol with the least overhead that meets the requirements listed in the question. Even if you fix the cipher suite (and possibly invent a new one for a DH_DHE key agreement), you will have to send and process redundant negotiation messages. Hence my question.                                                                                                            |
| Mar11 | comment | Method and explanation for calculating difference in speed between DES and RSAYou have not provided sufficient information. Firstly, different implementations of both algorithms have different speed. Secondly, what RSA padding is used? Thirdly, what size of the RSA modulus is assumed? Fourthly, what is the length of the plain text to be encrypted?                                                                                                                                                                                                                                                                 |
| Mar10 | comment | Where to store the private key and the public key in a communication protocolSecure protocols are designed to be secure even if they are known. Security through obscurity is not real security, at least not in the cryptographic sense. However, you are right that the flexibility of SSL/TLS is a valid security concern (in the sense that it complicates both the protocol and the implementations). Many existing SSL/TLS implementations will allow you to restrict the set of allowed protocol versions and cipher suites. Do that, and ISTM you will have accomplished what you want.                               |
| Mar8  | comment | How difficult is it to check if a group element is in a sub group?@Poncho: Thanks, fixed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Mar7  | comment | Timing attack on modular exponentiation@SmitJohnth: The second part of my answer concerns the case where the attacker doesn't only vary the input to the function, but also varies other external factors. In this case it is possible to not only count the bits of the exponent, but determine their position.                                                                                                                                                                                                                                                                                                              |
| Mar7  | comment | Equivalents to a physical hat+shaking?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| Mar6  | comment | Timing attack on modular exponentiation@SmitJohnth: The purpose of the side channel attack I describe is to determine the position of the 1 bits with arbitrary precision.                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| Mar6  | comment | Timing attack on modular exponentiation@SmitJohnth: Well, presumably you implemented the critical parts, such as multiplication, in assembler. If you don't, it will be hard to avoid input dependent conditional branches when dealing with carries.                                                                                                                                                                                                                                                                                                                                                                         |
| Mar5  | comment | is AES secure for java application licensingRunning the application in a debugger will reveal enough information to calculate every possible key that will unlock your software.                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| Mar4  | comment | Are there any secure commutative ciphers?This question probably has to be rephrased. Commutativity is, by itself, more of a security vulnerability than a security feature. If you really need this commutativity, you probably have to build an entire protocol around it, to make sure it can't be exploited by an attacker. Just asking for the security of the commutative cipher itself doesn't make much sense.                                                                                                                                                                                                         |
| Mar3  | comment | In RSA, how to make sure that $p-1$ and $q-1$ are still hard to factorize?Ah, no, I was comparing apples to oranges: The algorithms I was timing were too different to make sense of comparing them.                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Mar3  | comment | In RSA, how to make sure that $p-1$ and $q-1$ are still hard to factorize?@Poncho: If you look closely at FIPS 186 prime generation, it contains a counter that makes the search for $p$ break and generate a new $q$. If you don't have that step, you might end up with a subprime for which finding a prime is infeasible.                                                                                                                                                                                                                                                                                                 |
| Mar2  | comment | In RSA, how to make sure that $p-1$ and $q-1$ are still hard to factorize?@Poncho: Well, our results show that finding primes $p$ with $p-1$ having large prime factors might take about 10 times longer. Another possibility is that Rabin-Miller is more likely to return false positive in the first iterations for $p = rk + 1$, which would also cause a slow down.                                                                                                                                                                                                                                                      |
| Mar2  | comment | In RSA, how to make sure that $p-1$ and $q-1$ are still hard to factorize?IME step 2 is more expensive in the sense that it is less likely, given a fixed prime $r$ and a randomly selected $k$ of a fixed size, a number of the form $rk + 1$ is a prime, compared to a completely random odd integer of the same size. I only have experimental evidence to support this conjecture, though.                                                                                                                                                                                                                                |
| Mar2  | comment | What is “Blinding” used for in cryptography?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| Mar2  | comment | Timing attack on modular exponentiationThen again, some of that info doesn't necessarily help in common scenarios.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| Mar2  | comment | What is “Blinding” used for in cryptography?Then again, it is usually not the value $x$ to-be-raised that has to be blinded, but the private exponent $d$. Your method does not blind $d$, so if the timing attack works independently of the value-to-be-raised, it has no effect at all.                                                                                                                                                                                                                                                                                                                                    |
{"extraction_info": {"found_math": true, "script_math_tex": 0, "script_math_asciimath": 0, "math_annotations": 0, "math_alttext": 0, "mathml": 0, "mathjax_tag": 0, "mathjax_inline_tex": 31, "mathjax_display_tex": 0, "mathjax_asciimath": 0, "img_math": 0, "codecogs_latex": 0, "wp_latex": 0, "mimetex.cgi": 0, "/images/math/codecogs": 0, "mathtex.cgi": 0}, "config": {"markdown_headings": true, "markdown_code": true, "boilerplate_config": {"ratio_threshold": 0.18, "absolute_threshold": 10, "end_threshold": 15, "enable": false}, "remove_buttons": true, "remove_image_figures": true, "remove_link_clusters": true, "table_config": {"min_rows": 2, "min_cols": 3, "format": "github"}, "remove_chinese": true, "remove_edit_buttons": true, "extract_latex": true}, "english_confidence": 0.935390830039978, "perplexity_flag": "middle"}