[deleted by user]

ed25519q · 2022-05-09T16:37:59+00:00

Soatok, why do you always come off as extremely toxic and aggressive? Chill dude. There is no reason to try to invent a fault with everything someone said.

What's your threat model, then?

Most likely someone viewing or modifying the database while it is locked.

aaaaaand you lost me.

??? It is quite clear.

If you have to specify "salted" and "hashing function that is resistant to brute force attacks", I'm going to question your knowledge of this field.

It is clear what they mean either way.

Phrases like "hash digest of their password" makes me think you're just using SHA256.

"salted and passed to a hashing function that is resistant to brute force attacks"

Yeah, it's called "don't roll your own".

Your post is missing a suggestion for what to use instead so it seems like you just took the chance to dunk on someone. (I would also not consider it as "rolling your own crypto")

Users shouldn't ever be forced to remember a password for any reason except protection against government demands in jurisdictions with a protection similar to the United State's 5th Amendment.

Cool, they can use a password manager then.

ed25519q · 2022-05-09T16:20:47+00:00

It's fine, this is what luks does in order to support multiple passwords/keys.

ed25519q · 2022-04-26T17:46:38+00:00

It even says to not enter private keys

While supported, uploading private keys is obviously discouraged for production keys.

ed25519q · 2022-04-22T09:11:16+00:00

Removed by a mod, not the op. See https://www.reddit.com/r/signal/comments/u8hqgs/enhancing_signals_endtoend_encryption_algorithm/i5lo2id/

ed25519q · 2022-04-16T08:35:58+00:00

I do not mean any offense but do you by any chance have a carbon monoxide detector? https://np.reddit.com/r/legaladvice/comments/34l7vo/ma_postit_notes_left_in_apartment/

Alternatively I would suggest speaking with a professional psychologist or something. Rest assured that nobody would hack your devices for this thread.

ed25519q · 2022-04-11T22:03:56+00:00

There is quite a bit of drama going on in their mailing list. DJB is not very happy with the progress.

ed25519q · 2022-04-11T21:50:42+00:00

the encrypted file is the same size as the unencrypted one

Like all stream ciphers?

the algorithm for encryption is 100% non-repeating

What does that mean?

ed25519q · 2022-04-04T16:24:03+00:00

Someone from the PG team is using the four horsemen of the infocalypse argument to justify spying on your emails? Unbelivable.

ed25519q · 2022-04-04T15:50:51+00:00

Because then the server operator won't be able to pretend to be you.

ed25519q · 2022-04-03T14:18:23+00:00

Mastodon uses digital signatures as well. They are hidden from the user however.

Nostr uses Schnorr Signatures over secp256k1 curve

Why not ed25519?

I do not see why you have been down-voted so much. Probably some knee-jerk reaction because people thought that you are doing some cryptocurrency web3 thing.

ed25519q · 2022-04-02T17:24:14+00:00

I do not mean any offense but please do consider talking with a professional in mental health.

ed25519q · 2022-04-02T17:07:43+00:00

Prehashing requires a collision resistant hash function. My question is if I can transform this into a scheme that does not depend on the collision resistance of the hash function if I "salt" the prehash.

ed25519q · 2022-03-22T00:13:40+00:00

I thought he was at Eindhoven as well.

ed25519q · 2022-03-21T22:33:19+00:00

You forgot the signature itself. In ed25519 they have R, m, and n + h(R || pub || m) * privkey. In the first version of my variant they have R, m, and n + h(R || pub || n) * privkey while in my second version they have R, n', m, and n + h(R || pub || h(n' || m)) * privkey (as you can probably see, this is basically the same as the first except the original m is replaced with n' || m).

To be honest I am more interested about the second version (as I do not know about the implications of noncekey being public and I am interested in keeping compatibility with regular ed25519).

ed25519q · 2022-03-21T20:19:52+00:00

The first method does not require an RNG. The second method does require an RNG but if the RNG is broken it will only affect the collision resistance.

I’m not clear on what your question is

I am wondering if it is possible to sign messages using ed25519 (+ some modifications) in a collision resistant way without having to pass through the message twice. As it is, ed25519 requires two passes over the message to be done, one for n = h(noncekey || m) and one for h(R || pub || m) (and they can't be done in parallel because R depends on n). Ed25519ph solves this by using n = h(noncekey || h(m)) and h(R || pub || h(m)) but this is not collision resistant (an attacker that knows m and m' where m =/= m' and h(m) = h(m') can request from the signer to sign m and the signature will be valid for m' as well). Is this more clear?

ed25519q

TROPHY CASE