Announcing TripleSec - JavaScript encryption combining Salsa20, AES, and 2fish

Re:Announcing TripleSec - JavaScript encryption combining Sa... by jimrandomh on Tuesday September 17, 2013 @07:34PM (#6402567)

Hi Max! Have you looked into taking the style of cipher-stacking you use for symmetric encryption, and applying it to key-stretching? For example, you might replace PBKDF2 with PBKDF2^bcrypt^scrypt. Similarly for public-key encryption: is there a good reason not to stack RSA and multiple elliptic curves?

I personally think it's very unlikely that any of these algorithms have been broken, but it'd be a good way to restore some faith in cryptography, and introduce a safety factor.

[ Parent | on HN ]

Re:Announcing TripleSec - JavaScript encryption combining Sa... by maxtaco on Tuesday September 17, 2013 @07:51PM (#6402622)

For PBKDF2, we use SHA-512 XOR SHA3 as the inner PRF. But you're right, it would be interesting to stack bcrypt and scrypt too. That's a good idea in the name of maximum paranoia. My slight reservation here is that I haven't seen any published results on combinations of key stretchers (there are several for the other primitives).

As for public key stacking, it depends on the application. The fear with putting encrypted data on a server is that it might sit there for all time and therefore needs to be present- and future-proof. If using public key for signatures, you can plan ahead for your key's expiration. For public key encryption, maybe stacking is the right idea.

[ Parent | on HN ]