Hot answers tagged

7

This is identical with CTR mode encryption with a MAC. That's known to be secure. It doesn't say in your question if: the Ai blocks are completely unique; the header is included in the MIC calculation. If those preconditions are met then I don't see any issue with the protocol. The first one I cannot verify but seems likely, the second one is certainly ...


4

At least for compiled languages it should also be possible to have tools that perform static analysis on machine code, shouldn't it? Indeed, such tools exist. There are companies specialized in this domain which provide this kind of tools (see this datasheet for example). But you should note that an only software tool will not be able to detect all ...


3

I'm wondering what the recommended number of iterations would be? Unlike bcrypt or traditional crypt, argon2 does not have a single iteration count, but three parameters affecting the computational cost: Number of iterations $t$, affecting the time cost. Size of memory used $m$, affecting the memory cost. Number of threads $h$, affecting the degree of ...


3

Since $a_1 = e^{r_1(p-1)} \bmod N$ and since $p$ divides $N$, it follows that $a_1 \equiv e^{r_1(p-1)} \equiv 1 \pmod p$. We so have $a_1 - 1 \equiv 0 \pmod p$ or, equivalently, $a_1-1$ is a multiple of $p$. In turn, this implies (with overwhelming probability) that $\gcd(a_1-1,N) = p$ and thus $q =N/p$. Since $d_1 \equiv {a_1}^{s_1} \equiv 1 \pmod p$ and ...


2

You won't be able to use a stream cipher with VOIP, because packet loss will prevent you from properly decrypting data that follows the missing chunks. It may be possible to work around this issue, if you can figure out the size of the missing data, and assuming your chosen stream cipher does not have feedback, fast-forward to cipher to the start of the ...


2

I think that it was to make sure that the leading zeroes in the data to hash are taken into account during the hash. Without the '1' prefix value, those leading zeroes would make the fingerprint stay to zero. Without the '1' prefix, the following 2 list of bytes would have the same fingerprint: [42, 5, 3] [0, 0, 0, 0, 0, 0, 0, 0, 0, 42, 5, 3]


2

Slide #8 in the presentation you linked to describes the way Käsper and Schwabe pack the bits of the AES data blocks into CPU registers. According to the slide, what they're doing is processing eight 128-bit AES blocks in parallel, using eight 128-bit XMM registers to store them. They're not doing basic "naïve bitslicing", which would involve using 128 $n$-...


1

newR: [ -1, 1, 1, 0, -1, 0, 1, 0, 0, 1, -1 ] This polynomial is $f = -x^{10} + x^9 + x^6 - x^4 + x^2 + x - 1$ where you wanted: $f=x^{10}+x^9+x^6−x^4+x^2+x−1$ The sign for the $x^{10}$ was opposite. Your algorithm/code is actually correct. See the following calculation from sage: sage: f -x^10 + x^9 + x^6 - x^4 + x^2 + x - 1 sage: f_inv 30*x^10 ...


1

Based on the more recent Disturbance vectors for collision attacks against SHA-1 by the same author, which Maarten Bodewes mentioned in the comments, the initial attack/complexity was optimistic/erroneous. The algorithm actually leads to a disturbance vector that had already been published: Using our algorithm and those cost function we retrieved all ...



Only top voted, non community-wiki answers of a minimum length are eligible