Tag Info

New answers tagged

1

One particularly interesting aspect of Poly1305 is that its security is guaranteed, assuming the underlying cipher is secure. In other words, Poly1305-AES is guaranteed to be secure, as long as AES has not been broken. In the event that AES is broken, AES could be replaced with another cipher, and get a similar security guarantee. DJB talks about his ...


-2

ECDSA based on NIST curves contain hard-coded numbers that the community find suspicious. In cryptography, the rule is to throw away the baby, the bath tube and the water when there is some doubt about chlorine origin. DJB curve (the 2 variants ed25519 and c25519) is not based on hardcoded numbers. It is based on a modulus easy to use on standard computer ...


3

$Tag = MAC_k(\Sigma_i m_i)$. Too many attacks to enumerate. As long as the sum over the blocks remains the same, the tag remains valid. If the sum is reduced modulo $2^{\mathrm{blocksize}}$ at the end, the attacker can choose the whole message, apart from a single block used to balance the sum. $t_i = MAC_k(m_i)$ and $Tag = (t_1, ..., t_l)$. ...


1

It is clear that if $r_i$ is picked randomly the above Mac [defined in the second paragraph] would be secure. Actually, that's not at all clear. I would claim that if I were given that values of $Mac_i(a)$ and $Mac_i(b)$, I could compute the value of $Mac_i(x)$ for any $x$, as long as $a-b$ is relatively prime to $p-1$. To do this, I need the value of ...



Top 50 recent answers are included