Ethan Heilman
Reputation
1,390
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
1 10 27
Newest
Impact
~62k people reached

• 3 helpful flags
• 217 votes cast

# 101 Comments

 Apr 15 comment Non-iterative cryptographic hash functions It has, thanks for your help. Apr 14 comment Non-iterative cryptographic hash functions I agree that non-iterative is a bad word to use for this property. What do you think about non-streaming compression? I really like where you are going with this however I'm concerned about the following situation: Let $G(x) = md5(x)||x$ and $H(x)=md5(x)$, wouldn't this allow me to define $md5(x)$ as "non-iterative/non-compressing"? Apr 13 comment Non-iterative cryptographic hash functions @ChrisPeikert SPRPs exist for any length, thus for each $|m|$ we choose a SPRP with the correct domain size. Apr 10 comment Non-iterative cryptographic hash functions @otus Consider two messages $m$ and $m'$ where $f(m_2||m_3||m_4||m_4||m_3||m_2) = f(m'_2||m'_3||m'_4||m'_4||m'_3||m'_2)$ and $m_1 = m'_1$. You don't actually need to know what $m_1$ is to know you have a collision. Part of the reason I asked this question was that I was looking for a better formal definition of non-iterative because I am not satisfied by the definition I currently have. Apr 10 comment Non-iterative cryptographic hash functions @otus yesterday If $h$ is an iterative hash and $|m|$ is significantly longer than the message block size then you can compress most of the messaged into $f(m||r(m)\mid_b)$ and compress the remainder in a second call to $f$. One test if something is an iterative hash is: 'can I cause a collision prior to reading the entire message?' Apr 9 comment Non-iterative cryptographic hash functions I did some of the differential resistance work on MD6 so I'm a big fan of the design. Its a nice property of a non-iterative hash functions that you can tree hash them into an iterative design if you want to. Apr 3 comment Non-iterative cryptographic hash functions @pg1989 Sponge-based hash functions like Keccak are considered iterative since the potential message space is much larger than the intermediate state (the sponge). One could imagine a construction in which the intermediate state grew in space to ensure no message entropy was lost, but it wouldn't be a sponge construction. Apr 3 comment Non-iterative cryptographic hash functions @pg1989 Added a more precise definition. Jan 2 comment Why programming languages don't provide simple encryption methods? You have a source for the statement that "it turns out that the AES has a back door that the NSA has access to"? Sep 30 comment Could one construct a cipher that is secure for friendly parties to use but insecure for hostile parties? @user4982 The Soviets did the same thing with GOST (different s-boxes to different people, some believed to be backdoored). 4C Entity thinks like the USSR? Feb 20 comment Why programming languages don't provide simple encryption methods? I am asking for serious failures in security that results in physical or financial damage. Such examples would make the case for simple easy to use packaged encryption in much the same way that firms which did not salt their passwords and had massive password exposures helped the security community "raise the bar" on password hashing standards. Oct 23 comment Because the algorithm is known, it is no longer a trade secret The NSA has several secret ciphers, called SUITE A (BATON being one of the most well known). SUITE A ciphers (not publicly revealed) are considered the most secure by the NSA (although a few type 1 ciphers are public). That is not to say the ciphers have not be subject to review, many many cryptographers work for the NSA and have attempted to break these ciphers. That being said, I'd still prefer AES256 to BATON if my life depended on it. en.wikipedia.org/wiki/BATON archives.neohapsis.com/archives/crypto/2000-q4/0028.html en.wikipedia.org/wiki/NSA_Suite_A_Cryptography Oct 12 comment Could the Enigma algorithm be classified as a Feistel network? @bob - Yep you are correct. I had always heard that the reflector was unique to enigma (since the germans patented it) and assumed the plugboard while necessary to security was a rather common feature on rotor machines at that time. Researching this further I realize I was wrong, reflectors were quite common (for example the M-325 had a reflector) but I can find no mention of plug boards prior to the enigma (although that doesn't mean there were none). quadibloc.com/crypto/ro020404.htm Oct 2 comment Could the Enigma algorithm be classified as a Feistel network? Also FYI The trick that made enigma so powerful was not the rotators changing position (since that was common of rotor machines of that time period hence the term rotor), it was the reflector that reflected the character back through the rotors. see en.wikipedia.org/wiki/Enigma_machine#Reflector The reflector also introduced a weakness into enigma. Namely that a character could never be encoded by itself. Jul 24 comment Is there a way to break this encryption? Using the hash of the file as a public IV is extremely dangerous since it allows an attacker to try plaintexts and detect if they match. XCE would need to add randomness to plaintext to avoid this, but why not just use a random IV instead. Jul 24 comment Is there a way to break this encryption? @xce Under option 2 there is no way to decrypt the file since the decrypter doesn't have access to a hash of the file it can't generate the same random sequence and decrypt the file. Jul 24 comment Designing a key expander out of ciphers Edited post to add I just found a weakness in this. Jul 3 comment Are there any simple and yet secure encryption algorithms? Probably the only "a priori secure" function we have is a OTP. May 22 comment Order of cascaded ciphers Thanks, somehow I missed that. Feb 10 comment Why do we need asymmetric algorithms for key exchange? In light of recent break-ins at root-level Certificate Authorities an effective argument could be made that Kerberos while less efficient is actually more secure than PKI because: (1). revoking trust is easier in Kerberos and (2). that Kerberos'es "online" requirements increase the complexity of attacks. Consider the case in which someone wishes to intercept a session secured by Kerberos. An impostor kerberos must be set up and it must quickly issue valid tickets for various domains or else cause very visible failures.