Ethan Heilman
Reputation
1,390
Top tag
Next privilege 2,000 Rep.
 Sep 27 comment How can I prevent a message replay with RSA? Why would including the expiration time in the message be insecure? Sep 27 comment Is Diffie-Hellman mathematically the same as RSA? I think I might be wrong, but I thought I've heard the claim that breaking discrete log breaks/threatens RSA as well. Maybe this should be a question. Sep 26 comment What is the best method to determine the language used in a monoalphabetic substitution cipher? @128 - absence of whitespace is typical, most classical ciphers assume you remove whitespace. Solving classical ciphers can get a bit tricky, if you are really interested I'd recommend: 'Cryptanalysis: a study of ciphers and their solution' ( books.google.com/books/about/Cryptanalysis.html?id=fKNB-7y_Hs4C ). Also 'The American Black Chamber' (amazon.com/American-Black-Chamber-Cryptographic/dp/0894121545) has a bit of advice, examples on solving classical ciphers. Sep 26 comment What is the best method to determine the language used in a monoalphabetic substitution cipher? Certainly you can use a monogram frequency chart to guess the language. Another idea would be to use a common word such as in german 'ein' and look for three letters that have the same distance from each other (assuming it is a shift cipher). Where did you get a ciphertext in which you know so little about it, yet you know that it is monoalphabetic? Sep 24 comment Is there a simple hash function that one can compute without a computer? @FUZxxl - I think it might be safe enough for class. Not sure how safe it is generally. It would make an interesting crypto question. Sep 24 comment Is there a simple hash function that one can compute without a computer? Yes, RO schemes typically require a trusted third party to keep the table of inputs and outputs and to generate new outputs. Sep 24 comment Is there a simple hash function that one can compute without a computer? What about a function, $f$, that given a number $n$, indexes e with $n \times 4$ and returns the next 4 digits of e. $$f(n) = e[n*4],e[n*4+1],e[n*4+2],e[n*4+3]$$ So $f(0)$ would return $2718$, f(1) would return $2818$ and so on. Or use a normal number instead of e ( en.wikipedia.org/wiki/Normal_number) is you want to be more formal. Sep 23 comment New PRG from old What about using bar $|$ for concatenation? Is $.$ commonly used? Sep 22 comment Designing a key expander out of ciphers @DavidSchwartz - I've posted a complete version of my answer. Sep 21 comment Designing a key expander out of ciphers With a slight change you are correct. You can use all the ciphers in series with the key, $k$, xored in at each step so Eve could not construct a cipher that would reduce the entropy of the generated keys $k_{0}' ... k_{n}'$. Sep 21 comment Designing a key expander out of ciphers @DavidSchwartz Alice and Bob share a set of ciphers and a key $k$. They wish to generate a set of keys, $k'_0 .. k'_n$, from the key, $k$, such that this set of keys will not allow Eve to learn the key, $k$, without her breaking all the ciphers. Alice and Bob have to both derive the generated keys $k'_0 ...$ from $k$ without communicating (no random values). Sep 21 comment Designing a key expander out of ciphers This works for hiding the value of the key, but it doesn't work as a key expander since the keys generated are non-deterministic. If Bob uses your method, Alice won't be able to generate the same keys given the shared key. Sep 20 comment Designing a key expander out of ciphers @PaĆ­loEbermann Well played. Question edited to prevent cheating. Sep 20 comment Why use an Initialization Vector (IV)? "Because the IV needs to change for every message." Pornin disagrees in his answer: "For instance, with MD5, the IV is fixed and this is not an issue." Sep 16 comment Analysis of Repeatedly Enciphered Plaintext using Same Algorithm / Key @D.W. I worked through the math and you are correct about the birthday bound. My apologizes and thanks for catching that. Sep 12 comment Could one construct a cipher that is secure for friendly parties to use but insecure for hostile parties? @user11342 +1 but please add more (maybe sum up the various claims made about it). Dual_EC_DRBG does seem rather close to the above scheme in that it has "weak values" and "strong values". I find this really interesting. Sep 12 comment Could one construct a cipher that is secure for friendly parties to use but insecure for hostile parties? I agree completely, if history is the judge general mathematical attacks are not the way most military ciphers are broken. Never the less there is a non-zero chance that GCHQ could break AES tomorrow. Do they tell the world? Many friendly governments are not going to be able to switch to new ciphers in time. If they announce a new contest out of the blue they are tipping their hand. Furthermore, there is a valid strategic argument to be made that the benefit of secretly listening on enemy communications out weighs the risk that enemy has discovered the attack as well. What do you do? Sep 12 comment Could one construct a cipher that is secure for friendly parties to use but insecure for hostile parties? @D.W. I agree in general with your comment (known attacks are probably a bad place to start) but I've spend some time researching differential backdoors. Consider the case in which the difference that the attack relies on is defined by some logical function constructed such that finding the "difference function" to perform the attack is equivalent to 3SAT. How many of the SHA3 finalists have proofs of differential security? The ones that do are conditional on independence assumptions (one can differentially backdoor a function and still prove resistance). Sep 12 comment Could one construct a cipher that is secure for friendly parties to use but insecure for hostile parties? I agree that in all likelihood you are correct, AES is fairly secure and harddrives are so cheap everyone can use OTPs. For the sake of argument lets assume that the NSA, GCHQ or whatever found a devastating attack on all known ciphers (AES, SERPENT, etc). Rather than publish the attack, they slowly move all military systems to the new secure cipher (the USA does employ unpublished/secret ciphers like BATON). The NSA wishes to maintain their ability to listen to communications if the "other side" begins to suspect something and switches to the new secure cipher. Sep 12 comment Could one construct a cipher that is secure for friendly parties to use but insecure for hostile parties? The NSA did weaken DES so they could break it and others could not. They did by reducing the key size such that only someone with as much compute resources (likely custom built hardware as well) as the NSA could hope to break DES in a reasonable amount of time.