1,231 reputation
722
bio website ethanheilman.tumblr.com
location Cambridge, MA
age 31
visits member for 3 years
seen Apr 18 at 0:02

Sep
23
comment New PRG from old
What about using bar $|$ for concatenation? Is $.$ commonly used?
Sep
22
comment Designing a key expander out of ciphers
@DavidSchwartz - I've posted a complete version of my answer.
Sep
21
comment Designing a key expander out of ciphers
With a slight change you are correct. You can use all the ciphers in series with the key, $k$, xored in at each step so Eve could not construct a cipher that would reduce the entropy of the generated keys $k_{0}' ... k_{n}'$.
Sep
21
comment Designing a key expander out of ciphers
@DavidSchwartz Alice and Bob share a set of ciphers and a key $k$. They wish to generate a set of keys, $k'_0 .. k'_n$, from the key, $k$, such that this set of keys will not allow Eve to learn the key, $k$, without her breaking all the ciphers. Alice and Bob have to both derive the generated keys $k'_0 ...$ from $k$ without communicating (no random values).
Sep
21
comment Designing a key expander out of ciphers
This works for hiding the value of the key, but it doesn't work as a key expander since the keys generated are non-deterministic. If Bob uses your method, Alice won't be able to generate the same keys given the shared key.
Sep
20
comment Designing a key expander out of ciphers
@PaĆ­loEbermann Well played. Question edited to prevent cheating.
Sep
20
comment Why use an Initialization Vector (IV)?
"Because the IV needs to change for every message." Pornin disagrees in his answer: "For instance, with MD5, the IV is fixed and this is not an issue."
Sep
16
comment Analysis of Repeatedly Enciphered Plaintext using Same Algorithm / Key
@D.W. I worked through the math and you are correct about the birthday bound. My apologizes and thanks for catching that.
Sep
12
comment Could one construct a cipher that is secure for friendly parties to use but insecure for hostile parties?
@user11342 +1 but please add more (maybe sum up the various claims made about it). Dual_EC_DRBG does seem rather close to the above scheme in that it has "weak values" and "strong values". I find this really interesting.
Sep
12
comment Could one construct a cipher that is secure for friendly parties to use but insecure for hostile parties?
I agree completely, if history is the judge general mathematical attacks are not the way most military ciphers are broken. Never the less there is a non-zero chance that GCHQ could break AES tomorrow. Do they tell the world? Many friendly governments are not going to be able to switch to new ciphers in time. If they announce a new contest out of the blue they are tipping their hand. Furthermore, there is a valid strategic argument to be made that the benefit of secretly listening on enemy communications out weighs the risk that enemy has discovered the attack as well. What do you do?
Sep
12
comment Could one construct a cipher that is secure for friendly parties to use but insecure for hostile parties?
@D.W. I agree in general with your comment (known attacks are probably a bad place to start) but I've spend some time researching differential backdoors. Consider the case in which the difference that the attack relies on is defined by some logical function constructed such that finding the "difference function" to perform the attack is equivalent to 3SAT. How many of the SHA3 finalists have proofs of differential security? The ones that do are conditional on independence assumptions (one can differentially backdoor a function and still prove resistance).
Sep
12
comment Could one construct a cipher that is secure for friendly parties to use but insecure for hostile parties?
I agree that in all likelihood you are correct, AES is fairly secure and harddrives are so cheap everyone can use OTPs. For the sake of argument lets assume that the NSA, GCHQ or whatever found a devastating attack on all known ciphers (AES, SERPENT, etc). Rather than publish the attack, they slowly move all military systems to the new secure cipher (the USA does employ unpublished/secret ciphers like BATON). The NSA wishes to maintain their ability to listen to communications if the "other side" begins to suspect something and switches to the new secure cipher.
Sep
12
comment Could one construct a cipher that is secure for friendly parties to use but insecure for hostile parties?
The NSA did weaken DES so they could break it and others could not. They did by reducing the key size such that only someone with as much compute resources (likely custom built hardware as well) as the NSA could hope to break DES in a reasonable amount of time.
Sep
7
comment Is this “layered” XOR cipher secure?
@paulo Ebermann - Exactly. What I really want to do is use the key as a seed to a PRNG but no PRNG is available so instead I built a really lame LFSR with really lame tap positions. Something better could be built by running a LFSR on the key with good tap positions but then I'm just reinventing a bad linear-stream cipher.
Sep
1
comment How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?
@D.W. Yes that is what I generally intended, with the idea that we can place attacks on some sort of quantifiable continuum (2^60, etc ...). Feel free to edit the question to clarify it.
Sep
1
comment How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?
@D.W. I meant what sort of lower bounds can we assume in regards to the ease of breaking the cipher, but I agree the wording is confusing, I have edited the question to clarify the issue.
Sep
1
comment How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?
@gokoon - are my edits in line with what you wished to ask with this question?
Aug
11
comment The use of cribs
@mixedmath in your defense, codes and code books are still used by militaries in all parts of the world. Breaking such code books are not particular interesting to academic cryptographers as the methods and techniques have already been researched exhaustively, but intelligence agencies still have to break code books.
Aug
11
comment Is it possible to derive the encryption method from encrypted text?
@Nayuki Minase - The functions themselves may by pseudorandom, but what about the increments, the other bits of information that no one likes to talk about. Can a block cipher running in 'ciphertext stealing' mode produce an odd number of bits, can it operate on the bit level rather than the byte level? What does it do if the input size is less than one block? How does it fail?
Aug
11
comment Is it possible to derive the encryption method from encrypted text?
@Nayuki Minase - Can you distinguish a stream cipher from a block cipher running in 'ciphertext stealing' mode?