Ethan Heilman
Reputation
1,316
Top tag
Next privilege 1,500 Rep.
Approve tag wiki edits
 Sep22 comment Designing a key expander out of ciphers @DavidSchwartz - I've posted a complete version of my answer. Sep21 comment Designing a key expander out of ciphers With a slight change you are correct. You can use all the ciphers in series with the key, $k$, xored in at each step so Eve could not construct a cipher that would reduce the entropy of the generated keys $k_{0}' ... k_{n}'$. Sep21 comment Designing a key expander out of ciphers @DavidSchwartz Alice and Bob share a set of ciphers and a key $k$. They wish to generate a set of keys, $k'_0 .. k'_n$, from the key, $k$, such that this set of keys will not allow Eve to learn the key, $k$, without her breaking all the ciphers. Alice and Bob have to both derive the generated keys $k'_0 ...$ from $k$ without communicating (no random values). Sep21 comment Designing a key expander out of ciphers This works for hiding the value of the key, but it doesn't work as a key expander since the keys generated are non-deterministic. If Bob uses your method, Alice won't be able to generate the same keys given the shared key. Sep20 comment Designing a key expander out of ciphers @PaĆ­loEbermann Well played. Question edited to prevent cheating. Sep20 comment Why use an Initialization Vector (IV)? "Because the IV needs to change for every message." Pornin disagrees in his answer: "For instance, with MD5, the IV is fixed and this is not an issue." Sep16 comment Analysis of Repeatedly Enciphered Plaintext using Same Algorithm / Key @D.W. I worked through the math and you are correct about the birthday bound. My apologizes and thanks for catching that. Sep12 comment Could one construct a cipher that is secure for friendly parties to use but insecure for hostile parties? @user11342 +1 but please add more (maybe sum up the various claims made about it). Dual_EC_DRBG does seem rather close to the above scheme in that it has "weak values" and "strong values". I find this really interesting. Sep12 comment Could one construct a cipher that is secure for friendly parties to use but insecure for hostile parties? I agree completely, if history is the judge general mathematical attacks are not the way most military ciphers are broken. Never the less there is a non-zero chance that GCHQ could break AES tomorrow. Do they tell the world? Many friendly governments are not going to be able to switch to new ciphers in time. If they announce a new contest out of the blue they are tipping their hand. Furthermore, there is a valid strategic argument to be made that the benefit of secretly listening on enemy communications out weighs the risk that enemy has discovered the attack as well. What do you do? Sep12 comment Could one construct a cipher that is secure for friendly parties to use but insecure for hostile parties? @D.W. I agree in general with your comment (known attacks are probably a bad place to start) but I've spend some time researching differential backdoors. Consider the case in which the difference that the attack relies on is defined by some logical function constructed such that finding the "difference function" to perform the attack is equivalent to 3SAT. How many of the SHA3 finalists have proofs of differential security? The ones that do are conditional on independence assumptions (one can differentially backdoor a function and still prove resistance). Sep12 comment Could one construct a cipher that is secure for friendly parties to use but insecure for hostile parties? I agree that in all likelihood you are correct, AES is fairly secure and harddrives are so cheap everyone can use OTPs. For the sake of argument lets assume that the NSA, GCHQ or whatever found a devastating attack on all known ciphers (AES, SERPENT, etc). Rather than publish the attack, they slowly move all military systems to the new secure cipher (the USA does employ unpublished/secret ciphers like BATON). The NSA wishes to maintain their ability to listen to communications if the "other side" begins to suspect something and switches to the new secure cipher. Sep12 comment Could one construct a cipher that is secure for friendly parties to use but insecure for hostile parties? The NSA did weaken DES so they could break it and others could not. They did by reducing the key size such that only someone with as much compute resources (likely custom built hardware as well) as the NSA could hope to break DES in a reasonable amount of time. Sep7 comment Is this “layered” XOR cipher secure? @paulo Ebermann - Exactly. What I really want to do is use the key as a seed to a PRNG but no PRNG is available so instead I built a really lame LFSR with really lame tap positions. Something better could be built by running a LFSR on the key with good tap positions but then I'm just reinventing a bad linear-stream cipher. Sep1 comment How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ? @D.W. Yes that is what I generally intended, with the idea that we can place attacks on some sort of quantifiable continuum (2^60, etc ...). Feel free to edit the question to clarify it. Sep1 comment How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ? @D.W. I meant what sort of lower bounds can we assume in regards to the ease of breaking the cipher, but I agree the wording is confusing, I have edited the question to clarify the issue. Sep1 comment How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ? @gokoon - are my edits in line with what you wished to ask with this question? Aug11 comment The use of cribs @mixedmath in your defense, codes and code books are still used by militaries in all parts of the world. Breaking such code books are not particular interesting to academic cryptographers as the methods and techniques have already been researched exhaustively, but intelligence agencies still have to break code books. Aug11 comment Is it possible to derive the encryption method from encrypted text? @Nayuki Minase - The functions themselves may by pseudorandom, but what about the increments, the other bits of information that no one likes to talk about. Can a block cipher running in 'ciphertext stealing' mode produce an odd number of bits, can it operate on the bit level rather than the byte level? What does it do if the input size is less than one block? How does it fail? Aug11 comment Is it possible to derive the encryption method from encrypted text? @Nayuki Minase - Can you distinguish a stream cipher from a block cipher running in 'ciphertext stealing' mode? Aug5 comment What is the general justification for the hardness of finding preimages for cryptographic hash functions? +1 Interesting. Are there any research papers that you would recommend that use proof of resistance to 3SAT to argue the strength of various hash functions/ciphers?