Reputation
306
Top tag
Next privilege 500 Rep.
Access review queues
Badges
2 9
Newest
 Enlightened
Impact
~11k people reached

  • 0 posts edited
  • 1 helpful flag
  • 7 votes cast
Mar
15
comment Why is Pearson hash not used as a cryptographic hash?
@johnfound: Yes, clearly (a hash with a length of more than 256 will just repeat after 256 bytes). But within the first 256 bytes of the hash there can be no duplicate. If you know all the input bytes except one for a one-byte Pearson hash, and the output hash value, you can easily reconstruct what the missing byte must have been -- in particular a duplicated byte in your multi-byte hash must be because the variable first input byte was the same for both of them.
Mar
15
comment Why is Pearson hash not used as a cryptographic hash?
@johnfound: If your byte array is actually a permutation, the hash can be run backwards, proving that if there are duplicates bytes in the output they would need to come from duplicates initial bytes -- and "simply increment the first byte of the message for every next byte of hash" implies that the initial bytes won't have duplicates.
Sep
10
comment Is simple XOR with secret key using DHE secure?
Apart from the XOR weaknesses already noted, you should also be aware that "simple Diffie-Hellman" is trivially vulnerable to a man-in-the-middle attack unless you extend it with some way of verifying that you're in fact talking to who you think you're talking to during the key exchange. You need either a shared secret and a MAC or some kind of public-key signing of the $g^x$ values.
Jan
11
awarded  Enlightened
Jan
11
awarded  Nice Answer
Aug
12
awarded  Student
Mar
31
awarded  Critic
Mar
27
awarded  Scholar
Mar
27
accepted Is it secure to choose d in a RSA key pair?
Mar
27
asked Is it secure to choose d in a RSA key pair?
Nov
19
awarded  Yearling
Nov
4
comment CPA Secure Chosen plaintext scheme
Since it's becoming clear that I don't actually have a clue here, could someone write a better answer that the OP could accept instead of this?
Nov
4
comment CPA Secure Chosen plaintext scheme
@PaĆ­lo: There may be subtleties here that I have not grasped, but my idea was that the concept of a PRF (not the actual function) would be symmetric, since a distinguisher for $E_x(y)$ could trivially be adapted to distinguish $E_y(x)$ and vice versa. There's a hidden assumption that the two value spaces are the same.
Nov
4
revised CPA Secure Chosen plaintext scheme
fix language
Nov
4
revised CPA Secure Chosen plaintext scheme
Looks like I was wrong
Nov
4
awarded  Commentator
Nov
4
comment CPA Secure Chosen plaintext scheme
On the other hand, I'm not sure I agree with @DW that any PRP is also a PRF, since a PRP has a few collisions (namely none) to look like a random oracle, and we can discover that fact probabilistically by querying only birthday-bound many values of the PRP. Or is that too strict a demand to make of a PRF?
Nov
4
comment CPA Secure Chosen plaintext scheme
... and then the answer to the OP's question is: No it doesn't make a difference whether you write $E_r(k)$ or $E_k(r)$.
Nov
4
comment CPA Secure Chosen plaintext scheme
Oh, I think I see. I assumed that the OP's formula was meant as part of a test for being IND-CPA, sort of like "your cryptosystem has the IND-CPA property if an attacker cannot effectively tell the difference between it and $(k,m)\mapsto(r\mathop\|E_k(r)\oplus m)$" or something like that. But I see now that it makes more sense to interpret is as "here is a way to construct a cryptosystem with the IND-CPA property". Then it does make sense to speak of PRFs rather than PRPs.
Nov
4
comment CPA Secure Chosen plaintext scheme
@DW: What I'm asking is, is "IND-CPA" a standard name for the particular construction $\mathit{Enc}_k(m) = (r\mathop\| E_k(r) \oplus m) $ the OP referred to? If yes, then I've been talking nonsense all the way. But my assumption was that "IND-CPA" here just means the ordinary concept of "indistinguishability under chosen-plaintext attacks", applicable to many different constructions.