926 reputation
48
bio website LeastAuthority.com
location
age
visits member for 3 years
seen May 2 at 3:32

Jul
26
awarded  Nice Answer
Jul
13
awarded  Yearling
May
2
awarded  Commentator
May
2
comment Can I jettison MAC if I already have SHA1(M)?
However, I should add that the short answer is likely to be right, in that the scheme and its implementation are likely to expose the sort of vulnerability that D.W. described. Likewise, the advice to use authenticated encryption might be perfect, depending on the needs of the user. So these answers are not wrong, but they overstate the case when they say that the proposal is definitely not secure. It might be.
May
2
comment Can I jettison MAC if I already have SHA1(M)?
I disagree with the advice in the summary because the proposed alternative — to use a message authentication code or authenticated encryption — has weaker security properties than the original proposal to use the secure hash of the plaintext has. Whether those reduced security properties would entail actual risk to the users can't be determined without more information about the way this protocol is used.
May
2
comment Can I jettison MAC if I already have SHA1(M)?
I disagree with this short answer and also with the advice in this "Summary". I disagree with the short answer because it assumes that the padding scheme used is amenable to that sort of chosen-plaintext attack. In fact there are padding schemes that, when combined with implementations free of timing and error-handling side channels, prevent all such attacks. (I.e. padding schemes in which there is a bijection from message to padded-message, and therefore there is no ciphertext block other than the original ciphertext block which will result in a plaintext that matches the hash. …
Jul
13
awarded  Yearling
Feb
5
awarded  Nice Answer
Jul
13
awarded  Yearling
Oct
3
answered At the current time, is SHA256 the de facto standard for strong cryptographic hashes?
Oct
1
answered Hashing or encrypting twice to increase security?
Oct
1
comment Is Convergent Encryption really secure?
The second attack, which we call "learn the remaining information", is not so obvious, and as far as I know nobody was aware of this attack until 2008 when Drew Perttula and Brian Warner developed it as an attack against the Tahoe-LAFS secure filesystem. In the "learn the remaining information" attack, the attacker can make guesses about a few secret, random, unknown parts of a larger file and then find out if one of their guesses is correct. Please see the write-up at: tahoe-lafs.org/hacktahoelafs/drew_perttula.html
Oct
1
comment Is Convergent Encryption really secure?
There are two possible attacks. The first one, which we call the "confirmation of a file attack" is the obvious problem that deduplication exposes the fact that the two things were the same as each other. This issue was immediately appreciated and discussed when convergent encryption was first proposed (not under that name) on the cypherpunks mailing list in 1996. (Before Microsoft applied for a patent on convergent encryption, so the cypherpunks discussion is prior art that invalidates the Microsoft patent.)
Oct
1
comment Is Convergent Encryption really secure?
I was asked over on the security stack exchange (security.stackexchange.com/questions/7142/… ) to explain more about this.
Sep
28
awarded  Nice Answer
Sep
23
answered Is Convergent Encryption really secure?
Sep
6
comment How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?
Don't focus too much on specific organizations, such as the American National Security Agency (NSA). Maybe you think NSA are The Good Guys and will not do anything bad (even if they have such an ability) or you at least think they are on your side and will not do anything bad to you. But do we have any reason to believe that the Chinese or Russian classified cryptography research are less advanced than the American or British? Also some users (e.g. Europeans) may not feel okay about the possibility of NSA having such power over their communications.
Sep
1
comment How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?
Yes, this is a good question. Everyone should have this question. The fact that nobody has a good answer is an important fact and it is good to publish the question on this site. A lot of the most important questions around don't really have solid answers. Uncertainty and ignorance are what we have to face up to and decide how to manage.
Sep
1
comment What is the post-quantum cryptography alternative to Diffie-Hellman?
Not for the key agreement that you asked for, but for digital signatures, please see my answer to a previous related question.
Aug
17
answered Are these emerging threats against AES affecting your designs?