876 reputation
36
bio website zooko.com
location
age
visits member for 2 years, 9 months
seen Apr 4 at 4:57

Jul
13
awarded  Yearling
Feb
5
awarded  Nice Answer
Jul
13
awarded  Yearling
Oct
3
answered At the current time, is SHA256 the de facto standard for strong cryptographic hashes?
Oct
1
answered Hashing or encrypting twice to increase security?
Oct
1
comment Is Convergent Encryption really secure?
The second attack, which we call "learn the remaining information", is not so obvious, and as far as I know nobody was aware of this attack until 2008 when Drew Perttula and Brian Warner developed it as an attack against the Tahoe-LAFS secure filesystem. In the "learn the remaining information" attack, the attacker can make guesses about a few secret, random, unknown parts of a larger file and then find out if one of their guesses is correct. Please see the write-up at: tahoe-lafs.org/hacktahoelafs/drew_perttula.html
Oct
1
comment Is Convergent Encryption really secure?
There are two possible attacks. The first one, which we call the "confirmation of a file attack" is the obvious problem that deduplication exposes the fact that the two things were the same as each other. This issue was immediately appreciated and discussed when convergent encryption was first proposed (not under that name) on the cypherpunks mailing list in 1996. (Before Microsoft applied for a patent on convergent encryption, so the cypherpunks discussion is prior art that invalidates the Microsoft patent.)
Oct
1
comment Is Convergent Encryption really secure?
I was asked over on the security stack exchange (security.stackexchange.com/questions/7142/… ) to explain more about this.
Sep
28
awarded  Nice Answer
Sep
23
answered Is Convergent Encryption really secure?
Sep
6
comment How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?
Don't focus too much on specific organizations, such as the American National Security Agency (NSA). Maybe you think NSA are The Good Guys and will not do anything bad (even if they have such an ability) or you at least think they are on your side and will not do anything bad to you. But do we have any reason to believe that the Chinese or Russian classified cryptography research are less advanced than the American or British? Also some users (e.g. Europeans) may not feel okay about the possibility of NSA having such power over their communications.
Sep
1
comment How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?
Yes, this is a good question. Everyone should have this question. The fact that nobody has a good answer is an important fact and it is good to publish the question on this site. A lot of the most important questions around don't really have solid answers. Uncertainty and ignorance are what we have to face up to and decide how to manage.
Sep
1
answered What is the post-quantum cryptography alternative to Diffie-Hellman?
Aug
17
answered Are these emerging threats against AES affecting your designs?
Aug
6
answered UMAC: to what extent is it in use today?
Aug
4
answered Guarding against cryptanalytic breakthroughs: combining multiple hash functions
Aug
3
answered Reduction from signatures to encryption?
Aug
2
awarded  Beta
Jul
17
revised Is key size the only barrier to the adoption of the McEliece cryptosystem, or is it considered broken/potentially vulnerable?
added 247 characters in body
Jul
17
answered Is key size the only barrier to the adoption of the McEliece cryptosystem, or is it considered broken/potentially vulnerable?