Reputation
9,010
Next tag badge:
73/100 score
30/20 answers
Badges
3 13 45
Impact
~138k people reached

4h
revised Parallel authentication of encrypted data. What AE type to choose?
added 9 characters in body
4h
comment Parallel authentication of encrypted data. What AE type to choose?
Being online does not mean that there are no length limitations, it just means that you can perform the encryption/decryption directly - specifically without knowing the length in advance. GCM can be parallelized, but at the cost of performing additional calculations. It may be tricky to find a library that supports that. If the solution space is empty then the obvious solution is to split up the input and verify the blocks separately (with an additional authentication tag over the first authentication tag, like a hash tree).
5h
comment Is there any practical attack to create a printable chosen prefix MD5 collision?
I'm not sure if it fits your needs, but you could use any byte code after a 00 character. Many editors and such don't display anything after the 00 "end of file/input" control character.
16h
comment Is standardizing a modified AES a good idea?
Note: it seems like this replaces the previous GOST algorithm, which is an 64 bit block cipher with 256 bit key from Russia. After reading the text it seems to me that the cipher was chosen by competition is mainly AES with some of its deficiencies fixed. The question is if the Ukraine has a large enough crypto community to verify correct operation, because I would say that the crypto community of the world hasn't looked at it.
1d
comment Is standardizing a modified AES a good idea?
I had some success doing exactly that on the security site. I just asked the author to respond. I think he was grateful to be notified. With a bit of luck we even get people to join this site :)
1d
comment Is standardizing a modified AES a good idea?
They are all about Kalyna it seems so I'm OK with the fact that there are sub-questions. On the other hand, "the most likely design rationale" is a kind of asking to be guessing. Do you have any other resources that we could read? There is only a short description of the cipher, bar the test vectors.
1d
revised Is standardizing a modified AES a good idea?
added 1 character in body
1d
comment Pseudo Random Function
Not really - usually the output is a hash over the next state, or the output is securely mixed into the state.
1d
comment I hashed my bag and in it I put… “Is there a hash for unordered items?”
Note that it is often possible to define some ordering of the elements in a set / bag. Even if there is no explicit ordering, it could be possible to create an implict ordering, e.g. using the hash value itself as number and order the hashes accordingly.
1d
comment nonce of AES-GCM in SSL
@SEJPM Thanks for the update, but isn't that what's already in the answer (first to last paragraph)?
1d
answered Pseudo Random Function
1d
comment How often does RSA-OAEP have a leading zero?
Important note: it can also have more than 1 leading zero (2 bytes more than 1/65536 of the time, of course etc. etc.). The chance that there are more than 8 leading zero's is negligable ($2^{64}$), 16 leading zeros is next to impossible given that the encryption routine is correct. I can still remember the phrase: "OK, we've fixed the leading byte problem" pretty well - that's not enough.
1d
comment Suggestion : CRC vs SHA1
A CRC is enough to protect against random changes. What you seem to be protecting against is a system where a lot of data may be changed in one go, without an attacker being able to chose the input of the checksum. In that case a large CRC could be possible. Assuming that the CRC32 is randomly distributed you would get a change of 1 in $2^{32}$ (or 1 in 4 bilion) that the CRC verifies for incorrect input.
1d
answered Suggestion : CRC vs SHA1
2d
comment What is SRP-Z form?
From the terms I understand that this is mutual authentication while SRP itself is client only authentication. If you mix in a server secret in the session key derivation then the above description may make sense. Did you search the patent database for SRP?
Jun
30
comment Collision attacks on digital signatures
I think the text in the question shows a clear underestimation about how easy it is to include a "jumbled mess" inside a file. I created a shell script that simply put the jumbled mess behind the executable code. Same MD5, script performed two entirely different things.
Jun
30
comment Source for PKCS#11 Header Files
Don't see them either. If in doubt, kindly ask the authors.
Jun
30
comment Ring signatures in ECC
@geoff_h That didn't work but you can always create your own answer. You won't get any points accepting it, but if you respond to this comment then I would be happy to upvote (if it is good, of course). A belated welcome to crypto, these are exactly the questions we are waiting for.
Jun
29
revised Do all attacks against PKCS1 v1.5 encryption require an oracle
oops.. 8 bytes not zero is slightly less than 64 bits not 128 bits
Jun
29
awarded  Good Question