Reputation
4,107
Next tag badge:
98/100 score
16/20 answers
Badges
1 9 30
Newest
 Pundit
Impact
~88k people reached

Aug
1
comment What exactly is the base for the KECCAK (SHA3) claim that a security strength of 256 bits is “post-quantum sufficient”?
I guess they meant "post-quantum sufficient with our immediate understanding of quantum technology", which, when you think of it, is pretty reasonable, contrasted with how classical algorithms are deemed "secure" when they really are "secure against current known cryptanalytic techniques". But it's hard not to speculate when it comes to quantum cryptography - nobody knows for sure, and nobody is using quantum crypto anyway, so it looks good to add that to the list. I suppose that was the rationale, anyway.
Jul
30
comment Algorithm/Technique for Steganography
There's also a lot more to steganography, including: it needs to be resistant to statistical analysis on the carrier (your alpha value scheme would instantly fail here), and it needs to be resistant to transformations, meaning the payload should be able to be preserved to some extent if the image ends up compressed, resized, or otherwise altered on a reasonable scale (probably via redundancy). But it depends how much secrecy you really need. Ultimately, given enough samples and a specific carrier distribution, any steganographic scheme can be detected, you want to make it very hard to do so.
Jul
30
reviewed Approve Abstracting primitives and modes of operation
Jul
28
comment Security of RSA-substitution-RSA
@NoOne That said I don't know why people are voting to close as a duplicate, since it's quite clearly not one - this question is about encrypting with two different public keys, with a middle step, the duplicate simply encrypts twice with the same key.
Jul
28
comment Security of RSA-substitution-RSA
@NoOne The problem here isn't academia being close-minded, it's simply exposure. Known, "mainstream" algorithms have been evaluated by hundreds of cryptographers, and none have found a (significant) flaw. Sure, it's possible some random dude out there has, and is decrypting your stuff as I write this message. But this gives us confidence that the algorithm is a good one. Your scheme hasn't, is at least twice as slow as the original version, and requires twice as large public keys. You might not care, but somebody will, however nobody will care about an algorithm only one person uses.
Jul
28
comment Security of RSA-substitution-RSA
@NoOne I think what owlstead is getting at is that in cryptography (and most sciences) it is customary to develop an idea and clearly show that your new method is better than what already exists in some way, or has some interesting properties, and request feedback. This is not the same as jotting down a formula and two justificatory paragraphs and then sitting back saying "prove me wrong".
Jul
27
reviewed Reject integrity tag wiki
Jul
27
reviewed Approve terminology tag wiki excerpt
Jul
23
comment Toy encryption system that provides “hints”
One thing that comes to mind is the Vigenere cipher. If you get a few of the key characters right, some of the plaintext characters are revealed. Eventually you can work out the rest of the key by taking guesses at possible plaintext words (though a more powerful and general solution exists). That said the "key distance" isn't like the one in your example (e.g. you'd have keys "CRYPTO" and "CRYPTA" instead of 1234 and 1288) but their Hamming distance should do fine as a metric.
Jul
22
comment How is input message for SHA-2 padded?
Perhaps you should mention where the $448$ and $896$ values come from (it's to have enough space to fit the message length on 32/64 bits at the end of the padding block)
Jul
22
comment SIMON implementation, decryption issues
I haven't read the spec in detail but one thing that often gets people with this type of algorithm is, for instance, in your line y = f(x, N), not realising that x is no longer the original one as it was modified above. This looks like a good candidate, so have you checked that?
Jul
22
comment AES: keylength and password length?
@user129789 If your password was provided by a user, it won't be uniformly distributed, which may open the door to related key attacks. Always feed it into the proper type of key derivation function.
Jul
20
comment How difficult is it to find the “pre-image” of a block cipher?
Pick any key $k_2$ and decrypt $C_1$ to obtain $M_2$.
Jul
20
comment Parallel-resistant proof-of-work scheme?
@rath What about the RSA timelock proof of work protocol? It is also chained, believed as hard to cheat as integer factorization, and allows the verifier to check the result very efficiently, so that could work for you, perhaps.
Jul
18
comment estimating entropy/randomness as fail-safe mechanism
I can see this working somewhat as a one-off implementation test bench, but it just doesn't seem doable to do those verifications constantly with any degree of accuracy. The old quote rings true: "that's the problem with randomness - you can never be sure".
Jul
18
comment estimating entropy/randomness as fail-safe mechanism
@JohnDeters I think he means e.g. check that something has gone wrong with the entropy supply algorithmically, in the same way that TRNG's need to do some tests on their output periodically to verify they haven't failed. It's an interesting question but it seems unlikely such an estimator exists, unless you are willing to run statistical tests on terabytes of data to detect a potential flaw. The problem is there just isn't enough data to assert that "this IV is not random, abort the mission", you need a lot more samples to conclude anything about what you are seeing.
Jul
17
reviewed Approve How to prove a cipher resistant to differential cryptanalysis?
Jul
16
comment Generating a secure random number in javascript
Over-engineered. Collect all mouse samples over some time $t$ (massively overestimate the time needed - better too much than not enough) instructing the user to furiously move the mouse around (do not record samples which occur more than twice in a row, it means he isn't moving his mouse), and feed it all into a hash function to distill 256 or 512 bits of entropy. Stretch as needed. That said you might look into existing frameworks to generate cryptographic numbers in Javascript - some already exist, and creating your own algorithm is generally not the answer.
Jul
16
comment Primality testing (deterministic vs. non-deterministic)
@CodesInChaos This argument in general is true if and only if an attacker cannot control the inputs to the algorithm (e.g. in an attempt to make it fail), fortunately most modern primality tests (including Rabin-Miller) are immune to this to an arbitrary number of rounds.
Jul
15
comment Primality testing (deterministic vs. non-deterministic)
Because asymptotic complexity isn't the whole story.