3,993 reputation
1830
bio website
location Wellington, New Zealand
age
visits member for 3 years
seen 7 hours ago

I am an undergraduate computer science and mathematics student in New Zealand. My fields of interest are computer graphics, in particular the physics of light transport, and to some extent cryptography, as well as programming and software development in general.


Jul
14
comment What operations are used in symmetric cryptography and why?
@SmitJohnth Addition with overflow isn't an involution. $\left ( x + x \right ) \mod{n} \ne 0$ in general.
Jul
14
comment What operations are used in symmetric cryptography and why?
Also, XOR being an involution makes it very convenient to use in some schemes, for instance in embedded situations it means you don't need to waste space implementing a decryption routine - decryption is exactly (or almost exactly) the same as encryption. Not that relevant today but some elements of DES were in fact designed with this in mind (also, stream ciphers)
Jul
13
comment What is the purpose of update() in popular hash APIs?
It also makes the hash implementation run in constant memory, which I think is actually the real reason it's done this way - you can convert a constant-memory scheme into a more convenient but less flexible "all at once" scheme, via a wrapper implementation, but doing the opposite is harder. So it's a "lowest common denominator" kind of deal.
Jul
13
comment IV and Headers inside cipher text
You are correct that it is theoretically redundant, but sometimes you need to know if the key is the right one before proceeding to decrypt and authenticate perhaps gigabytes of data, possibly overwriting the existing ciphertext in the process.
Jul
13
comment IV and Headers inside cipher text
@hunter It lets you verify you have the correct key before attempting to process a (potentially large) ciphertext message. There is also a MAC or an AEAD tag, of course, but it cannot be verified until the whole file has been acknowledged. This makes no sense in an interactive protocol, but for encryption at rest it is perfectly standard practice (though typically in those situations the key is derived from a password, so you also need a KDF + salt).
Jul
12
comment IV and Headers inside cipher text
@hunter I am confident he means the hash of a (cryptographically secure) key, which can be securely disclosed, though it could be clarified.
Jul
12
revised Review of AES encryption concept for an open source project
edited title for clarity (who read operating system?)
Jul
12
comment CBC with random prefix but no IV - secure?
Well it is mostly random to start with, but, yes, as the key is secret, once the first plaintext block has gone through the block cipher it becomes effectively random to an attacker, and as long as your first plaintext block is unique (which it is thanks to your counter) the "effective IV" will never be repeated, indeed satisfying all of CBC's IV requirements.
Jul
9
comment Selecting bijective functions for permutations
@Polynomial They are - look at Threefish for instance, an ARX cipher with simple permutations and no s-boxes. Even if those operations are simple, repeating them a sufficient number of times leads to high confusion and diffusion. And after all, modular exponentiation is a series of multiplications, which themselves are series of additions... of course this is an oversimplification, it takes a lot of work to make sure the way you're combining the operations leads to such behaviour.
Jul
9
comment Is FIPS 140-2's “Continuous random number generator test” practical?
Yes, one could argue that a PRNG with a 16-bit internal state is a design failure, but since output block size need not be the same as internal state size, the requirement is still questionable as it basically cuts out PRNG's having an output block size less than 64 bits (in practice this is not a problem, but the requirement still feels like it's missing the point).
Jul
8
awarded  Quorum
Jul
8
comment Difference between actual attacks and theoretical attacks on SHA cryptographic series
You've pretty much got it right. Theoretical means it probably works (if the researchers got the math right) but it's too expensive to attempt yet.
Jul
8
comment Why is it said that if we know few bits of pseudo random sequence we can predict the whole of it?
That is not true out of context. Do you have the complete citation which says that?
Jul
8
comment Snowden Challenge II: Can we solve Snowden challenge quantumly?
@rath and everyone else - I have created a meta thread for this question, feel free to voice your opinions in there: meta.crypto.stackexchange.com/questions/286/…
Jul
6
reviewed Reject Cryptographic Challenge: How to Say Something Confidentially to Snowden?
Jul
6
comment Securely generating passwords based on a secret and a public identifier
@GeorgeBashi I would say that is okay. HMAC is guaranteed not to leak any information about the input, so it should be safe to feed it into HMAC while still using the keypair as usual. This is assuming the private key has enough entropy e.g. is long enough to avoid being brute-forced, which is hopefully the case here. I'm not sure I understand what you mean by "certificates" though.
Jul
4
reviewed Approve constructing QR-like one way function
Jul
4
comment Encryption schemes and pseudorandom permutations
The IV is conventionally part of the output but not of the input (which is why it's called a randomized encryption scheme - randomization is a property of the primitive, else it would still be deterministic). Anyway, I think I understand better, you want to ask to what extent a PRP can be modelled as PRF, since their security properties overlap, right?. One will necessarily need to instantiate those with at least some concrete security parameters such as input/output length. For instance, you are correct that a 128-bit PRP cannot be distinguished from a PRF, but a 64-bit PRP certainly can.
Jul
4
comment Encryption schemes and pseudorandom permutations
Did you mean a pseudorandom permutation? A pseudorandom function isn't very useful for encryption since it isn't invertible (so it's not possible to decrypt). Also, consider that an encryption scheme returning an output exactly as long as its input must necessarily be deterministic.. what does that imply about some of its security properties?
Jul
4
answered Securely generating passwords based on a secret and a public identifier