Reputation
Next tag badge:
98/100 score
16/20 answers
Badges
1 9 30
Newest
 Pundit
Impact
~93k people reached

Feb
24
comment Is the following key stretching algorithm as memory hard as I think it is?
@mingleplough You don't need an excessively large number of iterations to make it memory-hard (otherwise it would be too slow in practice, 200k iterations is already pushing it). And initializing the array does help - in the example you gave, the attacker can clearly choose to not spend much memory and only save some of the cells in the array, but he'll have to spend much more time repeatedly computing the missing cells that way, which balances out. And just iterating a hash wasn't my idea of initialization, think something where a cell depends on all previous cells.
Feb
23
answered Is the following key stretching algorithm as memory hard as I think it is?
Feb
21
comment Computational indistinguishability and example of non polynomial algorithm
Another example is this: distinguish between a stream of output from Blowfish-CTR and AES-CTR (or generally two block ciphers with different block sizes in CTR mode). An algorithm can distinguish them without even touching the keys, using the birthday paradox, with complexity $\approx 2^{32}$, which is not polynomial-time (is exponential) but far better than brute-force.
Feb
21
comment Computational indistinguishability and example of non polynomial algorithm
Brute force on the input of algorithm $A$? But otherwise I suspect the algorithm would be highly dependent on the underlying cryptographic primitive, the simplest example is RSA where integer factorization is subexponential (but not polynomial) but this isn't a great example, being public-key and all.
Feb
21
comment Why do we assume un-security of communication channel on every cryptography system
I suppose because you need cryptography to make those channels secure. And you can't just create a mega-channel and say "this is secure, use this for encrypted communication", because a "secure channel" requires authentication of both parties, which is inherently an individual process.
Feb
20
comment Implementing PKCS#7 Padding on a Stream of Unknown Length?
If you're doing things right (i.e. including a MAC, and so on) it will not cause a security weakness. Including the resource length before sending it is standard practice in network applications, because sometimes, there just isn't any way to unambiguously delimit two consecutive resources - or one resource & the end of stream - based solely on the received data (this is the case here).
Feb
20
comment Implementing PKCS#7 Padding on a Stream of Unknown Length?
"padding 1-16 bytes of data isn't exactly the hardest thing in the world" Padding oracle attacks anyone? Is there any reason you can't send the file length in an encrypted header beforehand?
Feb
19
revised AES key/ciphertext space sizes
see fgrieu's comment
Feb
19
revised Could use an explanation of the notation for an oracle adversary
formatted math
Feb
19
revised AES key/ciphertext space sizes
added 1 characters in body
Feb
19
answered AES key/ciphertext space sizes
Feb
19
reviewed Approve Why is RSA encryption significantly faster than decryption?
Feb
18
comment Why is RSA encryption significantly faster than decryption?
Hint: consider the size of "e" compared to the size of "d".
Feb
18
revised Why is RSA encryption significantly faster than decryption?
fixed timing; edited tags
Feb
17
comment AES encryption with shared IV
Point taken. Using a message counter as IV with independent session keys is probably the best solution overall.
Feb
17
comment AES encryption with shared IV
I said "if it's initialized with random bits" (not known to the attacker, i.e. derived from the shared secret obtained upon connection). Of course the zero counter case is a flaw.
Feb
17
comment AES encryption with shared IV
The IV becoming public wouldn't be a security flaw if it's initialized with random bits, since they are all unique and unpredictable (though there is no reason to disclose it).
Feb
16
revised lfsr wiki excerpt
added 79 characters in body
Feb
16
comment Berlekamp-Massey algorithm: case when sequence length is less than double the length of the LFSR
Agreed, LFSR's probably merit a tag for themselves since there's a lot to be said about them. I added it.
Feb
16
wiki created lfsr excerpt