Reputation
4,243
Next tag badge:
101/100 score
17/20 answers
Badges
1 9 31
Newest
 Caucus
Impact
~97k people reached

Feb
25
comment Nonce role on stream ciphers
@Ivella In that case the offset in the keystream for each new message is equivalent to an IV (a variant of counter mode, but for stream ciphers). And as Paŭlo says, this has a few drawbacks.
Feb
25
comment Chosen Plaintext Attacks against an Affine Cipher
What happens if the attacker asks the oracle to encrypt $x = 0$?
Feb
25
comment How to represent point-at-infinity in affine coordinate
Does crypto.stackexchange.com/questions/6156/… help, by any chance?
Feb
25
answered Nonce role on stream ciphers
Feb
24
comment Fastest multiplication algorithm for efficient exponentiation in C++?
Fürer's algorithm is asymptotically the fastest multiplication algorithm known, but only for numbers with several million digits, so it's definitely not meant for cryptography (or anything else, really). If you're just doing RSA, Karatsuba will work fine.
Feb
24
comment Is the following key stretching algorithm as memory hard as I think it is?
I recommend you take a look at the code of scrypt to see what is going on at a high level (there are python implementations).
Feb
24
comment Bad/Crackable Encryption Example?
The first example that comes to mind is deterministic encryption (no IV) on a small piece of data. Looks impenetrable to the novice, but you can do lots of stuff with that (replay attacks, statistical attacks, etc..)
Feb
24
comment Is the following key stretching algorithm as memory hard as I think it is?
I don't think it's possible to have a purely memory-hard problem, it's always possible to not use memory and recalculate everything all the time, but you have to make sure this is actually expensive.
Feb
24
comment Is the following key stretching algorithm as memory hard as I think it is?
@mingleplough You don't need an excessively large number of iterations to make it memory-hard (otherwise it would be too slow in practice, 200k iterations is already pushing it). And initializing the array does help - in the example you gave, the attacker can clearly choose to not spend much memory and only save some of the cells in the array, but he'll have to spend much more time repeatedly computing the missing cells that way, which balances out. And just iterating a hash wasn't my idea of initialization, think something where a cell depends on all previous cells.
Feb
23
answered Is the following key stretching algorithm as memory hard as I think it is?
Feb
21
comment Computational indistinguishability and example of non polynomial algorithm
Another example is this: distinguish between a stream of output from Blowfish-CTR and AES-CTR (or generally two block ciphers with different block sizes in CTR mode). An algorithm can distinguish them without even touching the keys, using the birthday paradox, with complexity $\approx 2^{32}$, which is not polynomial-time (is exponential) but far better than brute-force.
Feb
21
comment Computational indistinguishability and example of non polynomial algorithm
Brute force on the input of algorithm $A$? But otherwise I suspect the algorithm would be highly dependent on the underlying cryptographic primitive, the simplest example is RSA where integer factorization is subexponential (but not polynomial) but this isn't a great example, being public-key and all.
Feb
21
comment Why do we assume un-security of communication channel on every cryptography system
I suppose because you need cryptography to make those channels secure. And you can't just create a mega-channel and say "this is secure, use this for encrypted communication", because a "secure channel" requires authentication of both parties, which is inherently an individual process.
Feb
20
comment Implementing PKCS#7 Padding on a Stream of Unknown Length?
If you're doing things right (i.e. including a MAC, and so on) it will not cause a security weakness. Including the resource length before sending it is standard practice in network applications, because sometimes, there just isn't any way to unambiguously delimit two consecutive resources - or one resource & the end of stream - based solely on the received data (this is the case here).
Feb
20
comment Implementing PKCS#7 Padding on a Stream of Unknown Length?
"padding 1-16 bytes of data isn't exactly the hardest thing in the world" Padding oracle attacks anyone? Is there any reason you can't send the file length in an encrypted header beforehand?
Feb
19
revised AES key/ciphertext space sizes
see fgrieu's comment
Feb
19
revised Could use an explanation of the notation for an oracle adversary
formatted math
Feb
19
revised AES key/ciphertext space sizes
added 1 characters in body
Feb
19
answered AES key/ciphertext space sizes
Feb
19
reviewed Approve Why is RSA encryption significantly faster than decryption?