Reputation
4,243
Next tag badge:
101/100 score
17/20 answers
Badges
1 9 31
Newest
 Caucus
Impact
~97k people reached

Jan
26
comment Cryptographic Symmetric Stream Cipher
If S and P are inverses of each other then you can put any block cipher in their place and all your conditions will be satisfied, with the exception of semantic security which requires the ciphertext to be strictly longer than the plaintext. Though I don't understand the use-case, how would you 'use' this system in real life?
Jan
26
comment Theoretical pi-based stream cipher
@fgrieu The question mentions a one-time-pad, but if we downgrade to stream cipher security, I know not of any such result either. It could work, but we're relying on unproven assumptions here (that it isn't possible to efficiently match an $n$-digit long string in base $b$ with its first occurrence in $\pi$, for all we know an algorithm exists to do it in time faster than $O(b^n)$).
Jan
26
awarded  Yearling
Jan
26
comment Theoretical pi-based stream cipher
Ah, I did not see Joshua's assumption - sorry! That'll teach me to comment without reading the entire thread..
Jan
26
comment Theoretical pi-based stream cipher
The $n$th digit of $\pi$ is most certainly not a uniform random variable over $\mathbb{Z}_{10}$, therefore claiming that this scheme is equivalent to an OTP is incorrect (it may seem that choosing a random "starting position" is enough, but it's not - the underlying distribution of $\pi$ actually matters and if it is not uniformly random, it will destroy entropy encoded in said starting position).
Jan
25
reviewed Close What is the most paranoid way to exchange messages?
Jan
24
comment Which categories of cipher are semantically secure under a chosen-plaintext attack?
The stream cipher issue is generally addressed by introducing an IV as part of the stream cipher's key somehow, unfortunately there is no generic way to securely accomplish this (unlike for block ciphers) which is why stream ciphers often end up being used with the same key (or related keys) more than once.
Jan
24
comment In the Paillier cryptosystem, is there a method to judge whether an encrypted number is less than 0 (without the private key)
@phan I don't know of any additively homomorphic symmetric ciphers, but if such a cipher existed, it would not be IND-CPA secure. The attacker could use the order property to work out which of the two ciphertexts belongs to any one plaintext.
Jan
24
revised Why does Rijndael with a 256-bit block require the bottom two rows to be shifted one more space than usual?
edited title
Jan
23
comment Initialize a PRNG with a password
It's funny but those password "strength" requirements you quoted, then struck out, are actually not doing much for the password's strength. The average user (who probably reuses his weak password everywhere) will most likely get frustrated and append a symbolic "#" at the end of his password just to get it accepted by your system, and will then proceed to write it down in some file just to remember it's a different one.
Jan
23
comment Hashing a password with the password?
I understood it as HMAC(password, password) or something like that, but you are right. Plus it doesn't really have any functional advantage over just hashing the password, and may in fact be weaker due to over-engineering.
Jan
23
comment In the Paillier cryptosystem, is there a method to judge whether an encrypted number is less than 0 (without the private key)
A fully order-preserving cryptosystem would have a few issues..
Jan
23
awarded  Necromancer
Jan
22
comment How compared encryption algorithm in terms of efficiency
@almodawan No need to shout, it's an acronym.
Jan
22
reviewed Approve SHA-256 and AES-128
Jan
22
comment Two files encrypted with related data versus one file
Indeed, it is IND-CPA secure - I just wanted to clarify that point.
Jan
22
comment Two files encrypted with related data versus one file
"AES" is certainly not IND-CPA secure. A probabilistic encryption scheme such as CBC, CTR, OFB, .. is.
Jan
22
comment How compared encryption algorithm in terms of efficiency
No, there isn't. Big-O complexity is asymptotic - in addition to being an average - and is generally not accurate for realistic key sizes. In addition, some theoretically fast algorithms are terribly slow because they are not amenable to an efficient implementation, etc.. your best bet is to measure it, IMHO.
Jan
21
revised Using CBC with a fixed IV and a random first plaintext block
added 84 characters in body
Jan
21
reviewed Approve ANSI X9.31 standards for generating random numbers