5,366 reputation
1724
bio website
location
age
visits member for 2 years, 6 months
seen 1 hour ago

Aug
5
revised Interleaving bytes to make an effectively larger block size
added 965 characters in body
Aug
5
revised Interleaving bytes to make an effectively larger block size
added 8 characters in body
Aug
5
revised Interleaving bytes to make an effectively larger block size
added 550 characters in body
Aug
5
answered Interleaving bytes to make an effectively larger block size
Aug
3
comment Cryptographically Secure Hash Algorithm with Very Specific Property
1. What exactly do the operators $\oplus$ and $+$ signify? Bitwise xor and string concatenation, or something else? 2. Are the $K_i$ values supposed to be of a fixed bit length, or do you want the relation to hold for inputs of any length?
Aug
2
revised Correctly generating cryptographically secure pseudorandom numbers (in C)?
added 1392 characters in body
Aug
1
comment Using Lattice-based cryptography for TLS\SSL
@XCore I work mostly with independent software vendors. For them, GPL is as prohibitive as patents.
Aug
1
comment Using Lattice-based cryptography for TLS\SSL
I think you might add the fact that NTRU is patented to the list of reasons. It doesn't have anything to do with cryptography, but it is a very strong reason for a lot of people to bend over backwards searching for alternatives.
Aug
1
comment Deterministic Rand function for Winternitz One Time Signatures
Does there exist a standard Salsa/ChaCha variant that uses a 256 bit nonce (for at least 256 bit outputs) as per the question? Do you mean BLAKE?
Jul
25
accepted Generalized Merkle Signatures, SHA-3 and Sakura
Jul
25
comment Deterministic Rand function for Winternitz One Time Signatures
I guess there are three reasons: 1. Underlying requirement to use a standard primitive (e.g. AES). 2. Ability to generate the values at arbitrary positions (due to GMSS). 3. As few key schedule executions as possible. FWIW, I presume these requirements will be met by SHAKE256 once the standardization is final.
Jul
19
answered Are HMACs based on hashes with larger bit-lengths also more secure?
Jul
17
comment Generalized Merkle Signatures, SHA-3 and Sakura
@Dingo13: The problem with recovering the OTS private keys, seems to make it infeasible for an adversary to produce an existential forgery from a GMSS signature, even if the depth parameter might be altered.
Jul
17
comment How long does it take to crack PBKDF2?
If $DK$ is e.g. used as a key for a symmetric encryption scheme and the attacker has access to some cipher text and partial information about the plain text, testing if a $(DK, Salt, Password)$ guess is correct usually doesn't require prior knowledge of $DK$.
Jul
17
revised Generalized Merkle Signatures, SHA-3 and Sakura
added 362 characters in body
Jul
17
asked Generalized Merkle Signatures, SHA-3 and Sakura
Jul
15
comment Does CCA security imply authenticated encryption?
@K.G. Yes, non-malleability does not strictly imply authenticity, as noted in my answer. FTR I didn't comment on your use of the term "AE" but on your use of the term "malleable".
Jul
15
comment How does AES-CCM work in BitLocker?
The octet length of the CCM nonce is not 16 but $15-L$, where $L$ equals the octet length of the counter.
Jul
14
comment Does CCA security imply authenticated encryption?
@K.G. The usual definition of malleability is that there exists a known function for transforming cipher texts into something that decrypts to related plain texts. Modifying an AE-scheme to return psuedo random plain text instead of an error doesn't qualify.
Jul
14
revised Does CCA security imply authenticated encryption?
added 1129 characters in body