5,491 reputation
1827
bio website
location
age
visits member for 2 years, 9 months
seen 6 hours ago

Aug
2
revised Correctly generating cryptographically secure pseudorandom numbers (in C)?
added 1392 characters in body
Aug
1
comment Using Lattice-based cryptography for TLS\SSL
@XCore I work mostly with independent software vendors. For them, GPL is as prohibitive as patents.
Aug
1
comment Using Lattice-based cryptography for TLS\SSL
I think you might add the fact that NTRU is patented to the list of reasons. It doesn't have anything to do with cryptography, but it is a very strong reason for a lot of people to bend over backwards searching for alternatives.
Aug
1
comment Deterministic Rand function for Winternitz One Time Signatures
Does there exist a standard Salsa/ChaCha variant that uses a 256 bit nonce (for at least 256 bit outputs) as per the question? Do you mean BLAKE?
Jul
25
accepted Generalized Merkle Signatures, SHA-3 and Sakura
Jul
25
comment Deterministic Rand function for Winternitz One Time Signatures
I guess there are three reasons: 1. Underlying requirement to use a standard primitive (e.g. AES). 2. Ability to generate the values at arbitrary positions (due to GMSS). 3. As few key schedule executions as possible. FWIW, I presume these requirements will be met by SHAKE256 once the standardization is final.
Jul
19
answered Are HMACs based on hashes with larger bit-lengths also more secure?
Jul
17
comment Generalized Merkle Signatures, SHA-3 and Sakura
@Dingo13: The problem with recovering the OTS private keys, seems to make it infeasible for an adversary to produce an existential forgery from a GMSS signature, even if the depth parameter might be altered.
Jul
17
comment How long does it take to crack PBKDF2?
If $DK$ is e.g. used as a key for a symmetric encryption scheme and the attacker has access to some cipher text and partial information about the plain text, testing if a $(DK, Salt, Password)$ guess is correct usually doesn't require prior knowledge of $DK$.
Jul
17
revised Generalized Merkle Signatures, SHA-3 and Sakura
added 362 characters in body
Jul
17
asked Generalized Merkle Signatures, SHA-3 and Sakura
Jul
15
comment Does CCA security imply authenticated encryption?
@K.G. Yes, non-malleability does not strictly imply authenticity, as noted in my answer. FTR I didn't comment on your use of the term "AE" but on your use of the term "malleable".
Jul
15
comment How does AES-CCM work in BitLocker?
The octet length of the CCM nonce is not 16 but $15-L$, where $L$ equals the octet length of the counter.
Jul
14
comment Does CCA security imply authenticated encryption?
@K.G. The usual definition of malleability is that there exists a known function for transforming cipher texts into something that decrypts to related plain texts. Modifying an AE-scheme to return psuedo random plain text instead of an error doesn't qualify.
Jul
14
revised Does CCA security imply authenticated encryption?
added 1129 characters in body
Jul
13
revised Effective security of block cipher – equal the key size, or half the key size?
added 534 characters in body
Jul
13
revised Effective security of block cipher – equal the key size, or half the key size?
added 3 characters in body
Jul
13
answered Effective security of block cipher – equal the key size, or half the key size?
Jul
13
answered Does CCA security imply authenticated encryption?
Jul
13
comment Does CCA security imply authenticated encryption?
IND-CCA2 is equivalent to NM-CCA2.