Reputation
6,756
Top tag
Next privilege 10,000 Rep.
Access moderator tools
Badges
1 12 35
Newest
 Nice Answer
Impact
~164k people reached

Feb
9
comment Is reusing keys for CBC and CBC-MAC secure when using encrypt-then-MAC?
CCM mode (counter mode with CBC MAC) uses the same keys for CTR mode encryption and for the CBC MAC.
Feb
3
comment Determining Involutary Keys in Substitution Ciphers
The symmetric group $S_n$ is defined as the set of all permutations over the elements of $\mathbb{Z}_n$ with composition of permutations being the group operation. If and only if an element in such a group is of order 2, then it meets the condition in your question, yes.
Jan
30
comment Side channel security of HMAC in software
True, if the hardware leaks the number of bits affected by instructions that would otherwise be assumed to be atomic, all bets are off. This obviously begs the question exactly what might be assumed about the hardware?
Jan
30
comment Side channel security of HMAC in software
Are you aware of any kind of side channel attacks against SHA-1 or SHA-2? There are no data dependent table look-ups like in AES and the algorithms appear to have a completely input independent operation flow.
Jan
28
comment Can I use a one time pad key twice with random plaintext?
Let us continue this discussion in chat.
Jan
28
comment Can I use a one time pad key twice with random plaintext?
I understand your point from a purely semantic point of view, but in practice, as the example in my answer is written, there is no practical meaning to the notion of guessing the message with probability $2^{-n}$. There will still be no way to test which guess is correct, all alternatives will be equally probable, exactly because the message was random, secret and has been discarded, as stipulated.
Jan
27
comment Can I use a one time pad key twice with random plaintext?
Isn't your point covered by the second paragraph in my answer? You will preserve the entropy of the message if you discard it immediately after transmission, but only then, and that's typically not what you want to do with messages.
Jan
27
comment Can I use a one time pad key twice with random plaintext?
a xor b || a xor c = b xor a || c xor a. The entropy is exactly the same.
Jan
16
comment Is it safe to use XOR to encrypt data key using master key
crypto.stackexchange.com/questions/2264/…
Jan
11
comment Encryption used in a commercial software product
Your question is off-topic here. I suggest that you ask this question to the software manufacturer directly.
Jan
6
comment Protocol to identify zone of potential agreement without revealing reservation prices and having to trust third parties?
A somewhat related problem would be how to eliminate the risk of collusion. Suppose A is working with C, who is the "real" prospective buyer from B. A proposes a maximum price that is lower than what C is prepared to pay, and communicates the result to C, before C and B executes the protocol. This way C is able to start the negotiation with an offer that leads to a final price that is closer to B's minimum.
Jan
3
comment Is CPU timing jitter a usable entropy source?
I've been using CPU timing jitter as entropy source on a wide variety of CPU models since 2001. Perhaps the most important observation is that it has become more risky on modern multicore CPUs. If you are not careful, you might end up harvesting entropy from a core that is not used for anything else, meaning you will either end up with a poor entropy source, or be stuck in an endless loop.
Jan
2
comment Homemade Randomized RSA
Suppose you take a guess at $m$. Will you be able to tell if $(A,B)$ is an encryption of $m$ or not? (You will.)
Dec
28
comment Shamir's Secret Scheme : Knowing the threshold
@IlmariKaronen I understand, but shouldn't the fact that we are dealing with polynomials and not random functions affect that probability?
Dec
28
comment Shamir's Secret Scheme : Knowing the threshold
@IlmariKaronen Are you sure the probability is exactly $1/q$? I agree with the approximation, but would presume that two polynomials of degree $k+1$ and $t-1$, with $k+1 < t-1$, might intersect in up to $t-1$ different points; not $k+1$ points.
Dec
14
comment Cost of attack on DSA with attack on DLP
You can't "optimize" Pollard Rho. It is what it is. You can however (a) modify the algorithm to use various trade-offs, or (b) optimize the implementations of the underlying arithmetic operations. In the former case you will get a different algorithms. which might or might not be faster depending on a lot of factors. In the latter case you might get a speed up by a constant factor.
Dec
5
comment Unconditionally Secure Authentication
Do I understand correctly that you are looking for a MAC that will not leak information about the plain text, even in the face of an unbounded attacker (simple: EtA will work)?
Nov
28
comment RSA: Most significant key bit always 1?
@pafodie There is a subtle difference between numbers and bit strings. Bit strings might have either 0 or 1 at the most significant index. All positive non-zero numbers will always have 1 in the most significant bit.
Nov
26
comment Does the RSA algorithm use repeated squaring?
The RSA algorithm doesn't use repeated squaring. However, many implementations of the RSA private key operation do use implementations of modular exponentiation that do use repeated squaring in one form or another.
Nov
21
comment CTR DRBG dependent on request size?
A library that implements DRBG-AES-CTR will implement AES-PRF, which can be used as a "chunkable" PRF.