5,516 reputation
1828
bio website
location
age
visits member for 2 years, 10 months
seen Dec 18 at 13:02

Aug
1
comment Using Lattice-based cryptography for TLS\SSL
@XCore I work mostly with independent software vendors. For them, GPL is as prohibitive as patents.
Aug
1
comment Using Lattice-based cryptography for TLS\SSL
I think you might add the fact that NTRU is patented to the list of reasons. It doesn't have anything to do with cryptography, but it is a very strong reason for a lot of people to bend over backwards searching for alternatives.
Aug
1
comment Deterministic Rand function for Winternitz One Time Signatures
Does there exist a standard Salsa/ChaCha variant that uses a 256 bit nonce (for at least 256 bit outputs) as per the question? Do you mean BLAKE?
Jul
25
comment Deterministic Rand function for Winternitz One Time Signatures
I guess there are three reasons: 1. Underlying requirement to use a standard primitive (e.g. AES). 2. Ability to generate the values at arbitrary positions (due to GMSS). 3. As few key schedule executions as possible. FWIW, I presume these requirements will be met by SHAKE256 once the standardization is final.
Jul
17
comment Generalized Merkle Signatures, SHA-3 and Sakura
@Dingo13: The problem with recovering the OTS private keys, seems to make it infeasible for an adversary to produce an existential forgery from a GMSS signature, even if the depth parameter might be altered.
Jul
17
comment How long does it take to crack PBKDF2?
If $DK$ is e.g. used as a key for a symmetric encryption scheme and the attacker has access to some cipher text and partial information about the plain text, testing if a $(DK, Salt, Password)$ guess is correct usually doesn't require prior knowledge of $DK$.
Jul
15
comment Does CCA security imply authenticated encryption?
@K.G. Yes, non-malleability does not strictly imply authenticity, as noted in my answer. FTR I didn't comment on your use of the term "AE" but on your use of the term "malleable".
Jul
15
comment How does AES-CCM work in BitLocker?
The octet length of the CCM nonce is not 16 but $15-L$, where $L$ equals the octet length of the counter.
Jul
14
comment Does CCA security imply authenticated encryption?
@K.G. The usual definition of malleability is that there exists a known function for transforming cipher texts into something that decrypts to related plain texts. Modifying an AE-scheme to return psuedo random plain text instead of an error doesn't qualify.
Jul
13
comment Does CCA security imply authenticated encryption?
IND-CCA2 is equivalent to NM-CCA2.
Jun
25
comment How come Shamir Secret Sharing uses Lagrange interpolation?
Technically, your question captures that $O(n^2) = O(kn^2 + r)$ for constant parameters $k, r$. The formula in my answer requires only about half as many multiplications, as if you were to calculate the coefficients of $P(x)$ instead of the the value of $P(0)$ directly. Newton's formula calculates the coefficients faster than Lagrange's formula, but it doesn't necessarily calculate the value of $P(0)$ faster.
Jun
25
comment How come Shamir Secret Sharing uses Lagrange interpolation?
Thanks, I improved it a bit further, to make it a bit a clearer exactly which calculations are made.
Jun
17
comment Is HMAC needed for a SHA-3 based MAC?
@figlesquidge Security is a relative notion. The question you link to in your comment, as well as the accepted answer to that question, explains in detail to what extent HMAC-SHA3 would be more secure than using in SHA3 in its built in MAC mode.
May
30
comment Update to “Cryptographic Right Answers”
@otus: true, using a CA provides no advantage in case you know the server private key is compromised. However, an educated guess is that most of the time a private key is compromised the owner is blissfully unaware of the situation, which is why certificates are normally set to expire. Expiration requires a CA, in order to be handled transparently by the client software.
May
30
comment Update to “Cryptographic Right Answers”
@otus: In order to avoid having to replace all client software due to private key compromise, the client software should include the public key corresponding to the private key that stands the least risk of becoming compromised.
May
8
comment Size of p in ElGamal cryptosystem?
No, it is theoretically impossible, unless you alter either the modes or the ElGamal encryption algorithm beyond recognition. I am curious about if you had any such alterations in mind, and if you can point to a security analysis of the result.
May
8
comment Size of p in ElGamal cryptosystem?
How, and why, would you possibly use ElGamal encryption in a chaining mode? It is not a block cipher and the cipher text is always greater than the plain text.
Apr
25
comment Is the product of two primes only factorisable by those two primes?
The answer is "Yes".
Apr
21
comment Stateless hash based public key cryptography?
Indeed, thanks. Using a seeded deterministic PRF for the private keys will make it possible to recreate everything. I think it requires careful balancing of the parameters to get acceptable performance, though. Using a ten level fractal of hash trees with $2^8$ leaf nodes seems feasible.
Apr
21
comment Stateless hash based public key cryptography?
Could you please expand a bit on the details? Clearly, with this approach you would still have to save all sub-trees in your fractal, because you can't rule out the possibility you might have to revisit them later. (If you could rule out that possibility, you would only need the top level tree, but then you would still have to save all nodes of that tree.)