5,516 reputation
1828
bio website
location
age
visits member for 2 years, 10 months
seen 2 days ago

Feb
21
comment Why do we use XTS over CTR for disk encryption?
Nice answer, but newer content replaced with older content will be a concern even if you use authenticated encryption. Prevention of replay attacks requires more than just authenticated encryption.
Feb
21
comment Is script execution time a decent source of pseudorandom number generation?
There might be a certain amount of unpredictability in this (presuming the adversary doesn't have full access to the parent system and you don't do this in the context of responding to the request), but you need a high resolution timer (not just microtime) and more than a single timing.
Feb
20
comment What informal indicators exist for estimating the computational infeasibility of cryptographic problems?
Also, it would be possible to formulate a valid hypothesis based on anecdotal experience, either if it demonstrates that no such study could ever eliminate a significant amount of inherently unknown hidden statistics, or, conversely, if it indicates exactly what kind of evidence should be collected to reach a reliable answer.
Feb
20
comment What informal indicators exist for estimating the computational infeasibility of cryptographic problems?
These kinds of things are very similar to what is studied in social sciences and economics. In principle, we don't have to guess. However, if no such research has been done, either due to lack of interest or lack of opportunity to collect the necessary data, that would also be an interesting answer.
Feb
16
comment My SSH server public key is 2048 bits, but my account's private key is 4096. What is my effective security?
@Gilles: Right, the question makes more sense if the second key is a public key server side, and is used for client auth.
Feb
14
comment Why is a 2048-bit public RSA key represented by 540 hexadecimal characters in X.509 Certificates?
Minor nit: X.509 objects are always DER encoded and not just BER encoded. DER is a subset of BER, so you might decode any DER encoding with a BER decoder, but the converse is not (necessarily) true, because DER encoding is unequivocal, while BER encoding is not.
Feb
10
comment How can I simulate and measure brute force hacking using RSA?
160 bits sound about right if by "brute force" one means literally iterating through all odd numbers from $\sqrt(N)$ and checking if the value divides $N$.
Feb
3
comment Can passwords be stored securely so that a similarity comparison can be made?
No, it would just require storing $h = Hash(f(PW))$. If $PW_0$ and $PW_1$ are similar, then $h_0 = h_1$.
Feb
3
comment Can passwords be stored securely so that a similarity comparison can be made?
One answer would be that the entered passwords are always passed through a function $f$ such that $f(PW_0) = f(PW_1)$ iff the passwords are "similar". One trivial example would be converting all entered passwords to all lower case before further processing.
Feb
2
comment What is difference between PRG, PRF, and PRP
It would be a stretch, so not quite. A PRF has to be indistinguishable from a random function. A PRP might be, but doesn't have to be, a PRF in this sense. However, the security proof for e.g. CTR mode is based on the premise that the block cipher (a PRP) might be modeled as a PRF, as long as the key stream is constrained to the square root of the cardinality of the total set of possible blocks.
Feb
2
comment Proof for exponentiation in modular arithemtic
This is a proof by induction. We know it is true for $e = 1$. Using the formula in the answer, we can then prove it is true for $e = 2$ as well, and then for $e = 3$ etc. No matter how large $e$ gets, we might prove that the formula is true for $e + 1$ as well. Hence, by induction, it is true for all integer values of $e$.
Feb
2
comment What is difference between PRG, PRF, and PRP
The difference between a PRF and a PRP is that the PRP is a bijective function and the PRF is not. There are no other differences, but of course this difference has various implications for their respective applications.
Jan
28
comment Secret sharing - no dealer, modifiable, verifiable
If robustness isn't a requirement, also look at Pedersen's original scheme link.springer.com/chapter/10.1007%2F3-540-46416-6_47
Jan
28
comment Secret sharing - no dealer, modifiable, verifiable
This sounds a lot like the Joint-Uncond-Secure-RSS scheme of link.springer.com/chapter/10.1007%2F3-540-68339-9_31. The trick is to let each participant be a dealer, or, put differently, build the scheme around participants who generate their shares randomly.
Jan
27
comment How can I find the prime numbers used in RSA?
The approach is just basic algebra. If the factors are close to the floor $x$ of the square root, the equation $r + (x-p)(q-x) - x(q+p-2x)$ will be dominated by the first and third term and the second factor of the third term will consequently be a function of the magnitude of $r$.
Jan
27
comment How cryptographically secure was the original WW2 Enigma machine, from a modern viewpoint?
AES is believed to be (IND-CPA) secure even if the plain text is chosen by the attacker, so why do you include the restriction of no operator errors?
Jan
14
comment Do I need to prepare plain text before encryption?
I see no obvious harm in anyone following your recommendation, but it is completely pointless as far as cryptographic security goes.
Jan
13
comment Do I need to prepare plain text before encryption?
Compression does not increase the total entropy of the plain text, but it does increase the average entropy per bit, by, well, compressing it. Theoretically, it might increase security in some sense, but only in so far that the compression algorithm effectively hides the length of the original plain text.
Jan
6
comment Shared secret: Generating Random Permutation
To avoid unnecessary confusion: I noted in my comment that a threshold scheme would introduce a risk of collusion and didn't "propose" such a scheme, but only stated a problem.
Jan
6
comment Shared secret: Generating Random Permutation
How are you going to enforce such a requirement? Suppose Alice, Bob and Carol are playing. Alice has already folded but remain online. Bob has gone all-in but realizes he is about to loose just before the last card is to be revealed. Bob privately asks Alice to pull the plug. Alice pulls the plug.