Henrick Hellström
Reputation
7,026
Top tag
Next privilege 10,000 Rep.
Access moderator tools
 Aug 12 comment Deterministic Rand function for Winternitz One Time Signatures I need (at least) 256 bit outputs because the Winternitz OWF has a 256 bit output. I need (at least) a 256 bit key, because the risk of collisions in the leaf keys must nut exceed the risk of collisions in the message digest function. I need a 256 bit seed because the number of leafs is $2^{250}$ and the total number of independent leaf keys is $2^{256}$. Aug 11 comment SHACAL in SHA-256 Yes, SHACAL-2 was e.g. selected as part of the NESSIE portfolio. However, it should be noted that some standard modes of operation don't have a 256-bit equivalent, such as GCM. Aug 9 comment Discovering private exponent from public key Correction: The order $q$ of $g$ is the least positive integer such that $1 = g^q \bmod N$. You are correct that an element $g$ is a generator of the multiplicative group if its order is $q = N-1$. Also please note that $N = 251$ isn't a safe prime, since $(N-1)/2 = 125$ isn't a prime. Aug 9 comment Discovering private exponent from public key The parameter $n$ in my answer is an arbitrary attack parameter that might be any value between $0$ and $128$. Aug 9 comment Discovering private exponent from public key @Joe In SRP, $g$ is supposed to be a generator of the multiplicative group, meaning that the order of $g$ should be $q = N-1$. Since $N$ is supposed to be a safe prime, the only other possible values are $q = (N-1)/2$, $q = 2$ and $q = 1$. Checking the order of $g$ is done by finding the least $q$ such that $g = g^q \bmod N$. Aug 7 comment Interleaving bytes to make an effectively larger block size If by "interleaving" you mean transposing, please see the second case in my answer. Your function has approximately the same collision rate as CBC mode or CFB mode under CPA, but at the expense of three AES invocations per 128 bits, instead of just one. Aug 3 comment Cryptographically Secure Hash Algorithm with Very Specific Property 1. What exactly do the operators $\oplus$ and $+$ signify? Bitwise xor and string concatenation, or something else? 2. Are the $K_i$ values supposed to be of a fixed bit length, or do you want the relation to hold for inputs of any length? Aug 1 comment Using Lattice-based cryptography for TLS\SSL @XCore I work mostly with independent software vendors. For them, GPL is as prohibitive as patents. Aug 1 comment Using Lattice-based cryptography for TLS\SSL I think you might add the fact that NTRU is patented to the list of reasons. It doesn't have anything to do with cryptography, but it is a very strong reason for a lot of people to bend over backwards searching for alternatives. Aug 1 comment Deterministic Rand function for Winternitz One Time Signatures Does there exist a standard Salsa/ChaCha variant that uses a 256 bit nonce (for at least 256 bit outputs) as per the question? Do you mean BLAKE? Jul 25 comment Deterministic Rand function for Winternitz One Time Signatures I guess there are three reasons: 1. Underlying requirement to use a standard primitive (e.g. AES). 2. Ability to generate the values at arbitrary positions (due to GMSS). 3. As few key schedule executions as possible. FWIW, I presume these requirements will be met by SHAKE256 once the standardization is final. Jul 17 comment Generalized Merkle Signatures, SHA-3 and Sakura @Dingo13: The problem with recovering the OTS private keys, seems to make it infeasible for an adversary to produce an existential forgery from a GMSS signature, even if the depth parameter might be altered. Jul 17 comment How long does it take to crack PBKDF2? If $DK$ is e.g. used as a key for a symmetric encryption scheme and the attacker has access to some cipher text and partial information about the plain text, testing if a $(DK, Salt, Password)$ guess is correct usually doesn't require prior knowledge of $DK$. Jul 15 comment Does CCA security imply authenticated encryption? @K.G. Yes, non-malleability does not strictly imply authenticity, as noted in my answer. FTR I didn't comment on your use of the term "AE" but on your use of the term "malleable". Jul 15 comment How does AES-CCM work in BitLocker? The octet length of the CCM nonce is not 16 but $15-L$, where $L$ equals the octet length of the counter. Jul 14 comment Does CCA security imply authenticated encryption? @K.G. The usual definition of malleability is that there exists a known function for transforming cipher texts into something that decrypts to related plain texts. Modifying an AE-scheme to return psuedo random plain text instead of an error doesn't qualify. Jul 13 comment Does CCA security imply authenticated encryption? IND-CCA2 is equivalent to NM-CCA2. Jun 25 comment How come Shamir Secret Sharing uses Lagrange interpolation? Technically, your question captures that $O(n^2) = O(kn^2 + r)$ for constant parameters $k, r$. The formula in my answer requires only about half as many multiplications, as if you were to calculate the coefficients of $P(x)$ instead of the the value of $P(0)$ directly. Newton's formula calculates the coefficients faster than Lagrange's formula, but it doesn't necessarily calculate the value of $P(0)$ faster. Jun 25 comment How come Shamir Secret Sharing uses Lagrange interpolation? Thanks, I improved it a bit further, to make it a bit a clearer exactly which calculations are made. Jun 17 comment Is HMAC needed for a SHA-3 based MAC? @figlesquidge Security is a relative notion. The question you link to in your comment, as well as the accepted answer to that question, explains in detail to what extent HMAC-SHA3 would be more secure than using in SHA3 in its built in MAC mode.