Henrick Hellström

2,656 reputation

1412

bio	website
	location
	age
visits	member for	1 year, 3 months
	seen	55 secs ago
stats	profile views	29

	2,656 reputation	bio	website		visits	member for	1 year, 3 months
1412 badges		location			seen	55 secs ago

summary answers questions tags badges favorites bounties reputation activity

182 Comments

suggestions reviews revisions comments badges posts accepts all

41m	comment	Secure low-key crypto A substitution cipher that is set up by something similar to the RC4 key schedule, where $k$ is the block bit length, and the key length $n = 2^{k/2}$, would have properties similar to those I guess you are looking for - at least if you are only going to demonstrate how to break it using the most obvious methods.
May 21	comment	Is Wikipedia's table about SHA-2 collisions correct? @PaŭloEbermann: I think reduced round attacks might be mentioned in this context, if the number of rounds attacks start to move up beyond some comfort limit. Otherwise mentioning them might just obscure the fact that there are logically reduced round attacks against any algorithm with multiple rounds (because after all that's why multiple rounds were made part of the design to begin with).
May 21	comment	Is Wikipedia's table about SHA-2 collisions correct? @PaŭloEbermann: Nit-pick, but if reduced round attacks are relevant, if found at least one against 2 round Keccak: naya.plasencia.free.fr/Maria/papers/Keccak_differential.pdf
May 20	comment	How random are comercial TRNGS I think you are probably asking the wrong question for this forum; this is not the right place to ask for product recommendations. However, theoretical cryptography can tell how to use a not necessarily completely reliable TRNG for seeding a PRNG in such way that you at least do not make matters worse.
May 20	comment	How random are comercial TRNGS Check the documentation. How has the manufacturer ensured that the output is unbiased? By using conditioning (using what method and with which security parameters), or by tuning the hardware to ensure the raw unconditioned output does not show any statistical bias (after how many requests)?
May 16	comment	Is this a sensible cryptographic protocol intending to reduce the impact of compromised security? Just a hint: Generally the basic idea is that you get cryptographic security by ensuring that the key never gets anywhere it might get compromised. Your protocol might give you security by obscurity at best, given your own assumptions about the threat scenario.
May 16	comment	Generate fixed length cipher text from arbitrary length plaintext Correct, the whole idea behind en.wikipedia.org/wiki/Numbers_station encryption is that the broadcast goes on forever, so that you don't get an indication when the actual traffic occurs. Obviously you are also theoretically correct about file encryption and drive encryption, but in practice there is equally obviously always a practical upper bound on how large a file might get, before you have to change medium.
May 16	comment	Generate fixed length cipher text from arbitrary length plaintext You hide the amount of actual plain text content. For instance, compare it to the WWII continuous broadcasts of seemingly random words. If you were listening in and didn't know which keyword to listen for, you couldn't tell when a message began or ended.
May 14	comment	Why is the following RSA PRNG cryptographically secure? If you mean algorithm 5.35 in HAC, you will only output the least significant bit of each intermediary $x_i$ value.
May 14	comment	Is there a way to do fair exchange between two parties who don't trust each other? @RickyDemer: Done right, yes. OTOH did I implement a bignum library that is approximately 100 times faster for similar 8192 bit integer operations, than another existing bignum library, on the same machine. Either way it boils down to how you define "much".
May 13	comment	Is there a way to do fair exchange between two parties who don't trust each other? @RickyDemer: That's basically the same thing as using contemporary key stretching techniques for deriving a 128 bit key from a 32 bit key, so I guess you could have answered yes. :)
May 13	comment	Is there a way to do fair exchange between two parties who don't trust each other? @RickyDemer: Do you mean use e.g. 32 bit encryption, and swap keys before the other party has a chance to decrypt the message by brute force? I guess there are Internet Poker protocols based on such primitives.
May 13	comment	Is there a way to do fair exchange between two parties who don't trust each other? @RickyDemer: Without additional assumptions and constraints, protocols with the latter property are not possible without a third party. cs.utexas.edu/~shmat/courses/cs395t_fall04/pagnia.pdf
May 13	comment	Is there a way to do fair exchange between two parties who don't trust each other? Yes, that perhaps should be made explicit. The best you can do without a trusted third party, is to get the ability to abort if the other party tries to change its message after you reveal yours. For some scenarios that is enough.
May 13	comment	Is there a way to do fair exchange between two parties who don't trust each other? Are you familiar with en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange? If yes, and this wouldn't meet your specific requirements, please explain why.
May 12	comment	Designing a security system from scratch with a custom protocol, suggestions needed Technically, it is perfectly possible to use SSL/TLS over any kind of odd transport, as long as the transport features reliable serialization of packets. Hence, you might perfectly well use the database server as a link in that communication, and let the two end nodes communicate using SSL/TLS.
May 9	comment	Recommended way of adding a pepper/secret key to password before hashing? @JesperMortensen: Given the clarified answer, I have to agree with D.W. regarding option 3. You might use $HKDF_{key}(password)$, but it would be overkill to use HDKF for this step, presuming $key$ is already pseudorandom.
May 8	comment	Recommended way of adding a pepper/secret key to password before hashing? You might want to read the HKDF specification, in particular the section on "extraction". You should change the role of the salt and the password in 3.
May 8	comment	*What does $(\mathbb{Z}_n^)^2$ mean?** @user4811: It looks that way, but perhaps more to the point, was there anything in the context of that theorem that led you to believe the notation could have anything to do with quadratic residues?
May 8	comment	*What does $(\mathbb{Z}_n^)^2$ mean?** @RickyDemer: The group $(\mathbb Z_1,\cdot)$ is indeed the trivial group with just one element, which happens to be the element zero. Since it is a trivial group I don't think I have ever seen anyone use the notation $\mathbb Z_1^*$ for it (and fwiw and imho I don't see a need for it either).