Henrick Hellström

2,971 reputation

1413

bio	website
	location
	age
visits	member for	1 year, 4 months
	seen	1 hour ago
stats	profile views	31

	2,971 reputation	bio	website		visits	member for	1 year, 4 months
1413 badges		location			seen	1 hour ago

summary answers questions tags badges favorites bounties reputation activity

200 Comments

suggestions reviews revisions comments badges posts accepts all

2h	comment	Is a small size block cipher usable? @Thomas: That, of course, depends on the confidence coefficient, as well as what is known of the plain text. As I wrote in my answer, you really only need two known plain text blocks to be more likely right than wrong if you guess it is CTR cipher text if there is no repetition.
6h	comment	Is using EAX mode with a 64-bit block cipher a bad idea? 64 bit authentication tags are however subject to online attacks. Normally you can live with a $2^{-64}$ risk of someone generating a valid tag by pure chance, but it might be a problem if the authentication scheme is such that the attacker might lower the odds of success by collecting lots of known plain/cipher text pairs.
2d	comment	Security of authenticated encryption modes gcm & ccm The modification made in the OCB1 mode otoh results in a different security proof: cs.ucdavis.edu/~rogaway/papers/offsets.pdf
2d	comment	Security of authenticated encryption modes gcm & ccm I think you are mistaken. If you need 128 bit of security in a IND-CCA2 model, you clearly can't use a mode that allows you to create forgeries with significantly better than $2^{-128}$ probability with realistic amounts of data. You do need IND-CCA2 security for online data transmission protocols, so with OCB mode you have to rekey long before you reach even MB of data transmitted using a key.
Jun 15	comment	Security of authenticated encryption modes gcm & ccm Are you asking why GCM and CCM are NIST approved, while EAX and OCB are not? csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf csrc.nist.gov/publications/nistpubs/800-38C/…
Jun 10	comment	When using HMAC, does key encoding matter? You got the parameters L and B mixed up in the third paragraph. B is the block length of the to-be-hashed input, before passed to the compression function (64 bytes for MD5), and L is the hash output size (16 bytes for MD5).
Jun 6	comment	Why is verification using DSA slower than verification with RSA? @SanderDemeester: That depends on both software and hardware. If you use a schoolbook implementation on hardware with a normal word size (such as 32 or 64), you should expect the private key operation to be up to 8 times slower, and the public key operation to be 4 times slower, if you increase the modulus by a factor of 2. The actual difference might be both greater and smaller, depending on things such as which algorithm is used, the CPU cache etc.
Jun 4	comment	HMAC and assumptions on the cryptographic hash In order for a hash function with $n$ bits of output to be collision resistant, it must take at least $2^{n/2}$ work and storage to find a collision. Presuming your hash function $H$ is collision resistant, it is not obvious $H′$ also is collision resistant. Finding two different messages that both share the same prefix, and collide in the last $n−8$ bits, requires less work and less storage than finding a collision in all $n$ bits of $H$.
Jun 1	comment	can we do double encryption of a message without first key? Public key encryption schemes have the kind of trap-door functionality you seem to be asking for. Are you looking for a specific scheme with the exact functionality you are asking for (or just something similar), and can it be based on a trap-door function such as RSA?
Jun 1	comment	Best way to create password manager passwordsafe.sourceforge.net
May 31	comment	What do recent announcements about solving the DLP in $GF(2^{6120})$ mean for RSA The quote is perhaps a bit misleading. The intended meaning was probably "Furthermore, if you can solve DLP for any arbitrary composite moduli, you can also solve it for prime moduli." The word "any" matters in so far that the DLP problem is differently hard in different groups, and the hardness is not just a function of the bit length of the modulus.
May 31	comment	How to test if a number is a primitive root? If $p$ is a safe prime, then the order of any $g \in \mathbb Z^*_p$ will be either 1, 2, $p-1 = 2q$ or $(p-1)/2 = q$.
May 30	comment	What is a definition of a nonce? A common way to generate an unpredictable IV for CBC is to simply encrypt the counter value before using it as IV. The IV doesn't have to be random; pseudo-random is fine.
May 30	comment	What is a definition of a nonce? The link on the Wikipedia page is good: cs.ucdavis.edu/~rogaway/papers/nonce.pdf The example in the introduction of that paper is to use a counter as nonce.
May 30	comment	What is a definition of a nonce? In this case Wikipedia is right. Nonce = number used once. It does not have to be generated at random, in fact, generating at random might cause repetitions, with a probability that is a function of the bit length of nonce.
May 30	comment	What is a definition of a nonce? en.wikipedia.org/wiki/Cryptographic_nonce - "In security engineering, nonce is an arbitrary number used only once in a cryptographic communication"
May 29	comment	Do recent announcements about solving the DLP in $GF(2^{6120})$ apply to schemes proposed for cryptographic use? Right, there is more to it.
May 29	comment	Do recent announcements about solving the DLP in $GF(2^{6120})$ apply to schemes proposed for cryptographic use? Good question, but isn't it a bit hard to answer "no", considering that anyone might both propose and recommend virtually anything?
May 28	comment	Why RSA uses {d,n} as private key instead of {e,n}? If the public exponent is selected uniformly from $\mathbb Z_{\phi((p-1)(q-1))}^*$, it doesn't matter which exponent you call $e$ and which you call $d$, just as long you keep the private one consistently private.
May 28	comment	Why is verification using DSA slower than verification with RSA? @fgrieu: Yes, you are right. The reason the number of multiplications was one off, is because most algorithms also include a multiplication by one, which obviously might be optimized away.