Henrick Hellström

2,606 reputation

1311

bio	website
	location
	age
visits	member for	1 year, 3 months
	seen	10 mins ago
stats	profile views	29

	2,606 reputation	bio	website		visits	member for	1 year, 3 months
1311 badges		location			seen	10 mins ago

summary answers questions tags badges favorites bounties reputation activity

181 Comments

suggestions reviews revisions comments badges posts accepts all

May 8	comment	*What does $(\mathbb{Z}_n^)^2$ mean?** @RickyDemer: Me too, but I consulted my text books in mathematics. The * symbol means "excluding zero", and does not necessarily entail that all elements are invertible under the implied operation. For instance, $(\mathbb Z^*,\cdot)$ means the set of non-zero integers under multiplication, which has all properties of a group except invertibility. I don't know what is the correct way of denoting the subgroup of integers relatively prime to the modulus.
May 7	comment	Are digital signatures secure for signing lots of small messages? You might want to pay close attention to exactly what "authentic" means in this context. It just means that the sender at some point in time, indeed signed a message with particular contents. Hence, replay attacks might be a concern in similar scenarios. If you need to know when and in response to what request the sender signed the message, the sender will have to sign that information too.
May 5	comment	how much is secure to encrypt a password using itself (as encryption key) for storing it on a unsecure media? Is there any particular reason you want to use AES for this (such as it is the only cryptographic algorithm implemented on the device and you can't implement anything else, such as some hash algorithm and password based key derivation schemes)?
May 4	comment	encrypt message with one digest 0-9 instead of 01-26 Yes, that would work, in theory. Think of it like this: At each position the attacker sees a cipher text value in the range 0..99. The attacker guesses a plain text value in the range 1..26. Since, for each guessed plain text value, there is exactly one possible key value in the range 0..99 that is consistent with the guessed plain text value, seeing the cipher text does not provided the attacker with additional information regarding the plain text. Hence, you got perfect secrecy, presuming the key values are equiprobable, independent and never repeat.
May 3	comment	encrypt message with one digest 0-9 instead of 01-26 ISTM that you are asking if using a Vigenère cipher en.wikipedia.org/wiki/Vigen%C3%A8re_cipher, where you restrict the key to only contain any of the first ten letters in the alphabet, is as secure as using a Vigenère cipher, where the key might contain any of the 26 letters of the alphabet. Is that correct?
May 3	comment	Knowing a valid salted hash for an unknown secret, is it possible to compute another valid hash? @ClaudioFloreani: The opposite, with the algorithms in my answer, anyone can take a valid $d = r\|h$ value and compute a new $d' = r\|r'\|h'$ value. If you want someone to be able to do this without any of the secret information involved in the original operation, anyone can do it. OTOH, if you want someone to be able to compute a new hash without all of the secret information, you need additional secret information. That changes your question completely.
May 2	comment	Knowing a valid salted hash for an unknown secret, is it possible to compute another valid hash? @fgrieu: I see. Well, calling the new salt $x$ or $r'$ shouldn't technically matter. What would make my answer invalid, would be a restriction of the length of the salt part $r$ of $d$, or a restriction that if $d \neq d'$, then there doesn't exist a sub-exponential function $f$ that would allow the derivation of $r$ from $d'$ or $r'$ from $d$.
May 1	comment	Why does key generation take an input $1^k$, and how do I represent it in practice? While it is correct that $k$ usually represents the amount of desired cryptographic strength is desired from the key generation algorithm, it seems it might represent any parameter that might cause some other aspect of the scheme to grow exponentially. Confer e.g. crypto.stackexchange.com/a/7853/1564
May 1	comment	What does the expression $1^n$ mean as a function argument? let us continue this discussion in chat
May 1	comment	Perfect secrecy Proof Have you tried using a straight logical proof, using the definition $Pr(A\|B) = Pr(A \& B)/Pr(B)$?
May 1	comment	What does the expression $1^n$ mean as a function argument? @D.W.: I think we should make a distinction between "valid attributes" and "numerically possible attribute values". I meant the former, istm you mean the latter. My point is that if you accept more than $2^n$ different attributes as valid in the sense that you accept more than $n$ predicates, you still can't use the numerical methods outlined in the paper for selecting attributes that combine more than $n$ predicates at a time - you will end up with an overdetermined equation system if you try to select an attribute for $n+1$ predicates.
May 1	comment	What does the expression $1^n$ mean as a function argument? @D.W.: Unless my math is completely off, there can't be $N^n$ possible disjoint attribute values, due to the way the predicates and attributes are combined, using a dot vector product in $\mathbb Z_N$. If the dot vector product evaluates to $0$, the predicate is "included" in the attribute. Assuming both attribute hiding and information theoretic security, the number of independent predicates and attributes are bounded by the number of linear equations that would be required to solve unknown predicates, which is $n$.
May 1	comment	What does the expression $1^n$ mean as a function argument? @D.W.: There is more to it. The parameter $n$ is not just an empty place holder that only exists in the security parameter $1^n$, but represents the number of dimensions in the formal attribute set $\mathbb Z_N^n$. Confer page 3.
May 1	comment	Perfect secrecy Proof How do you define "perfect secrecy"? As $Pr(m\|c) = Pr(m)$?
Apr 24	comment	What does “securely realize” mean? Generally, if the author of the paper defines the meaning of that phrase or provides a footnote with a reference, the phrase is intended to have specific technical meaning, otherwise probably not.
Apr 21	comment	Is encrypting a single 128 bit block with AES ECB “safe” The latter, but it is an intriguing question on its own. Is it generally possible to break collision resistance of a Merkle-Damgaard chaining of a Davies-Meyer construct that is built around a compression function that is not pseudo random?
Apr 20	comment	Chain several RSA encryptions without increasing the message size @user2301771: Sorry, but you still haven't explained why you are asking (which IMO is important in order to give an adequate reply). Is it out of purely theoretical-mathematical interest, or is this something you actually want to do in practice? In the latter case, why?
Apr 20	comment	Is encrypting a single 128 bit block with AES ECB “safe” SHACAL-2 (i.e. the compression function of SHA-256) is a block cipher with a 256 bit block, which was approved e.g. by NESSIE. FWIW, considering the security proof of the Davies-Meyer construct, I presume SHACAL-2 might be assumed to be a secure block cipher if SHA-256 might be assumed to be a CSOWHF.
Apr 20	comment	Chain several RSA encryptions without increasing the message size If you want any kind of suggestion about what would be secure to do, you have to explain exactly why you want to RSA encrypt some RSA cipher text. If I may guess you are either trying to invent some kind of counter signature scheme, or are using RSA in a block chaining mode, in both cases for which there are other recommended practices.
Apr 19	comment	What is the best way to store sensitive information on the client? In addition to what fgrieu wrote above, if your strongest requirement is to get cryptographic guarantees for some aspect of your application, it sounds from your description your architecture needs to be reworked more or less from scratch.