507 reputation
310
bio website
location
age
visits member for 2 years, 7 months
seen 13 hours ago

Sep
24
comment Is there any area where AES-CBC cannot be used ? If so, why ?
"TLS uses CBC, but by default it uses CBC before authentication" - don't you mean the opposite here? I.e., TLS employs MAC-then-Encode-then-Encrypt. The way you have phrased it, it sounds like it's using Encrypt-then-MAC.
Jul
2
awarded  Curious
Jun
22
comment What does it mean for an adversary to run in PPT?
Regarding the last question. Within the field of computational complexity theory it's commonly believed that the class of problems solvable by probabilistic PT machines is strictly larger than the class of problems solvable by deterministic PT machines. That is, we strongly believe (note, however, that this is not formally proved) that P $\subsetneq$ BPP, hence, if we can prove something secure against an attacker in BPP, we've also automatically shown it secure against an attacker in P.
Jun
20
awarded  Revival
Jun
19
revised Flaw in the security definition of *Stateful* Authenticated Encryption?
added 64 characters in body
Jun
19
revised Flaw in the security definition of *Stateful* Authenticated Encryption?
Complete rewrite of the question, removing the distracting notion of length-hiding, and focusing on a different then previously.
Apr
5
comment For a one-time pad, which MAC method is information-theoretically secure?
@lightspeeder Note that all the attacks mentioned in that paper are based on real-world schemes where the key is reused for many messages. I suggested a one-time polynomial MAC's for which none of these attacks apply. Since you have already insisted on using a one-time pad for encryption, why not for the MAC as well?
Apr
4
comment For a one-time pad, which MAC method is information-theoretically secure?
Why do you insist on using HMAC as your authentication mechanism? And more importantly, do you really need to use a one-time pad? Anyway, if unconditional security is your goal for integrity, why not go with a one-time polynomial-based MAC?
Mar
31
comment Any field in a PKI certificate where some text info can be stored?
You are probably aware of this already, bu the nsComments extension is also deprecated according to the OpenSSL docs: "The following extensions are non standard, Netscape specific and largely obsolete. Their use in new applications is discouraged."
Mar
20
revised McEliece key size
Mixed up the distance d of the code with t = (d-1) / 2
Mar
20
answered McEliece key size
Mar
17
awarded  Yearling
Feb
2
comment The difference between these 4 breaking Cipher techniques?
[About CPA]: "this is the strongest type of attack possible". This is false. CCA is a stronger attack model than CPA. Furthermore, there exists attack models even stronger than CCA, for instance related-key models.
Jan
19
comment RSA cipher wrong use
Regarding applying unpadded RSA, that's already answered here: crypto.stackexchange.com/a/10155/1772
Jan
7
answered Flaw in the security definition of *Stateful* Authenticated Encryption?
Nov
27
answered Why does WPA2-PSK use 4-way handshake instead of 2-way handshake
Nov
24
revised Flaw in the security definition of *Stateful* Authenticated Encryption?
added 29 characters in body
Nov
24
asked Flaw in the security definition of *Stateful* Authenticated Encryption?
Oct
30
revised Can you help me understand this strange implication direction in security reduction for OAEP 3-round?
edited title
Oct
30
asked Can you help me understand this strange implication direction in security reduction for OAEP 3-round?