Reputation
612
Top tag
Next privilege 750 Rep.
See vote count; VIP usercard
Badges
4 11
Newest
 Yearling
Impact
~8k people reached

1d
awarded  Yearling
1d
answered Prove there is PRG that is not necessarily one-to-one
1d
answered Fault-based transition for crypto proof (a la Shoup) with big probability of fault - does it work?
Apr
10
revised Prove that if we redefine the key space, we can assume Gen chooses a key uniformly
deleted 1 character in body
Apr
9
revised Prove that if we redefine the key space, we can assume Gen chooses a key uniformly
deleted 1 character in body
Apr
9
answered Prove that if we redefine the key space, we can assume Gen chooses a key uniformly
Mar
20
revised MAC in SSH packet encryption, benefits to not including it?
added 2 characters in body
Mar
19
answered MAC in SSH packet encryption, benefits to not including it?
Mar
9
accepted Flaw in the security definition of *Stateful* Authenticated Encryption?
Dec
6
awarded  Self-Learner
Dec
5
comment In cryptographic protocols, what protects against an attacker dropping messages?
@e-sushi You can spare me the condescending tone. My first quote from your answer was on its own line, stated in quite an unequivocal way. Whether you use tickets or sequence numbers to detect replays, reorderings, drops, etc, is beside my point (still I wonder why you insist on calling what the OP has clearly identified as being 'sequence numbers' 'tickets'?) -- which was simply that the message sequence given by the OP would actually be accepted by some cryptographic protocols. I just wanted to add this point to an otherwise good answer, and see no need to provide another one myself.
Dec
5
comment In cryptographic protocols, what protects against an attacker dropping messages?
@e-sushi Hmm, I must say that I find your comment a bit insidious. When I mentioned 802.11 I reasonably expected this to be understood in the context of cryptography (i.e. the RSNA part of the spec, and in particular CCMP). In what world CCMP, or (D)TLS for that matter, would not be consider cryptographic protocols, while Kerberos would be is beyond me. Ironically that your link to Kerberos itself states: "Kerberos is a computer network authentication protocol".
Dec
5
comment In cryptographic protocols, what protects against an attacker dropping messages?
@e-sushi "Under no circumstances should message #236 be trusted." This is actually not correct, and not the way things are handled by certain standards like 802.11 and DTLS. E.g. in 802.11 a packet is accepted as long the sequence number is strictly larger then the currently maintained receive counter (i.e. it doesn't have to be the exact following number). Likewise, in DTLS, they allow a sliding window implementation, in which case the packet with sequence number #236 would be accepted (given that the MAC checks out ofc).
Sep
24
comment Is there any area where AES-CBC cannot be used ? If so, why ?
"TLS uses CBC, but by default it uses CBC before authentication" - don't you mean the opposite here? I.e., TLS employs MAC-then-Encode-then-Encrypt. The way you have phrased it, it sounds like it's using Encrypt-then-MAC.
Jul
2
awarded  Curious
Jun
22
comment What does it mean for an adversary to run in PPT?
Regarding the last question. Within the field of computational complexity theory it's commonly believed that the class of problems solvable by probabilistic PT machines is strictly larger than the class of problems solvable by deterministic PT machines. That is, we strongly believe (note, however, that this is not formally proved) that P $\subsetneq$ BPP, hence, if we can prove something secure against an attacker in BPP, we've also automatically shown it secure against an attacker in P.
Jun
20
awarded  Revival
Jun
19
revised Flaw in the security definition of *Stateful* Authenticated Encryption?
added 64 characters in body
Jun
19
revised Flaw in the security definition of *Stateful* Authenticated Encryption?
Complete rewrite of the question, removing the distracting notion of length-hiding, and focusing on a different then previously.
Apr
5
comment For a one-time pad, which MAC method is information-theoretically secure?
@lightspeeder Note that all the attacks mentioned in that paper are based on real-world schemes where the key is reused for many messages. I suggested a one-time polynomial MAC's for which none of these attacks apply. Since you have already insisted on using a one-time pad for encryption, why not for the MAC as well?