Reputation
994
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
4 11
Newest
 Yearling
Impact
~13k people reached

Dec
10
comment Are parts of a pseudorandom string also a pseudorandom string?
@Lemon Yes, you are absolutely on the right track. See also my update.
Nov
27
comment How to check if a function is significant or not?
@user3193259 Yes it is going to zero. However, it is decreasing very slowly. On your graph it will seem like it is never going towards zero, because for $f(n)$ to be less than, say $1 / 10$, you would need to set $n > 10^{100}$ (with log = base 10)!
Nov
26
comment How to check if a function is significant or not?
@user3193259 The base doesn't matter, it is still going to 0 in the limit (see e.g. here)
Nov
26
comment How to check if a function is significant or not?
@user3193259 You have $f(n) = \frac{1}{\sqrt{\log n}}$ right? This function goes to 0 as $n \rightarrow \infty$. Of course it will never be exactly 0, that is why we are calling it a limit. I know that you were asking about whether it was negligible or not, I just wanted to clarify which function you meant, since you said that it did not tend to 0, which got me confused.
Nov
26
comment How to check if a function is significant or not?
As far as I can tell $f(n)$ do tend towards 0 for $n \rightarrow \infty$. Did you perhaps mean a different function?
Oct
19
comment What Diffie-Hellman parameters should I use?
I second the recommendation for elliptic curve DH over 2048-bit DH. Maybe you could add this to your answer?
Aug
26
comment Clarification of RFC2246 with regards to Finished Message
Is there a particular reason for why you are using the TLS 1.0 spec and not the TLS 1.2 spec?
Aug
7
comment Are deployed MACs IND-CPA?
And to partially answer your question: Yes, some deployed MACs are also PRFs. Like e.g. HMAC.
Aug
7
comment Are deployed MACs IND-CPA?
First, the IND-CPA game is meant for encryption schemes not MAC's. Secondly, in the IND-CPA game the adversary does not submit one message and gets back two ciphertexts. It's the other way around :-) I.e., he submits two messages and gets back the encryption of one of them. Thirdly, it seems to me now then, that the security notion you should be looking at regarding the MACs is PRF.
Aug
7
comment Are deployed MACs IND-CPA?
I'm a little confused by your title. The security notion usually targeted by MACs is unforgeability against a chosen message attacks (UF-CMA), not IND-CPA. It is not clear to me what it should mean for a MAC to satisfy IND-CPA. When you say that you want the MAC tag to be "random looking" did you mean this in the sense of the MAC being a PRF? Still, note that a MAC does not necessarily have to be a PRF in order to be UF-CMA (a PRF is a secure MAC though). Moreover, it is not necessary for the tag to be "random looking", as you say, in order for an AE scheme to be IND-CPA/IND-CCA secure.
Aug
6
comment Why does WPA-PSK not use Diffie-Hellman key exchange?
@Joost I agree with you. I have updated the answer accordingly. Hopefully this is more on point.
Apr
19
comment Prove there is PRG that is not necessarily one-to-one
@MaartenBodewes Please see the edit. Does that look OK?
Dec
5
comment In cryptographic protocols, what protects against an attacker dropping messages?
@e-sushi You can spare me the condescending tone. My first quote from your answer was on its own line, stated in quite an unequivocal way. Whether you use tickets or sequence numbers to detect replays, reorderings, drops, etc, is beside my point (still I wonder why you insist on calling what the OP has clearly identified as being 'sequence numbers' 'tickets'?) -- which was simply that the message sequence given by the OP would actually be accepted by some cryptographic protocols. I just wanted to add this point to an otherwise good answer, and see no need to provide another one myself.
Dec
5
comment In cryptographic protocols, what protects against an attacker dropping messages?
@e-sushi Hmm, I must say that I find your comment a bit insidious. When I mentioned 802.11 I reasonably expected this to be understood in the context of cryptography (i.e. the RSNA part of the spec, and in particular CCMP). In what world CCMP, or (D)TLS for that matter, would not be consider cryptographic protocols, while Kerberos would be is beyond me. Ironically that your link to Kerberos itself states: "Kerberos is a computer network authentication protocol".
Dec
5
comment In cryptographic protocols, what protects against an attacker dropping messages?
@e-sushi "Under no circumstances should message #236 be trusted." This is actually not correct, and not the way things are handled by certain standards like 802.11 and DTLS. E.g. in 802.11 a packet is accepted as long the sequence number is strictly larger then the currently maintained receive counter (i.e. it doesn't have to be the exact following number). Likewise, in DTLS, they allow a sliding window implementation, in which case the packet with sequence number #236 would be accepted (given that the MAC checks out ofc).
Sep
24
comment Is there any area where AES-CBC cannot be used ? If so, why?
"TLS uses CBC, but by default it uses CBC before authentication" - don't you mean the opposite here? I.e., TLS employs MAC-then-Encode-then-Encrypt. The way you have phrased it, it sounds like it's using Encrypt-then-MAC.
Jun
22
comment What does it mean for an adversary to run in PPT?
Regarding the last question. Within the field of computational complexity theory it's commonly believed that the class of problems solvable by probabilistic PT machines is strictly larger than the class of problems solvable by deterministic PT machines. That is, we strongly believe (note, however, that this is not formally proved) that P $\subsetneq$ BPP, hence, if we can prove something secure against an attacker in BPP, we've also automatically shown it secure against an attacker in P.
Apr
5
comment For a one-time pad, which MAC method is information-theoretically secure?
@lightspeeder Note that all the attacks mentioned in that paper are based on real-world schemes where the key is reused for many messages. I suggested a one-time polynomial MAC's for which none of these attacks apply. Since you have already insisted on using a one-time pad for encryption, why not for the MAC as well?
Apr
4
comment For a one-time pad, which MAC method is information-theoretically secure?
Why do you insist on using HMAC as your authentication mechanism? And more importantly, do you really need to use a one-time pad? Anyway, if unconditional security is your goal for integrity, why not go with a one-time polynomial-based MAC?
Feb
2
comment The difference between these 4 breaking Cipher techniques?
[About CPA]: "this is the strongest type of attack possible". This is false. CCA is a stronger attack model than CPA. Furthermore, there exists attack models even stronger than CCA, for instance related-key models.