502 reputation
311
bio website
location
age
visits member for 2 years, 9 months
seen 2 days ago

Dec
5
comment In cryptographic protocols, what protects against an attacker dropping messages?
@e-sushi You can spare me the condescending tone. My first quote from your answer was on its own line, stated in quite an unequivocal way. Whether you use tickets or sequence numbers to detect replays, reorderings, drops, etc, is beside my point (still I wonder why you insist on calling what the OP has clearly identified as being 'sequence numbers' 'tickets'?) -- which was simply that the message sequence given by the OP would actually be accepted by some cryptographic protocols. I just wanted to add this point to an otherwise good answer, and see no need to provide another one myself.
Dec
5
comment In cryptographic protocols, what protects against an attacker dropping messages?
@e-sushi Hmm, I must say that I find your comment a bit insidious. When I mentioned 802.11 I reasonably expected this to be understood in the context of cryptography (i.e. the RSNA part of the spec, and in particular CCMP). In what world CCMP, or (D)TLS for that matter, would not be consider cryptographic protocols, while Kerberos would be is beyond me. Ironically that your link to Kerberos itself states: "Kerberos is a computer network authentication protocol".
Dec
5
comment In cryptographic protocols, what protects against an attacker dropping messages?
@e-sushi "Under no circumstances should message #236 be trusted." This is actually not correct, and not the way things are handled by certain standards like 802.11 and DTLS. E.g. in 802.11 a packet is accepted as long the sequence number is strictly larger then the currently maintained receive counter (i.e. it doesn't have to be the exact following number). Likewise, in DTLS, they allow a sliding window implementation, in which case the packet with sequence number #236 would be accepted (given that the MAC checks out ofc).
Sep
24
comment Is there any area where AES-CBC cannot be used ? If so, why ?
"TLS uses CBC, but by default it uses CBC before authentication" - don't you mean the opposite here? I.e., TLS employs MAC-then-Encode-then-Encrypt. The way you have phrased it, it sounds like it's using Encrypt-then-MAC.
Jun
22
comment What does it mean for an adversary to run in PPT?
Regarding the last question. Within the field of computational complexity theory it's commonly believed that the class of problems solvable by probabilistic PT machines is strictly larger than the class of problems solvable by deterministic PT machines. That is, we strongly believe (note, however, that this is not formally proved) that P $\subsetneq$ BPP, hence, if we can prove something secure against an attacker in BPP, we've also automatically shown it secure against an attacker in P.
Apr
5
comment For a one-time pad, which MAC method is information-theoretically secure?
@lightspeeder Note that all the attacks mentioned in that paper are based on real-world schemes where the key is reused for many messages. I suggested a one-time polynomial MAC's for which none of these attacks apply. Since you have already insisted on using a one-time pad for encryption, why not for the MAC as well?
Apr
4
comment For a one-time pad, which MAC method is information-theoretically secure?
Why do you insist on using HMAC as your authentication mechanism? And more importantly, do you really need to use a one-time pad? Anyway, if unconditional security is your goal for integrity, why not go with a one-time polynomial-based MAC?
Mar
31
comment Any field in a PKI certificate where some text info can be stored?
You are probably aware of this already, bu the nsComments extension is also deprecated according to the OpenSSL docs: "The following extensions are non standard, Netscape specific and largely obsolete. Their use in new applications is discouraged."
Feb
2
comment The difference between these 4 breaking Cipher techniques?
[About CPA]: "this is the strongest type of attack possible". This is false. CCA is a stronger attack model than CPA. Furthermore, there exists attack models even stronger than CCA, for instance related-key models.
Jan
19
comment RSA cipher wrong use
Regarding applying unpadded RSA, that's already answered here: crypto.stackexchange.com/a/10155/1772
Sep
10
comment Question about Fermat's little theorem
@Alex For the left-to-right implication in the first equivalence to hold true, you should probably add that $p \nmid a$.
May
30
comment What are the requirements of a nonce?
...what I'm trying to say is that, I think that a definition of a nonce should not impose ANY other requirements other than that it should not be used more than once. This does not forbid you from putting additional constraints on it.
May
30
comment What are the requirements of a nonce?
You asked for a definition of a nonce, and I provided what I consider to be the "right" notion; namely a value which is simply not used more than once (that's it!). Unfortunately there's much ambiguity in how the terms nonce and IV's are used in practice. So you might see several sources calling the first input to CBC-mode a nonce, whereas I would have preferred calling it an IV.
Apr
19
comment PKC McEliece + $S$ + $P$
As per your own Wikipedia link: $S$ is simply any invertible binary $k \times k$ matrix, and $P$ is any $n \times n$ permutation matrix. What is it that you find unclear?
Mar
16
comment Proof of the standard pseudorandom generator + XOR encryption scheme in Goldreich
Exactly the answer I was looking for, thx! It's funny though: I had done exactly the same thing as you, including the consideration of the "triangle" inequality. But, when I got to your last equation, I couldn't figure out where that $1/2$ factor should come from. However, its good too see that I wasn't to far of :)
Feb
28
comment Is SHA-1 still practical secure under specific scenarios?
I think it should be mentioned that the security guarantees given by that HMAC-paper is disputed. See Another Look at HMAC and the youtube presentation Another look at provable security. While controversial, they do bring up relevant points to the practical (security) merit of the Bellare paper.
Feb
16
comment How can an S-Box be reversed?
I think you should make it clear that S-boxes often ARE invertible. For instance, the S-box in AES is invertible. @Liam Inverting S-boxes can be very easy: you simply create a lookup table that reverse all the possible substitutions of the S-box. E.g. if the S-box maps 0xA5 to 0x3F (this would be an 8x8 S-box), then the inverse transformation would map 0x3F to 0xA5. Thus, you simply enumerate all the possible values the S-box can have, and create an inverse table that "undoes" all those transformations (this effectively limits how large the S-boxes can be in practice).
Feb
15
comment Encrypting a key with the same key
@madhukar2k2 "I tried searching for an answer for the above, but couldnt not find one." - try looking at circular security, it might give you some answers. Additionally, I've added some things in my answer below.
Jan
23
comment Why is MixColumns omitted from the last round of AES?
Ah, apparently my vote has been locked in, so I'm unfortunately not able to change my downvote. Sorry about that :(
Jan
23
comment Why is MixColumns omitted from the last round of AES?
Ok, fair enough. I will remove my downvote when the timeout has passed. Still, since many modes of operation allows you get away with only the encryption direction, I don't understand why an equal RoundFunction wouldn't be preferable for all rounds (Ref. Fixee's comment about the hassle's of the last round omission, in his answer to PulpSpy's answer)