Reputation
11,235
Next tag badge:
97/100 score
18/20 answers
Badges
1 25 57
Newest
 Informed
Impact
~181k people reached

1h
reviewed Approve El Gamal Decryption with Big Numbers
1h
reviewed Reviewed Why are there only positive value points on an elliptic curve?
1h
revised Why are there only positive value points on an elliptic curve?
added 79 characters in body
4h
comment Are more S boxes more secure in a SP-Network?
1) The increased pressure on the CPU cache might be more expensive than what you gain from being able to reduce the number of rounds. 2) You can't add special s-box instructions to the CPU if there are many sboxes (see AES-NI)
9h
comment Can cycle finding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?
Working on a prototype implementation, I noticed that my assumptions about how iterated hashes cycle were wrong. I didn't know that a few cycles and their tails dominate.
21h
comment Evidence of practical differential cryptanalysis attacks
Not a cipher, but the MD5 collisions were due to differential cryptoanalysis.
1d
comment Can cycle finding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?
You can't just equate the number of operations with time, you also need to take parallelism into account. (And DJB argues that you can't neglect the cost of memory access circuitry for many attacks either.) With cycle-finding I'd expect the cost of memory to be cheap compared to the cost of all those parallel DES computation circuits. For example such a computer might have ~4 GB of memory and $2^{20}$+ DES circuits, running for ~$2^{36}$ timesteps (where each timestep is one DES invocation).
1d
reviewed Approve Can cycle finding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?
1d
reviewed Close Creating of finite field over small prime number for Elliptic Curve
1d
reviewed No Action Needed If you hashed a hash an infinite number of times would you end up with a unique hash?
1d
reviewed No Action Needed Password length versus hash length?
1d
reviewed No Action Needed Key iteration count while using random keyfile larger than master key
1d
comment Can cycle finding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?
1) In the simplest case we could truncate. If we need a tweak to repeat the whole experiment with a different hash function (not sure if that's required) we can use any kind of tweakable hash (preferably a cheap one) 2) I don't think the block-size matters at all with most modes of operation (including ECB, CBC and CTR). We simply need a long enough known plaintext/ciphertext pair.
1d
comment Why does applying 56-bit DES twice only give 57 bits of security?
@fgrieu I originally planned to verify the technique experimentally with small keys before posting about it, but since I don't have the time for that at the moment, I've asked it as a question: Can cycle findinding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?
1d
asked Can cycle finding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?
1d
revised SHACAL-2 vs. AES as underlying block cipher for Secure Hash (aka SHA-256)
added 185 characters in body
2d
comment SHACAL-2 vs. AES as underlying block cipher for Secure Hash (aka SHA-256)
@EvgeniVaknin Depends on the hardware. AES will probably be faster than SHACAL-2 on most processors. But on processors without AES-NI the difference will be smaller than the ratio of the number of rounds. You also need to keep in mind that a hash gives an attacker much more control over the inputs, so the same block cipher might need more rounds when used as hash compared to being used as encryption.
2d
revised SHACAL-2 vs. AES as underlying block cipher for Secure Hash (aka SHA-256)
added 121 characters in body
2d
comment SHACAL-2 vs. AES as underlying block cipher for Secure Hash (aka SHA-256)
You can use AES to build a secure MAC (CBC MAC and its derivatives). Unlike your suggestion, these constructions use AES with a random key, which the attacker doesn't know.
2d
answered SHACAL-2 vs. AES as underlying block cipher for Secure Hash (aka SHA-256)