Reputation
11,601
Next tag badge:
97/100 score
18/20 answers
Badges
1 25 57
Newest
 Informed
Impact
~188k people reached

42s
revised Why does TLS do Authenticate-then-Encrypt instead of Encrypt-then-Authenticate?
added 768 characters in body
6m
revised Why does TLS do Authenticate-then-Encrypt instead of Encrypt-then-Authenticate?
added 768 characters in body
15m
answered Why does TLS do Authenticate-then-Encrypt instead of Encrypt-then-Authenticate?
20h
comment Curve41417 example
Your example is mod $10^8$. So how is it supposed to relate to Curve41417?
23h
comment Huffman encoding of hashes
If order doesn't matter, you can sort them and then compress the first few bytes, which rarely change between hashes.
May
21
comment one-way deterministic hash for low entropy input?
Your construction offers no advantage over computing HMAC(key, id) on a trusted device, relying on its rate limiting features and on key being unextractable.
May
19
comment How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?
I wouldn't say that the original version was incorrect, it just didn't mention an important limitation.
May
19
comment prevent padding oracle attack on key exchange process
OAEP should be safe from padding oracles, as long as you use a good implementation. Alternatively you can forget about padding and simply use a random plaintext hashed to derive a key. (RSA-KEM is based on this principle)
May
19
revised How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?
added 1120 characters in body
May
19
revised How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?
added 29 characters in body
May
19
comment How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?
If you like that nitpicky stuff, you might enjoy reading about the "foundations of hashing" problem and why random oracles can't be fully realized using random oracles. Rogaway - Formalizing Human Ignorance, Canetti, Goldreich, Halevi - Random Oracle Methodology, Revisited, Bernstein, Lange - Non-uniform cracks in the concrete, etc.
May
19
comment How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?
@Anon2000 Cryptographers almost always deal with indistinguishability, so the distinction between "real" and "indistinguishable from real" is only made in formal contexts, such as security proofs. For example we don't assume that AES is a PRP, we merely assume it's indistinguishable from one. Cryptography is all about reducing the probability of undesirable outcomes so much that they don't matter in practice.
May
19
comment How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?
@Anon2000 The size of the values is irrelevant, as you already noted, you could concatenate 2 64 bit values to obtain a full block. What matters how much data you output. The security claim for CTR mode is something like "The output is indistinguishable from random data as long as you observe significantly less than $2^{n/2}$ blocks and you don't have enough computational power to bruteforce the key". If you really care, you can quantify that as the probability of distinguishing the random data from the output given the total size of the outputs and the available computational power.
May
19
revised How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?
added 88 characters in body
May
19
revised How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?
added 169 characters in body
May
19
answered How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?
May
19
comment Exist this chat protocol?
The protocol looks silly. The server can passively sniff the traffic between A and B. With a proper protocol the server would have to impersonate A or B, which risks detection if A and B compare their public keys (or a SAS) out of band.
May
19
revised Building a combined encryption scheme from two encryption schemes that's secure if at least on of them is secure
added 36 characters in body
May
19
comment On composition of encryption schemes
Related question: Building a combined encryption scheme from two encryption schemes that's secure if at least on of them is secure (same OP)
May
19
comment Building a combined encryption scheme from two encryption schemes that's secure if at least on of them is secure
Related question: On composition of encryption schemes (same OP)