Reputation
12,198
Next tag badge:
89/100 score
20/20 answers
Badges
1 30 60
Newest
 Yearling
Impact
~205k people reached

Dec
22
revised Best hash-algorithm
deleted 1 character in body
Dec
22
revised Why shouldn't I use ECB encryption?
deleted 16 characters in body
Dec
22
comment Why shouldn't I use ECB encryption?
@Rogue AES-GCM is a decent choice. Note however that it breaks horribly if you ever reuse a nonce/IV.
Dec
22
comment Why shouldn't I use ECB encryption?
ECB does not only leak if messages are identical. It leaks which message blocks (typically 16 bytes) are identical.
Dec
21
comment Can a cryptosystem be unconditional secure if the same key $k \in \mathcal K$ is used for more than one encryption?
You can combine shamir's secret sharing with a one-time-pad to arrive at a scheme that's perfectly secure as long as you're able to generate a unique nonce for each message. Unfortunately the running time is quadratic in the maximum number of messages you can send. This does not free you from the above size limitation, but it doesn't require you to keep track of which parts of the key you already used,
Dec
21
comment Can a cryptosystem be unconditional secure if the same key $k \in \mathcal K$ is used for more than one encryption?
It's certainly necessary that the size of the key must be at least the total size of the messages.
Dec
21
comment The purpose of the final xor in Davies–Meyer scheme
I'm talking about a DM compression function in an iterated hash like the Merkle-Damgard construction. If the message is limited to a single block, then the MitM does not apply. And DM in MD doesn't xor with a constant, it xors with the chaining state. The chaining state is only a constant for the first block.
Dec
21
comment Why is feed-forward mechanism used in hash functions?
MD vs sponge is of little relevance. If the primitive of an iterated hash is reversible the MitM attack applies and you thus need a wide pipe to achieve full preimage resistance.
Dec
21
comment The purpose of the final xor in Davies–Meyer scheme
1) The MitM attack only works if the message consists of at least two blocks. You start with the initial state and call the encrypt function with 2^64 messages and you start with the desired hash and apply the decrypt function about 2^64 times. Once you got the same value out of both directions, you met in the middle and have completed your preimage attack. 2) Using DM with AES is a bad idea since it allows attacker controlled keys, something AES does not handle well.
Dec
21
comment The purpose of the final xor in Davies–Meyer scheme
The key size does not affect the cost of the MitM attack against a Davies-Meyer without Feed-Forward hash. It's the block size that determines the attack. A naive MitM against AES-256 in DM without FF would cost 2^64 memory and 2^64 AES invocations (parallelizable). But I believe the standard memory reduction techniques (distinguished points, cycle finding,...) apply, so the memory use should be much lower
Dec
21
comment The purpose of the final xor in Davies–Meyer scheme
I don't get your point. The cost of the MitM depends on the size of the chaining value (block size of the cipher) and works if the message consists of two blocks (where the block size of the hash function is the key size of the underlying blockcipher). To avoid the attack you need to have a chaining value which is at least twice the size of the desired pre-image resistance.
Dec
21
comment Find private exponent in RSA
Do you know the prime factors of the modulus?
Dec
21
answered Best hash-algorithm
Dec
21
comment Alternative encryption algorithm
What properties do you need? ChaCha is enjoying increased popularity, but being a stream cipher it's not suitable for every application. Depending on the application, authenticated encryption may be a better choice than plain encryption.
Dec
19
comment The purpose of the final xor in Davies–Meyer scheme
It enables a meet-in-the-middle attack, reducing pre-image resistance. Keccak suffers from this attack, which is why its preimage resistance is only half the capacity.
Dec
18
comment What would be the best plain text Cryptography method without the use of a computer?
See Is there any strong enough pen-and-paper or mind cipher?
Dec
18
revised Polynomial division hardware implementation
added 46 characters in body
Dec
18
revised Finding a collision for a hash function
added 1 character in body
Dec
18
comment Dancing confusion with Daniel J. Bernstein's stream ciphers
If you have a per session key, you still need a counter to distinguish messages. If you have a per message key (like noise) you don't need a nonce at all. If your protocol fits random nonces, use ciphers which support that. Choosing or designing a good protocol is the important part, choosing between Salsa20 and ChaCha a minor detail.
Dec
18
comment Dancing confusion with Daniel J. Bernstein's stream ciphers
For a random nonce you need XChaCha or XSalsa20. Finding an XChaCha implementation and making sure it's correct will be harder than finding a correct XSalsa20 implementation. So if you need long/random nonces, Salsa20 might be preferable over ChaCha.