9,791 reputation
12449
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 2 months
seen 1 hour ago

Sep
3
comment What is the exact purpose of length padding in Merkle–Damgård hash functions?
MD hashes do put the length into the padding. I interpret the question as asking why they use the length in the padding instead of a simpler padding, like the one you suggest. My favourite hashes (Skein and Blake2) use even simpler padding (just zeros) and use a different mechanism of signaling the end of the message.
Sep
3
comment What is the exact purpose of length padding in Merkle–Damgård hash functions?
But that doesn't explain why the padding contains the length of the message. At least that's how I understand the question, but it's so vague that your interpretation of "why is padding used" might also be what the OP wants.
Sep
3
comment What is the exact purpose of length padding in Merkle–Damgård hash functions?
Clearly including the length of the message in the padding in Merkle-Damgaard hashes does not prevent length extension attacks since they are vulnerable to this attack.
Sep
3
revised Why does the padding in Merkle–Damgård hash functions like MD5 contain the message length?
edited tags; edited title
Sep
3
comment Entropy of the key
1) Just search for a proof for additivity of Shannon entropy. This is such a basic property that you should find plenty. 2) 0.9954 is the entropy per bit. The entropy of the whole is obviously 1000 times that value.
Sep
3
revised Entropy of the key
added 6 characters in body
Sep
3
comment Entropy of the key
For the first 5 bits it's $P(0)=1$ and $P(1)=0$, for the other 995 bits it's $P(0)=0.5$ and $P(1)=0.5$.
Sep
3
answered Entropy of the key
Sep
3
comment Entropy of the key
It's not a one-time pad if the key is not randomly and uniformly generated.
Sep
1
revised Are partial hashes used in cryptographic protocols?
edited tags
Aug
29
reviewed Approve suggested edit on Why do new versions of TLS use an explicit IV for CBC suites?
Aug
28
comment Repeatable crypto
1) AES-SIV 2) convergent encryption AKA message locked encryption AKA content-hash-key (CHK). Be sure to include a convergence secret, to avoid the confirmation and learning the remaining information attacks
Aug
28
answered Why are some key stretching methods better than others?
Aug
28
reviewed Leave Open Security of very simple XOR with random?
Aug
28
reviewed Leave Open RSA was rejected by which journal?
Aug
27
comment Is hashing a list of hashes safe?
There is one common pitfall: In hashtrees you often need to tag leaves and inner notes differently, to ensure an unambiguous tree structure. You didn't include enough context to know if this applies to your scheme as well, but I suspect that you need to use different prefixes when hashing a list of hashes and when hashing a plain file.
Aug
27
comment Is using EAX mode with a 64-bit block cipher a bad idea?
@owlstead 1) I don't get your question. In my comment I worry about birthday attacks, and D.W.'s answer confirms that the proof of security breaks down as you approach the birthday bound. So we're saying pretty much the same thing, except that D.W. wasn't too lazy to look at the details. 2) As a software guy, a cipher not being available doesn't enter my considerations. There are so many good ciphers that I certainly wouldn't bother with a 64 bit cipher, unless I specifically want one. For my taste even 128 bit blocks are a bit on the low side, I prefer 256 bit blocks.
Aug
26
comment Are variable-length crypto hash functions still susceptible to collisions?
You don't gain any collision resistance by increasing the output size beyond the capacity. A chain is only as strong as its weakest link, and the link between each consumed block is the capacity.
Aug
26
comment Partial hash code protocol for security tokens providing signatures
One link I found: community.oracle.com/thread/1751753 which mentions an APDU format.
Aug
26
answered Proving Non-Existence of ECC Backdoors