CodesInChaos
Reputation
14,540
102/100 score
 May 19 revised How can a block cipher in counter mode be a reasonable PRNG when it's a PRP? added 29 characters in body May 19 comment How can a block cipher in counter mode be a reasonable PRNG when it's a PRP? If you like that nitpicky stuff, you might enjoy reading about the "foundations of hashing" problem and why random oracles can't be fully realized using random oracles. Rogaway - Formalizing Human Ignorance, Canetti, Goldreich, Halevi - Random Oracle Methodology, Revisited, Bernstein, Lange - Non-uniform cracks in the concrete, etc. May 19 comment How can a block cipher in counter mode be a reasonable PRNG when it's a PRP? @Anon2000 Cryptographers almost always deal with indistinguishability, so the distinction between "real" and "indistinguishable from real" is only made in formal contexts, such as security proofs. For example we don't assume that AES is a PRP, we merely assume it's indistinguishable from one. Cryptography is all about reducing the probability of undesirable outcomes so much that they don't matter in practice. May 19 comment How can a block cipher in counter mode be a reasonable PRNG when it's a PRP? @Anon2000 The size of the values is irrelevant, as you already noted, you could concatenate 2 64 bit values to obtain a full block. What matters how much data you output. The security claim for CTR mode is something like "The output is indistinguishable from random data as long as you observe significantly less than $2^{n/2}$ blocks and you don't have enough computational power to bruteforce the key". If you really care, you can quantify that as the probability of distinguishing the random data from the output given the total size of the outputs and the available computational power. May 19 revised How can a block cipher in counter mode be a reasonable PRNG when it's a PRP? added 88 characters in body May 19 revised How can a block cipher in counter mode be a reasonable PRNG when it's a PRP? added 169 characters in body May 19 answered How can a block cipher in counter mode be a reasonable PRNG when it's a PRP? May 19 comment Does this chat protocol exist? The protocol looks silly. The server can passively sniff the traffic between A and B. With a proper protocol the server would have to impersonate A or B, which risks detection if A and B compare their public keys (or a SAS) out of band. May 19 revised Building a combined encryption scheme from two encryption schemes that's secure if at least on of them is secure added 36 characters in body May 19 comment On composition of encryption schemes May 19 comment Building a combined encryption scheme from two encryption schemes that's secure if at least on of them is secure Related question: On composition of encryption schemes (same OP) May 19 comment Building a combined encryption scheme from two encryption schemes that's secure if at least on of them is secure Gen is clearly the key generation algorithm. Mathematically encryption is often modeled as a tuple of three algorithms, key generation, encryption and decryption. The combined scheme will invoke the two individual key generation algorithms in its key generation algorithm, using the tuple/concatenation of the two individual keys as its key. May 19 revised Building a combined encryption scheme from two encryption schemes that's secure if at least on of them is secure edited tags; edited tags May 19 revised Building a combined encryption scheme from two encryption schemes that's secure if at least on of them is secure added 526 characters in body; edited tags; edited title May 19 revised Building a combined encryption scheme from two encryption schemes that's secure if at least on of them is secure added 526 characters in body; edited tags; edited title May 19 revised Building a combined encryption scheme from two encryption schemes that's secure if at least on of them is secure rolled back to a previous revision May 18 comment Does Ed25519 support cryptographic threshold signatures? Ed25519 includes $R$ in the message hash. Does that cause problems for the threshold scheme? May 18 revised Inversion Free Direct Conversion between Twisted Edwards (X,Y,Z) and Montgomery (X,Z) added 133 characters in body May 18 answered Inversion Free Direct Conversion between Twisted Edwards (X,Y,Z) and Montgomery (X,Z) May 11 comment ECC vs RSA: how to compare key sizes? 1) The number can't be right. 2048 bits RSA roughly corresponds to a 112 bit symmetric key or a 224 bit ECC key. 2) You wrote a + in the RSA formula where it should be a *. 3) The RSA formula is asymptotic, but you need concrete cost for the comparison.