9,854 reputation
12450
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 3 months
seen 7 hours ago

Sep
6
comment Why does FIPS 186-4 require specific sizes for keys?
Larger sizes certainly won't hurt security. But restricting the sizes might simplify some implementations.
Sep
6
revised What does $\to$ mean in the following definition of a block cipher?
added 63 characters in body; edited tags; edited title
Sep
5
comment What is the most secure key expansion routine?
@John You could take a look at sosemanuk, which uses serpent as key expansion.
Sep
5
revised Why is Rijndael key length restricted?
edited tags
Sep
5
comment Why is Rijndael key length restricted?
Probably because the designer didn't see a point in supporting keys larger than 256 bits. It's not like a conventional computer will ever brute-force 256 bits, and even with a quantum computer it's pretty expensive.
Sep
4
comment Would xoring 2 independant AES CTRs to produce p-rand introduce vulnerabilities?
Meet-in-the-middle means that this isn't stronger against brute-force than single AES in some popular cost models. (Not sure if they are realistic models)
Sep
4
comment Would xoring 2 independant AES CTRs to produce p-rand introduce vulnerabilities?
You should fix your notation so that different variables get different symbols. (e.g. $k_1$ and $k_2$). With its current definition your function is simply zero.
Sep
4
comment Is this correct way to generate stream cipher using AES CTR mode?
Note that even without key-reuse, using a fixed IV enables multi-target attacks. Not a big issue with AES-256, but something I'd avoid with AES-128.
Sep
3
comment Encryption-Decryption-Encryption
@poncho 20 seconds too slow :)
Sep
3
comment Encryption-Decryption-Encryption
Related: Why do we use encrypt-decrypt-encrypt (EDE) in 3DES, rather than encrypting three times?
Sep
3
revised Entropy of the key
added 7 characters in body
Sep
3
comment What is the exact purpose of length padding in Merkle–Damgård hash functions?
BLAKE uses a similar technique, but combines it with a traditional padding. In Blake2 we replaced the traditional padding with zeros since that's simpler, still secure and reduces the number of compression function calls if the message length is an integral number of blocks (important for tree hashing).
Sep
3
comment What is the exact purpose of length padding in Merkle–Damgård hash functions?
Normal compression functions have two inputs, the chaining value and the message block. Skein uses a tweakable compression function which has a third input. It uses this input to signal the end of the message end of the message, preventing length extension attacks. It also uses it to pass a kind of block counter to each compression, so a unique compression function is used for each position in the hash, which improves second pre-image resistance compared to MD hashes. Take a look at the Skein paper, it's pretty readable.
Sep
3
comment What is the exact purpose of length padding in Merkle–Damgård hash functions?
MD has a security reduction for the collision resistance of the whole hash to the collision resistance of the compression function. This reduction relies on the message length being part of the padding. For details, check the question I linked as duplicate of this one.
Sep
3
comment What is the exact purpose of length padding in Merkle–Damgård hash functions?
MD hashes do put the length into the padding. I interpret the question as asking why they use the length in the padding instead of a simpler padding, like the one you suggest. My favourite hashes (Skein and Blake2) use even simpler padding (just zeros) and use a different mechanism of signaling the end of the message.
Sep
3
comment What is the exact purpose of length padding in Merkle–Damgård hash functions?
But that doesn't explain why the padding contains the length of the message. At least that's how I understand the question, but it's so vague that your interpretation of "why is padding used" might also be what the OP wants.
Sep
3
comment What is the exact purpose of length padding in Merkle–Damgård hash functions?
Clearly including the length of the message in the padding in Merkle-Damgaard hashes does not prevent length extension attacks since they are vulnerable to this attack.
Sep
3
revised Why does the padding in Merkle–Damgård hash functions like MD5 contain the message length?
edited tags; edited title
Sep
3
comment Entropy of the key
1) Just search for a proof for additivity of Shannon entropy. This is such a basic property that you should find plenty. 2) 0.9954 is the entropy per bit. The entropy of the whole is obviously 1000 times that value.
Sep
3
revised Entropy of the key
added 6 characters in body