9,417 reputation
12345
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years
seen 1 hour ago

Feb
28
comment Is SHA-1 collision free on data up to 20 bytes long?
@mikeazo 1) I used exist in the mathematical sense, where you can show that something exists, without being able to actually construct it. (If the claim that there are collisions is actually true, then there exists a short proof for their existance) 2) Not with probability 1. You need $2^{160}+1$ in the worst case. But it's quite unlikely it will need more than $2^{90}$ operations.
Feb
28
comment Is SHA-1 collision free on data up to 20 bytes long?
@mikeazo Technically the proof exists, but it's very expensive ($2^{80}$ invocations) to find it.
Feb
28
comment Efficient Symmetric Mutual Entity Authentication Protocol
When you use passwords as shared secrets, an important property of a such a protocol is not exposing the shared secret to offline search (against passive attackers).
Feb
28
comment Is SHA-1 collision free on data up to 20 bytes long?
With the way we typically construct symmetric primitives the fastest way to prove it, is finding a collision with these properties, and that requires $2^{80}$ work. What's clear is that an ideal 160 bit hashfunction does have collisions with length 20 (with overwhelming probability), and we have not the tiniest amount of evidence suggesting that SHA-1 so broken that it doesn't have this property.
Feb
28
comment Is SHA-1 collision free on data up to 20 bytes long?
Most likely not. See Is SHA-512 bijective when hashing a single 512-bit block?. The same arguments apply to SHA-1.
Feb
28
awarded  hash
Feb
27
comment Is SHA-1 still practical secure under specific scenarios?
I wouldn't use SHA-1 in any situation where MD5 is broken i.e. when some form of collision resistance is required.
Feb
27
comment Is SHA-1 still practical secure under specific scenarios?
Are you talking about HMAC with a key that's unknown to the attacker?
Feb
27
comment How to efficiently generate a stream of independent, but biased random bits?
Actually an output bit has only 0.72 bits of entropy.
Feb
27
comment When do ECC patents end?
My impression is that as long as you use a software implementation of a prime curve without point compression, you're probably not violating any patents. (As usual IANAL applies)
Feb
27
comment When do ECC patents end?
See Can ECC be used without infringing on patents?
Feb
27
comment When do ECC patents end?
A lot depends on how ECC is used. Most patents cover specific aspects which many implementations don't use at all.
Feb
27
awarded  Nice Answer
Feb
27
revised Can I find two specific words with the same md5 hash?
deleted 5 characters in body
Feb
26
comment Padding always the same, problem or not?
If your messages are always a multiple of 16 bytes, you don't need padding at all.
Feb
26
answered Can I find two specific words with the same md5 hash?
Feb
25
answered Turning a cipher into a hashing function
Feb
25
comment Turning a cipher into a hashing function
CBC can be used to turn a cipher into a MAC, but not into a has. In particular if the attacker knows the key for a CBC-MAC, he can trivially find collisions/pre-images.
Feb
24
revised Why is triple-DES using three different keys vulnerable to a meet-in-the-middle-attack?
added 62 characters in body
Feb
23
comment Fastest multiplication algorithm for efficient exponentiation in C++?
How large are you numbers? For typical crypto sizes schoolbook multiplications are still pretty popular. These alternative algorithms only pull ahead for larger numbers.