10,257 reputation
12452
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 5 months
seen yesterday

Apr
17
comment Why is $h(H, m) = E(m, H) \oplus m$ insecure?
What exactly is the definition of $H$ and $E$? I guess $H$ is the IV or chaining value, and $E$ some form of encryption, but which? In particular which parameter is the key, and which the message? And is it AES, a PRP, or an ideal blockcipher?
Apr
16
comment Is it safe to assume Salsa20 to be a PRP?
Salsa20 takes 16 constant bytes for a reason. While it's build from a permutation, that permutation has some limitations and it has no key.
Apr
16
comment Is it safe to assume Salsa20 to be a PRP?
The random function is produced by xoring a permutation with with its input, similar to the way block ciphers are turned into hashes.
Apr
14
comment How to use salt if I am sending hashed password?
@IvanP 1. If you want to avoid username probing, you can return HMAC(FakeSaltKey, username). A random value isn't possible since for real users the salt will not change often. 3. There is only a single stored value Hash(SaltedHash(salt, password)).
Apr
14
comment Comprehension question on a signature protocol based on the RSA assumption
How about linking the paper?
Apr
14
answered How to use salt if I am sending hashed password?
Apr
13
comment Is there an existing AEAD scheme with minimal IV requirements?
You can in principle describe AES-CBC with encrypted IV + an IV-less MAC (CBC-MAC or HMAC) as an AEAD. I think it'd fulfill your requirements.
Apr
12
comment Pseudo Random Generator (PRG) from Rabin function
Looks like I'll need to look up the details of how to compute the order again. I thought $x^{\lambda(n)}=x \pmod n$ holds.
Apr
12
revised Pseudo Random Generator (PRG) from Rabin function
added 328 characters in body
Apr
12
revised Pseudo Random Generator (PRG) from Rabin function
added 328 characters in body
Apr
12
comment Pseudo Random Generator (PRG) from Rabin function
A better choice of modulus. The product of two large primes (say 512 bits each) should do the job.
Apr
12
answered Pseudo Random Generator (PRG) from Rabin function
Apr
12
comment Pseudo Random Generator (PRG) from Rabin function
Your immediate problem is the unfortunate choice of the modulus.
Apr
12
comment Pseudo Random Generator (PRG) from Rabin function
Might not cause your immediate problem, but should use a BigInteger class instead of Math.Pow and double.
Apr
10
answered AES Message Authentication Vulnerability
Apr
8
comment May the problem with DES using OFB mode be generalized for all feistel ciphers
Your argument only works if reversing the subkeys has no effect.
Apr
8
revised “Weaknesses” in SHA-256d?
edited body
Apr
7
comment How fast can a wrong decryption key be detected using ECC?
Typically ECC is not used for encryption at all. It's only used to determine a symmetric key that's used with a symmetric cipher to do the actual encryption. Your question depends on the choice of the symmetric encryption scheme and on the nature of the plaintext.
Apr
7
revised “Weaknesses” in SHA-256d?
added 1029 characters in body
Apr
7
answered “Weaknesses” in SHA-256d?