9,505 reputation
12347
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 1 month
seen 9 hours ago

Oct
12
reviewed Approve suggested edit on Implementing AES encryption for firmware distribution system
Oct
12
reviewed Approve suggested edit on Cryptanalysis of S-DES - Equations
Oct
12
reviewed Approve suggested edit on Design criteria for AES
Oct
12
reviewed Approve suggested edit on Simulation-based security?
Oct
12
comment Why does Skein use an output transform, but other similar hashes don't?
Part of the answer might be that the block-cipher in blake has twice the hash-size, whereas in skein they're equal.
Oct
11
comment Encryption algorithm which produces comparable results for substrings
I think it's easy to show that monoalphabetic substitution is the only kind of cipher that has this property.
Oct
11
comment Stream ciphers based on discrete logs
Do you know the concrete security claims of proof? For example for BBS, the non-tight reduction in the proof lead to a huge modulus that's practically unusable.
Oct
11
comment Stream ciphers based on discrete logs
Not directly DL based, but based on the related DH problem: Dual_EC_DRBG. The infamous backdoored PRNG.
Oct
11
comment Encryption algorithm which produces comparable results for substrings
In particular, I suspect it's possible to show that the only kind of cipher that offers this property is a substitution cipher that works on single characters.
Oct
11
comment Encryption algorithm which produces comparable results for substrings
If I understand your desired property correctly, then the inherent weaknesses of that property lead to far too weak encryption.
Oct
11
revised Encryption algorithm which produces comparable results for substrings
deleted 55 characters in body
Oct
11
comment What's the difference between a Key Derivation Function and a Password-Hash?
There are two kinds of KDF, the slow, strengthening kind fed by a password(e.g. PBKDF2), and a fast one that only derives secondary keys from a master key(e.g. HMAC). The second one obviously shouldn't be used for password hashing.
Oct
11
comment Hash function from narrower block cipher operated in CBC-encryption mode?
The problem is that those constructions require a sufficient block size. In practice 256 or 512 bits. I think fgrieu's premise is a block size that's smaller than the desired hash size. | Additionally when you use such a construction with AES, it might expose AES's key schedule weaknesses.
Oct
11
comment How to encrypt a short string and keep the length secret
@Erik Consider adding authentication/a MAC. Without authentication you can't detect modifications of the data, and in some cases(padding oracle) modifications can be used to decrypt your data interactively.
Oct
11
comment How to encrypt a short string and keep the length secret
@Marcin That's very application dependent. In some cases it doesn't matter much, in others it can be fatal. A simple case could be distinguishing "yes" and "no" in a stream mode. Or as practical example, a recent attack on TLS was based on exposing the length of a compressed text.
Oct
11
comment Avalanche noise RNG for one-time pad use
You're wrong about the MAC. Encrypt-then-MAC ensures that the MAC doesn't leak anything about the plaintext. | As a side-note: There are provably secure MACs(search for universal hashing or Wegman-Carter) even for computationally unbound attacks. They obviously still have small finite chance of failing to detect a manipulation, but that chance is independent from the attackers computational power. (Assuming the underlying key-stream is perfectly secure.)
Oct
9
comment Is it possible to pick your Ed25519 public key?
If such a thing existed, "multiplicative inverse" would be an appropriate name. The problem is that there is no such thing as $B^{-1}$ and don't think there is an operation that can multiply two points on a curve, like you do in $AB^{-1}$. You can only multiply scalars and a scalar with a curve-point.
Oct
9
comment How is it possible to parallelize a hashing function to crack an iteratively hashed password?
I can't see any practical difference between PBKDF2 and his scheme. It doesn't make sense to build a rainbow table for the OPs scheme, just like it doesn't make sense for PBKDF2. In both cases the salting makes rainbow tables useless.
Oct
9
comment How is it possible to parallelize a hashing function to crack an iteratively hashed password?
He uses a salt on the first iteration.
Oct
9
comment Attack by replaying messages
@HeatfanJohn Both the use of nonces and that no forged packet can disrupt the connection.