Reputation
Top tag
Next privilege 250 Rep.
View close votes
Badges
6
Newest
 Scholar
Impact
~1k people reached

  • 0 posts edited
  • 0 helpful flags
  • 123 votes cast
Oct
6
comment Probabalistic Polynomial-time Algorithms & One-way functions
By definition $A$ is computed by a probabilistic poly-time Turing machine, and such a machine can make coin-tosses to compute its result(s). So $A$ is not randomly generated, but instead a mechanism that make random choices. And the proportion of random choices $A$ makes that lead to inverting $f$ must be small (negligible).
Sep
20
accepted Determining if a ciphertext can be decrypted
Sep
15
comment Determining if a ciphertext can be decrypted
Thanks for the additional material, it's very useful. Would it also be safe to use a cryptographic hash of the secret key as tag, or, alternatively, pad the plaintext with the secret key, or a cryptographic hash of the secret key before encryption?
Sep
14
comment Determining if a ciphertext can be decrypted
Yes, I can use any protocol I like, including plain or encrypted identifiers. But I'm not a cryptographer, I am worried that I overlook something. I wonder if such a scheme has been described in the literature, e.g. as a Dolev-Yao style description in Applied-pi? I will need to produce a formal security proof, so would like to read the existing work.
Sep
14
comment Determining if a ciphertext can be decrypted
@SEJPM I share your intuition. I will have to make a formal security proof, so I would like to look at other people's work that has explicitly looked at this.
Sep
14
comment Determining if a ciphertext can be decrypted
I could definitely add message integrity, but it's not needed in my use-case, so would appear to be overkill. In some sense I am looking at the minimal technology needed to solve the problem.
Sep
14
comment Determining if a ciphertext can be decrypted
Thanks. Unfortunately, in my use-case I really do not know what session a message belongs to. I get just opaque ciphertext on the shared channel. I also have to deal with compressed plaintext and plaintext which really is cyphertext, so looking at byte distribution is not an option. Indeed I expect that almost all the messages I see are made from random plaintext.
Sep
14
comment Determining if a ciphertext can be decrypted
@SEJPM Tagging and then trail decryption is the obvious thing to do. But not being a cryptographer, I'm mortally afraid of overlooking attacks on this scheme. Has this scheme ever been described formally? In particular, there is a certain probability that this mechanism yields a false positive. I will need to have a good handle on such failure probabilities for my use case.
Sep
14
comment Determining if a ciphertext can be decrypted
@otus I have no concrete adversary model in mind. I would be interested in good models. I have edited the question accordingly.
Sep
14
revised Determining if a ciphertext can be decrypted
added 94 characters in body
Sep
14
revised Determining if a ciphertext can be decrypted
edited tags
Sep
14
asked Determining if a ciphertext can be decrypted
Jul
6
awarded  Scholar
Jul
6
accepted Formal definition of (perfect) forward security/secrecy
Jun
30
awarded  Commentator
Jun
30
comment Formal definition of (perfect) forward security/secrecy
That's what I think too, but I was told that I needn't worry, that perfect forward security does not even allow retroactive decryption. The person who told me that was then unable to produce the relevant security definition. Whence my question here.
Jun
30
comment Formal definition of (perfect) forward security/secrecy
Legisation has a direct effect on the applicability of the threat model. For example if session key have to be stored, as I belive they would have to in the UK, then a threat-model that assumes adversaries cannot get hold of ephemeral key material would be inappropriate.
Jun
28
comment Formal definition of (perfect) forward security/secrecy
Thank you. My application is quite simple, I want to understand precisely what it means that e.g. Google is using perfectly forward secure encryption of my communications. I suspect that it does not mean much given the requirements of various legislations to store relevant meta-data.
Jun
28
asked Formal definition of (perfect) forward security/secrecy
Jun
28
awarded  Informed