1,390 reputation
413
bio website
location
age
visits member for 2 years, 11 months
seen Jul 3 at 0:18

Jul
12
comment The probability of finding a limited set of collisions for HMACSHA256
I beleive the latest best consensus among hash function cryptographers is that SHA-2-256 or HMAC[SHA-2-256] is secure against collisions for all practical work and for the forseeable future, with the possible exception of some major major breakthroughs in quantum computing. If you want to be even more conservative, you could use SHA-2-512/256 which is an even more recent NIST standard.
Jul
6
comment Cryptographic Challenge: How to Say Something Confidentially to Snowden?
Well the point is to make it as little "about trust" as possible. Is it possible that someone could replace the President of $country with a very similar-looking actor and get away with it for awhile on TV? Saddam tried but I don't think he fooled any experts for long. You could impose a short time window on the attacker to forge a convincing video. Next to having Poitras and Greenwald as trusted introducers (ruled out in question), I suspect high resolution video is probably still the best you can get.
Jul
5
comment Cryptographic Challenge: How to Say Something Confidentially to Snowden?
Yes, I did not mean to imply that plaintext was free of authentication problems, just that if we could solve the identity and authentication problems we have well established solutions for message confidentiality and integrity.
Jul
5
comment Cryptographic Challenge: How to Say Something Confidentially to Snowden?
It's identity. Who is Snowden? Is he real? I've only seen evidence of him on this same screen I'm typing this on. Via news reports, mostly @ggreenwald. This is a valuable clue. The only way forward is for Snowden to authenticate a key exchange using what we have: media reports. But it would have to be an activity that was hard to forge. For example consider the news headline: "In rare appearance at airport Snowden performs interpretive dance spelling out the letters 546215007a39af41a445812170f41142238e62bf (Video on Youtube)".
Mar
29
comment Can a user of a password-protected Wi-Fi sniff on other user's communication?
When I've looked into wifi hacking, it sounds like a pretty common technique is to DoS the client over the air until it drops and reconnects. I believe this allows the attacker to observe the nonces exchanged at the initial handshake.
Mar
21
comment Is the SILC protocol still used?
Probably mpOTR would be a better choice for new usage.
Jan
7
comment Implementation of Tao Xie and Denguo Feng's MD5 attack
No, he asked about a specific attack. The link you posted is from 2005.
Dec
14
comment What does SSL use? RSA? El-Gamal? Elliptic curves?
DSA is based on El-Gamal, so you could use DSA certificates. But you're right, no one does.
Sep
11
comment How do I construct a 256-bit hash function from 128-bit AES?
I had to do this years back for something inconsequential. I'm sure that what I came up with is crappy. Thankfully, what I though was inconsequential back then remains inconsequential today, but that is notoriously hard to predict in advance. Other times that has not been the case.
Sep
11
comment How do I construct a 256-bit hash function from 128-bit AES?
You feel that 'Hirose - Some Plausible Constructions of Double-Block-Length Hash Functions' iacr.org/archive/fse2006/40470213/40470213.pdf is insufficiently vetted?
Sep
1
comment How are constructs with data-dependent swaps and rotations cryptanalyzed?
If only I could have accepted both answers. Instead, I flipped a fair coin.
Sep
1
comment How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?
I think it's an interesting question and one that every user of cryptography outside of the US Government itself must be asking. While it's true that an organization such as the NSA gives up very little information about its capabilities (and the question could be more general and apply to all such organizations) the amount of information is non-zero. Even in the absence of information, the question degenerates to another interesting and important question: why should we have confidence that algorithm X is secure in principle?
Aug
28
comment If a cryptanalytic breakthrough is made, what process should be followed?
First of all, you should never assume that you're the only party that knows about it.
Aug
28
comment If a cryptanalytic breakthrough is made, what process should be followed?
I think there's enough history and data at this point that we can say full disclosure is a good principle and default course of action. Generally the only parties opposed to it are those who actually want (perversely) the vulnerable state to persist longer.
Aug
26
comment Does MD5 generate 128 independent bits?
I'm far from an expert on this topic, but it seems to me that MD5 is completely deterministic, so when does it even make sense to ask about its stochastic properties? E.g., maybe in an attack context we could state something in terms of the absence of any (tractable) expression to constrain the input domain only slightly but that significantly modifies the distribution of some expression made from the output (or output and input) bits.
Aug
26
comment Does MD5 generate 128 independent bits?
Hmm, if the input is "random and at least of the output size" even the identity function achieves independence among the output bits. Is that a reasonable constraint for any useful interpretation of the question? The other extreme of two inputs seems like a better interpretation for crypto.se. An adversarial environment probably needs to be concerned with the worst case.
Aug
26
comment If a cryptanalytic breakthrough is made, what process should be followed?
@PaĆ­lo I agree that the field of cryptography needs to be able to discuss attacking and defending in a completely abstract way, using the terminology such that it's unloaded from the ethics of any particular human situation. More often than not, it's the real-world defender who benefits from the 'attack' research anyway. Nevertheless, it's probably not a good idea for any researcher to be completely oblivious to the real-world implications of their research. It think it's an important (even if maybe a little far-fetched) question that needs to be asked. If not here, then where?
Aug
24
comment Is HTTPS secure if someone snoops the initial handshake?
@David Let's not assume it isn't broken, or that there aren't some conditions in the fine print somewhere that have to be satisfied in order to actually realize the implied security.
Aug
24
comment Looking for cryptographic secure hash algorithm(s) that produces identical root hash for differently sliced hash list
Why do you want to know if two users upload the same file if you don't know the content of the file? You can't exactly give the ciphertext from one user back to another without also giving him the decryption key.
Aug
22
comment Dictionary attack on pass-phrases on common algorithms
Except that XKCD is showing a four word pass phrase at 44 bits of entropy by choosing 4 words from a 2^11 entry dictionary. He's not saying it's more secure because of the plain string length.