1,390 reputation
413
bio website
location
age
visits member for 2 years, 11 months
seen Jul 3 at 0:18

Aug
22
comment Is digest=HASH(HASH(a)+HASH(b)) equivalent to publishing two digests?
They're only 20 bit strings. You can sort those even in a language without loops.
Aug
22
comment Dictionary attack on pass-phrases on common algorithms
@gokoon English is, effectively, a small list of words.
Aug
18
comment How long would the 100 Year Cryptography Project have secured its data had it been started 100 years ago?
The point about things being qualitatively different back when crypto was all military secrets is well-taken. Nevertheless, world-class experts were certainly collaborating in teams within the scope of their own secrecy, which could still be quite impressive. (Bletchley Park cf. Eurocrypt 2011 anyone?) Collaboration in a restricted scope certainly has disadvantages, but being well-funded and focused has its own advantages too. Is it any more unfair of a question to them than to those attempting such a project today? Maybe, perhaps.
Aug
18
comment How long would the 100 Year Cryptography Project have secured its data had it been started 100 years ago?
For a question that cannot be answered, I found that to be a pretty interesting answer. :-) It was intended to be a bit ambitious and open-ended.
Aug
18
comment Are these emerging threats against AES affecting your designs?
I think the "100 year crypto" concept is cool enough that it should be exempt from the usual advice about appropriately-sized functions. Isn't that sort of the point? Hmm, I think I'm going to open a question about this...
Aug
11
comment How should I calculate the entropy of a password?
@this.josh If you expect the attacker to expect you to use some positions more than others, yes. Whether or not that's a good expectation is an interesting discussion. There is said to be a government agency using a password restriction of "if there is only one letter or special character, it should not be either the first or last character". I wrote a blog post a while back on this extendedsubset.com/?p=18
Aug
11
comment How should I calculate the entropy of a password?
Perhaps you could put it like this: entropy exists from the perspective of some party. To the user who knows their password, the password has zero entropy. But usually the party we're discussing the entropy is some hypothetical attacker. If you were to show him the password one symbol at a time, how much new information (in units of bits) would he learn as he sees each one arrive in turn? So the entropy is about the generation of the password insofar as we expect the attacker to know the method, but not the values, of that generation process.
Aug
11
comment Properties of PRNG / Hashes
So I was right that NIST wouldn't like "a1 = hash(seed), a2 = hash(seed + a1), ...", their approved method is somewhat more complex and does involve counters. I was wrong thinking that NIST wouldn't like a recursive SHA-1 PRNG at 160*2^80 bits output, AFAICT they don't allow anything to output more than 2^67 bits!
Aug
11
comment Properties of PRNG / Hashes
Sorry for the confusion, let me try again: For a given seed, the PRNG we're discussing recursively evaluates a hash function on its own output. When this recursion count approaches the Collision Resistance of the function, it risks colliding with one of its previous outputs. So our expectation for such a PRNG is that its cycle length will have an upper bound determined by the HF's CR. Looking at NIST SP 800-90, Hash_DRBG uses both counters and recursive HF application, and still places very conservative limits on the allowed output (< 2^48 reqs even for SHA-512)
Aug
10
comment How can I improve a password generation scheme based on a shared secret and URL?
As a point of reference, this guy golubev.com/hashgpu.htm is doing 5.8e9 MD5s per second on an off-the-shelf CPU+GPU box. That might translate into 1.8e9 SHA-1s per second. Better pick a strong password!
Aug
9
comment Properties of PRNG / Hashes
Agreed, 2^80 output blocks under the same key is not worth losing sleep over. But why would you even do it that way when the CTR-mode PRNG is no more expensive? On NIST, I read them saying (in their 2007 request for SHA-3 candidate submissions): "The 160-bit hash value produced by SHA–1 is becoming too small to use for digital signatures, therefore, a 160-bit replacement hash algorithm is not contemplated." This suggests to me that they would frown upon "only" 2^80 collion resistance in a new design. They even commissioned a function with a 512-bit output size too.
Aug
7
comment Why isn't the alternating step generator used more often?
My Google searches turned up a related patent web hit, but the linked web page didn't have 'Gunther' in it. It was in Google's result summary though. I had to view source in order to find it!
Aug
7
comment Properties of PRNG / Hashes
OK, I'll buy that about the cycle length.
Aug
6
comment Properties of PRNG / Hashes
They certainly don't impose the memory overhead of a Mersenne Twister.
Aug
6
comment Is the logic for how the enigma machine worked documented somewhere?
Perhaps this is what you want: Simulator "A recurring theme in my Inbox is people asking for the enigma wheel wiring so that they can write their own simulator. To save repetition, this web page contains the information you will need if you want to build yourself a simulator."
Aug
6
comment Properties of PRNG / Hashes
@D.W. Well I didn't mean to say that 2^80 was an imminent security problem - but there are certainly many users who wouldn't accept it in a new design either, e.g., NIST. Also -- I didn't believe that paper either. So I tested it with exhaustive and Monte Carlo analysis on much smaller (and likely much more ideal) random functions. My results suggested that, if anything, the effect was understated a bit. Here's some links to the ensuing discussion (including some source): bit.ly/oOe8tX bit.ly/rn3my3 My feeling about 2^64 wasn't based on the analytic collisions...just 160/2.5.
Aug
6
comment Properties of PRNG / Hashes
@Paŭlo I don't get your 'by this argument...'. A string comparison algorithm can be easily demonstrated to be O(N) with just a few small observations, whereas a 512-bit counter will simply not ever roll over to needing a second block. Only in practice, not theory, of course. :-)
Aug
6
comment What is the general justification for the hardness of finding preimages for cryptographic hash functions?
Sure, eprint.iacr.org/2006/254 and eprint.iacr.org/2010/285 for example. What's most interesting though is how the attitudes towards SAT seems to have changed in just 4 years. From (literally) "We expect SAT solvers to find new applications as a validation and testing tool of practicing cryptanalysts" to "We found preimages for some reduced versions and showed that full function is secure against the presented attack."
Aug
5
comment How can SSL secure a two-way communication with only one key-pair?
Netscape developed SSL 2.0 which is now all-but-abandoned. SSL 3.0 was developed and Netscape evaporated and handed stewardship of the protocol spec to the IETF who promptly renamed it TLS 1.0 (to fit their nomenclature). SSL 3.0 and TLS 1.0 are nearly identical. Nobody (give or take) uses TLS 1.1 or 1.2. The use of Diffie-Hellman to agree upon an ephemeral key is an option that client and server may choose to agree upon, but it's totally an option and not preferred by most sites due to the computational expense.
Aug
4
comment Properties of PRNG / Hashes
Yeah, if you don't pay the incremental costs before the entire universe burns out, I consider it O(1). Guess I'm a coder, not a mathematician. :-)