70 reputation
5
bio website
location
age 28
visits member for 2 years, 2 months
seen Jan 5 '13 at 7:36

Nov
20
comment Is there an authenticated encryption scheme where the recipient can attribute the message to a single sender?
I was mostly asking the question because even though AE provides 'authentication', it only provides authentication that someone in the trusted group produced the message. Whereas digital signatures provide authentication that a particular key holder produced the message.
Nov
20
comment Is there an authenticated encryption scheme where the recipient can attribute the message to a single sender?
I should have clarified... I only wanted non-repudiation for it's unspoofable identification properties (barring a stolen key), not for the claim that the signer cannot reneg on a promise contained in the payload. I realize that a fully-fledged non-repudiation system would really require physical witnesses and a trusted third party (much like a notary in real life). In a cryptography only approach, anyone could claim "Oh, my keys were stolen, but I didn't know about it at the time. I didn't sign that."
Nov
20
comment Is there an authenticated encryption scheme where the recipient can attribute the message to a single sender?
The same symmetric key as the one used to encrypt the payload, which of course you can't verify until decryption, which is a flaw. I was assuming that the symmetric key is a shared secret. Though you're actually right about the commitment for another reason, too. Simply signing the ciphertext allows an existential forgery where the attacker can intercept the blob, strip the signature, and then resign with any other private key as anyone else in the system.
Nov
19
comment Is there an authenticated encryption scheme where the recipient can attribute the message to a single sender?
Looking for a combination... you wouldn't usually want to encrypt a large piece of data using only asymmetric keys, anyway, since it would be incredibly slow. Which is why you would typically use a stream cipher and the block cipher key would be protected with the asymmetrical key, allowing you to transmit a long encrypted text to a recipient with only their public key without taking ages to encrypt/decrypt...
Nov
19
comment Is there an authenticated encryption scheme where the recipient can attribute the message to a single sender?
Do the same issues with MAC-then-encrypt apply to sign-then-encrypt? (e.g. crypto.stackexchange.com/questions/202/…) Though I suppose it could be sign-then-Authenticated Encryption.
Nov
19
comment Is there an authenticated encryption scheme where the recipient can attribute the message to a single sender?
Not enough why? If the signature encapsulates the ciphertext then if the signature is valid, then the ciphertext has not been modified, which means the signer must have used the same symmetric key. Unless I'm misunderstanding something...
Nov
19
comment Is there an authenticated encryption scheme where the recipient can attribute the message to a single sender?
I'm looking for an asymmetric scheme which provides the combined benefits of authenticated encryption (presumably with a symmetric key and some block cipher), as well as digital signatures (using an asymmetric key). The symmetric key would be shared, and the public key would be well known. It may even be the case that the symmetric key is sent encrypted with the public key of the signer. I'm wondering if there is something more efficient than encrypting then signing (much like OCB is faster than doing encrypt then MAC).
Aug
14
comment Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6?
I see, that makes sense. So then by doing $k = H(N,g)$, it makes it very unlikely that log_g(k) is known / trivially calculable. I suppose varying k would be possible (say, salting the hash of (N,g) per session), but not useful, because if the attacker could enable the two-for-one attack by solving log_g(k), he could also factor a from A, or x from v (assuming he could grab the verifiers), which allow him to break the protocol entirely.
Aug
11
comment Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6?
... fixed by convention (check the RFC which has defined (N,g) tuples). Or are you saying that there might be an attack across different (N,g)'s entirely which reuse the same k? It seems like since k is constant across sessions, any attacks leveraging k would be more relevant using data collected from multiple sessions on the same (N,g,k) (i.e. other users on the same server).
Aug
11
comment Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6?
@CodesInChaos Maybe... you mean a different (N,g)? Or just a different g for the same N? My understanding is that given an N, g is usually fixed by convention (check the RFC which has defined (N,g) tuples).