Reputation
Top tag
Next privilege 250 Rep.
View close votes
Badges
8
Newest
 Informed
Impact
~2k people reached

Jul
23
comment I hashed my bag and in it I put… “Is there a hash for unordered items?”
Silly me, of course! Aren't your keys rather salts (or even peppers)? What is their purpose, couldn't one do without them?
Jul
21
comment I hashed my bag and in it I put… “Is there a hash for unordered items?”
Can't one simply hash all items individually and then hash the sum of all hashes? And then, in order to prove a certain item's presence, provide its hash and that of the sum of all other hashes, and the sum of these two again hashes to revealed hash? On second thought, hashing the sum wouldn't do any good; why not simply sum all items' hashes?
Jul
21
comment I hashed my bag and in it I put… “Is there a hash for unordered items?”
I wasn't exactly sure what your k and i meant, and what your two-argument hash is, so I interpreted it from this Wikipedia image. But I think I didn't actually grasp your idea, maybe you could add a picture or example at some point - why are keys required?
Jul
4
comment I hashed my bag and in it I put… “Is there a hash for unordered items?”
Interesting method, though the growth means you'd have to add dummy items to not give away the amount of items packed
Jul
2
comment I hashed my bag and in it I put… “Is there a hash for unordered items?”
@cygnusv Hm, let me think about this... Commutativity would yield easy collisions, so the inner hash should be a "proper" one instead, right? But then again, if I understood it correctly those collisions are very peculiar and, given strings, would mostly yield garbage words. But still, sha512 for the items themselves wouldn't hurt...
Jul
2
comment I hashed my bag and in it I put… “Is there a hash for unordered items?”
Yes, on second thought #3 seems irrelevant, since H(bag without I) is simple H(other, items, etc)
Jul
2
comment I hashed my bag and in it I put… “Is there a hash for unordered items?”
You mean a Merkle tree? Yes, apart from 3 which on second thought seems irrelevant that does sound like a match, thanks - if one uses addition instead of concatenation
Jul
2
comment I hashed my bag and in it I put… “Is there a hash for unordered items?”
@cygnusv Because of "chainable"? I understand it would be insecure if H(H(A))=H(A), but what I (maybe unfortunately) called chainability merely allows splitting the hashes, and come to think of it is not even necessary
Dec
5
comment At the current time, is SHA256 the de facto standard for strong cryptographic hashes?
Question about the previous comment: “Weaknesses” in SHA-256d?
Sep
11
comment Should we sign-then-encrypt, or encrypt-then-sign?
The more general statement to make (e.g. from your short answer) is "don't sign anything that doesn't provide enough context"
Aug
14
comment What is the actual difference between security through obscurity and true encryption?
@mikeazo I was so hoping there was an xkcd for this :-D
Aug
14
comment What is the actual difference between security through obscurity and true encryption?
Very good point. A former employee decreased inbound traffic a lot by simply remapping the (needed) SSH ports... I guess you agree with my comment then :-7 Of course an obscured system will be considered a more interesting challenge to the potentially more harmful intruders. Well, that's what honeypots are for...
Aug
14
comment What is the actual difference between security through obscurity and true encryption?
Here's a nice quote from that linked SO question: If someone discovers the password, you can change the password, which is easy. If someone finds the location, you need to dig up the money and move it somewhere else, which is much more work. And if you use security by obscurity in a program, you would have to re-write the program... – Thomas Padron-McCarthy Feb 11 '09 at 15:27
Aug
14
comment What is the actual difference between security through obscurity and true encryption?
Ah, I forgot about equal probability. That's probably the most important difference, locations to hide a letter would probably be biased by physical reachability (or its inverse).
Aug
14
comment What is the actual difference between security through obscurity and true encryption?
@mikeazo thanks for these links, nice reading. I guess when crypto get out of beta that SO question should be migrated here...
Aug
14
comment What is the actual difference between security through obscurity and true encryption?
I think I get your point, but isn't hiding the letter the method and its location the key? And the keyspace can be quite huge if I have recently booked an around the world trip... But yes, this is not exactly encryption, since decryption requires the recipient to travel instead of simply entering a key...
Aug
14
comment What is the actual difference between security through obscurity and true encryption?
Re "Everything should be made public", shouldn't that rather read "Everything becoming public should not compromise the actual encryption"? With that I mean for example a primitive rot-13-ing of an RSA encrypted message should not be considered safer than RSA alone, but it would at least keep script kiddies with a brute force cracker out for a while since they would have to find and use their brains first. And reducing the amount of potential attackers is not so bad, as is in some scenarios increasing the shortest possible attack duration
Aug
14
comment What is the actual difference between security through obscurity and true encryption?
@Maeher sorry, I misread your comment. I'd actually accept it as an answer...
Aug
14
comment What is the actual difference between security through obscurity and true encryption?
@Maeher that's my very question, is encryption basically proven STO with the obscurity being the secret key?
Aug
14
comment Is a continuous stream of encrypted data embedded in garbage more or less secure than only encrypting the data?
@Thomas Thanks for the clarification. I think this is an important preposition to countering traffic analysis. One should also keep John's point in mind, that permanent communication may make it easier to determine who are communicating with, should that be worth keeping secret...