21,418 reputation
42877
bio website
location
age
visits member for 3 years, 8 months
seen 1 hour ago

Mar
28
awarded  Nice Question
Mar
27
reviewed Approve Practical brute-force attack on 128 bit encryption
Mar
25
answered Discrete log accumulator without pairings
Mar
22
awarded  Nice Answer
Mar
16
comment How to check if a sequence is generated by a linear congruential generator?
What do you mean by "a sequence of numbers starting at the nth bit"?
Mar
12
awarded  Notable Question
Mar
11
comment Encrypt-then-MAC: Do I need to authenticate the IV?
This answer contains incorrect statement. 1. It's not just "safer" to MAC the IV; it's unsafe if you don't MAC the IV. 2. "although Mallory can't predict the result of the decryption in any way" - This is simply false. Moreover, I don't know what you mean by "an invalid message", but there's no guarantee that the decryption will be "invalid"; it might be a completely valid message that just happens to be something other than what the sender wanted to send (which would amount to a break of integrity).
Mar
11
comment Is the 1st Encrypted Block Less Secure Than Subsequent Ones?
We expect you to do a significant amount of self-study and research before asking, including consulting standard resources (like Wikipedia and/or standard textbooks). This helps you craft a better question, and sometimes enables you to answer your question on your own. In this case, see e.g. en.wikipedia.org/wiki/Block_cipher_mode_of_operation#CBC. Look at the diagrams there. Why do you think the first block has fewer "permutations" or a closer relationship to the original message? The diagram looks identical for the first block....
Feb
28
comment What would a backdoor in symmetric key cipher look like?
This is already covered by crypto.stackexchange.com/q/1935/351 and crypto.stackexchange.com/q/675/351 (both of which you could have found by searching in the backdoors tag).
Feb
21
comment Anonymous Gravatar Problem
Thank you for the comments. That helps me understand this much better. I encourage you to edit the question to include this extra information -- comments are transitory and can disappear.
Feb
20
comment Anonymous Gravatar Problem
This answer might benefit from a bit more explanation. Where do the ephemeral keypairs come from? (how are they generated, and who knows them?), how do they come to be known to both Gravatar and the site?, and how does this differ from CodesInChaos's previous answer?
Feb
8
comment How many bits can be safely extracted from the BBS generator at each step?
@Nova, but I did answer the question of the OP. (Perhaps you missed it?) The answer is: zero bits, for practical parameters. There is no number of bits that can be extracted safely, with provable security, for practical parameter settings. That does answer the question that was asked.
Feb
7
answered Noisiest RF band for random number generation
Feb
7
comment Misunderstanding Broadcast Encryption
Check out non-committing encryption. Is it what you are looking for?
Feb
4
awarded  Good Answer
Feb
1
comment How hard is it to find plaintexts whose hashes satisfy $h(a)\oplus h(b)=h(c)$?
@JohnMeacham, I'm not familiar with SWIFFT, but if it satisfies $f(a+b)=f(a)+f(b)$, I would not call it a cryptographic hash function. The question specifically asks about cryptographic hash functions (and mentions SHA256 as an example); the term "cryptographic hash function" is often understand to require that the hash is effectively pseudorandom. So I think your criticism is debateable. If you have questions about what the OP meant by "cryptographic hash function", I suggest posting a comment underneath the question to ask the original poster to clarify.
Jan
31
comment Merkle hash tree updates
@user3150164, You can have a Merkle tree that has data values in internal nodes, if you want -- it's straightforward to extend all the ideas to that case. Alternatively, it's also possible to build a balanced binary tree data structure with values only in the leaves (and not in any internal nodes); the details of that are out of scope for this site (they're more appropriate for CS.SE than Crypto.SE). This is not a discussion forum, and not a place for extended back-and-forth or an interactive tutorial. I encourage you to formulate the original question more precisely in the future.
Jan
30
comment Merkle hash tree updates
@user3150164, inserting a new leaf at the leftmost edge can be done with $O(\lg n)$ operations. For instance, if $\ell$ is the leftmost leaf, you turn it into an internal node, with two children: $\ell$, and the new value. Then, you update the hashes of the nodes on the path to the root from these two new leaves. This takes $O(\lg n)$ time and hash updates. The general answer is: look at how any standard balanced binary tree data structure (e.g., AVL trees, red-black trees, etc.) handles this case -- they all handle this case, and achieve $O(\lg n)$ time. See paragraphs 2-4 of my answer.
Jan
30
comment Merkle hash tree updates
@user3150164, I've updated my answer with further explanation of these points.
Jan
30
revised Merkle hash tree updates
added 3474 characters in body; added 815 characters in body