D.W.
Reputation
23,908
Top tag
Next privilege 25,000 Rep.
 Jun 20 comment Could scrypt salts contribute to entropy if passwords & salts are only stored in human memory? Why do you want to do this, as opposed to the standard approach of generating a random salt and storing it with the password hash? Is there an application where you think this will be preferable? There might be a better solution, but we'd need to know the context in which this question arises to determine that. Jun 20 answered Could scrypt salts contribute to entropy if passwords & salts are only stored in human memory? Jun 20 comment Public and private key lengths What are you trying to achieve? What problem are you trying to solve? What's wrong with leaving that there? It is part of the standard format: see PGP and OpenPGP. Jun 18 answered Fiat–Shamir: why do r and s have to be smaller than n? Jun 18 comment LFSR and Markov chain question I don't understand in what sense the Berlekamp-Massey algorithm is an algorithm for "this problem" - what problem? Please try to be more precise. Berlekamp-Massey has nothing to do with Markov chains; it has to do with recovering the LFSR initial fill and feedback polynomial, given observations of its output. As far as your last question in your comment: for what task? what Markov chain formulation? It's impossible to say what resources are needed, if we don't know what the task is. Again, LFSRs are a deterministic process, so modelling it as a Markov chain is not very helpful. Jun 18 comment LFSR and Markov chain question I find this question unclear. What do you have in mind as the statespace of the Markov chain? If the state is the entire state of the LFSR, then of course there is a trivial Markov chain, since it is a deterministic process, but this does not seem likely to be useful. So what did you have in mind? Let me put it another way. Why do you ask this question? What's the motivation or context where you plan to use this? How will you evaluate or use answers? As it stands the question seems a bit on the open-ended/ill-defined end. Jun 18 comment Length-preserving all-or-nothing transform @fgrieu, actually, I think you have it backwards. For large size, it is straightforward (in the random oracle), as explained in the section "Theoretical perspective": use a cryptographic hash function as the F-function of a 6-round Feistel network. I actually think the more challenging case is to do it for small block size, not large block size. Jun 18 revised Authenticated encryption without padding added 189 characters in body Jun 18 comment Authenticated encryption without padding @RickyDemer, I've updated my answer to provide a construction that you might like better. If provable security is a goal, a better construction is likely to be $E_{k_2} \circ P \circ E_{k_1}$ where $P$ is a public random permutation and $E$ is a length-preserving encryption scheme. (Then even in the case where $E$ is merely xor with a constant, i.e., $E_k(x)=k \oplus x$, then it can still be proven to provide reasonable security, as this devolves to the Even-Mansour construction, which offers provable security guarantees.) Jun 18 revised Authenticated encryption without padding added 253 characters in body; added 466 characters in body Jun 18 comment Can the premaster secret generated by SRP be used as a secure private key? I recommend that you state the question you want answered in the body of the question. Jun 18 comment SHA1 collision event probability after n iterations Did you look at crypto.stackexchange.com/q/15068/351 ? (Did you remember to use search before asking?) Jun 18 comment SHA1 collision event probability after n iterations What do you think? What have you tried? Where did you get stuck? Where did you run into this question? What is the context/motivation for your question? This is not a site where you copy-paste your exercise and we do your exercise for you. Jun 18 comment What are good combinations of public key algorithms or primitives for long term security? I wouldn't recommend lattice-based methods at this point in time, for long-term security; they haven't been studied in as much detail as others. It wouldn't be shocking if someone discovered a new attack 10 years from now that breaks them significantly faster than we currently know how to. Jun 18 revised Authenticated encryption without padding added 219 characters in body Jun 18 answered Length-preserving all-or-nothing transform Jun 17 asked Length-preserving all-or-nothing transform Jun 17 answered Authenticated encryption without padding Jun 17 answered Non-commutitive and nonassociative algebraic structures in cryptography Jun 12 answered Use of less than secure random numbers for 'a' during an SRP proof of password