17,730 reputation
32063
bio website
location
age
visits member for 2 years, 8 months
seen 7 hours ago

Sep
22
answered Is SSH public key authentication weakened by 'none' cipher?
Sep
22
revised Is my understanding of CPA indistinguishability experiment correct?
correct spelling error. add tag.
Sep
22
comment Theoretical pi-based stream cipher
Your assumption that there are no patterns in the digits of pi, surprisingly, turns out to be false. Amazing, but true!
Sep
21
asked Why is TLS susceptible to protocol downgrade attacks?
Sep
20
comment Is the inverse of a secure PRP, also a secure PRP?
@nightcracker, I don't know of any real-world examples of a PRP that's not a sPRP. (The closest is 3-round Luby-Rackoff -- i.e., 3 rounds of a Feistel network with an absolutely perfect F function -- is a PRP but not a sPRP. However, no one uses something like that in practice.) So, yeah, I think it's just a theoretical issue.
Sep
20
answered blinding a hash vs. sending the hash directly
Sep
20
reviewed Reject suggested edit on mceliece tag wiki
Sep
20
reviewed Approve suggested edit on xts tag wiki
Sep
20
reviewed Reject suggested edit on mceliece tag wiki excerpt
Sep
20
reviewed Approve suggested edit on xts tag wiki excerpt
Sep
19
revised Explaining weakness of Dual EC DRBG to wider audience?
Add NSA tag, since it seems related to the recent NSA stuff.
Sep
19
comment Explaining weakness of Dual EC DRBG to wider audience?
@Nemo, well... in some sense, yeah, you're out of the mainstream. The reason for this notation is that mathematicians have been studying elliptic curves for far longer than cryptographers have been using them in crypto, and mathematicians have used the additive notation ($eQ$ rather than $Q^e$), for reasons that make sense in the mathematical context. That said, many folks studying crypto have the same reaction you do, because they were initially trained on the integer discrete log problem rather than elliptic curve discrete log problem, and their intuition follows what they learned first.
Sep
19
revised Is the inverse of a secure PRP, also a secure PRP?
Specify one possible resolution of the ambiguity.
Sep
19
comment Is the inverse of a secure PRP, also a secure PRP?
nightcracker, when you say PRP, do you mean "secure against chosen-plaintext attacks" (as in my answer), do you mean "secure against chosen-plaintext/ciphertext attacks" (what I call sPRP in my answer)? This affects the meaning of your question. I've edited your question to introduce one possible interpretation, but please edit the question if that isn't what you had in mind.
Sep
19
revised Is the inverse of a secure PRP, also a secure PRP?
added 356 characters in body
Sep
19
comment Is the inverse of a secure PRP, also a secure PRP?
@RickyDemer, huh! I didn't know that. Maybe the terminology isn't completely standard, or maybe I've been reading the wrong references. My recollection was that in the references I've seen, PRP = secure against chosen-plaintext attacks, strong PRP = secure against chosen-plaintext/ciphertext attacks (example: Boneh's class), but it's possible that different authors use different definitions, or that the definitions have evolved over time. Bellare and Rogaway's notes now refer to prp-cpa and prp-cca, to avoid ambiguity.
Sep
19
revised Is the inverse of a secure PRP, also a secure PRP?
added 66 characters in body
Sep
19
revised Is the inverse of a secure PRP, also a secure PRP?
Try to clean up the wording a little bit, to be more concise and use full sentences.
Sep
19
comment Is the inverse of a secure PRP, also a secure PRP?
@Reid, This is not a duplicate. The other question is related but not identical. The other question asks whether AES's inverse is a PRP, so the other question is only asking about AES (one specific example of a PRP). This question asks whether it is true that for every PRP, its inverse is also a PRP. That's a more general question. As a quick way to see that they are two different questions, they happen to have different answers: the inverse of AES is a PRP, but the inverse of a PRP is not necessarily a PRP. (See my answer below.)
Sep
19
revised Is the inverse of a secure PRP, also a secure PRP?
added 1495 characters in body