21,368 reputation
42876
bio website
location
age
visits member for 3 years, 7 months
seen 17 hours ago

Dec
7
comment PRP representation size
@Bush, your question still has the same problems. Have you tried answering the questions in the last paragraph of my question? They are intended to get you thinking along lines that enable you to clear up your confusion on your own.
Dec
7
answered PRP representation size
Dec
7
comment Slow one-way pseudo-random permutation?
@fgrieu, excellent point. OK, I guess I don't know how to make this slow after all (unless each person will only use the key once -- but that's probably a relatively rare situation). Thank you for catching that.
Dec
7
revised Slow one-way pseudo-random permutation?
added 15 characters in body
Dec
7
comment Slow one-way pseudo-random permutation?
@RickyDemer, yup, either do that (i.e., iterate: a standard way to make something slow), or make the key expansion of $k \mapsto (k_0,k_1)$ slow (if each person will only use the key $k$ once -- which might not apply here, but I mention it just for completeness).
Dec
6
revised Keyed digest function with odds of collision below the birthday bound?
Improve the construction a little bit, per the comment from fgrieu.
Dec
6
comment Keyed digest function with odds of collision below the birthday bound?
Is there any reason to think that the polynomial given here is hard to invert? It looks to me like that paper shows that these polynomials are easy to invert. In particular, it looks like the proofs of Propositions 1 and 2 give an explicit algorithm to find $x$ such that $p(x)=d$ (where $p$ is one of these permutation polynomials). For instance, equation (9) shows how to solve $(x^{2^k}+x+a)^{-l}+x=d$ for $x$, and the displayed equation at the end of Proposition 2 shows how to solve $(x^{2^k}+x+a)^s+x=d$ for $x$. (Cc:ing @fgrieu)
Dec
6
revised Slow one-way pseudo-random permutation?
added 52 characters in body
Dec
6
answered Slow one-way pseudo-random permutation?
Dec
6
comment Slow one-way pseudo-random permutation?
I still don't think I understand the requirements, but I suspect if you took a step back and allowed yourself to admit other solutions you could find better, simpler solutions. For instance, something using a trusted server or HSM. P.S. I think there's a solution to the mobile app issue you mentioned. Suppose there's a 256-bit SHA256 hash. You can ask the user to enter in the first 64 bits of the hash, then look it up in the database of items and see if that's to uniquely identify the item; if it isn't, have them enter in the rest. It will be extremely rare that a user needs to enter more.
Dec
6
comment Can insecure algorithms be combined to form a secure algorithm?
Also, they are hoping it will be safe, but there is no proof that this is safe.
Dec
6
comment Slow one-way pseudo-random permutation?
Also, why does your application require such a complex construct? Why not just store a unique random serial number in the 2-D barcode, and have a back-end database that maps the serial number to whatever data is associated to that card (of course, the data can be encrypted under one merchant's key if you wish). Perhaps I haven't quite understood the application yet.
Dec
6
comment Slow one-way pseudo-random permutation?
Why do you need the output to be the same length as the input? If you're willing to have (say) a 256-bit output, your goals are easy to achieve; just use the SHA256 hash. If the output is going to be stored in a database but not stored on the card, that'd suffice. Also, why do you need it to be bijective (i.e., a permutation)? If collisions are non-trivial to find, is that good enough?
Dec
6
comment Enhance CSPRNG output
@user1028028, it doesn't matter if the PRNGs are independent. What matters is that their seeds (their keys) are independently chosen. That's how you can tell: check how you've generated them.
Dec
6
revised Can insecure algorithms be combined to form a secure algorithm?
Clarify the question.
Dec
6
comment Enhance CSPRNG output
"Unrelated" is NOT the criterion. The criterion is that the keys be independently chosen, not that the algorithms be "unrelated" or "independent" (whatever that would mean). You can even use the same CSPRNG algorithm, as long as you have two independent keys.
Dec
6
comment Enhance CSPRNG output
How are they keyed? With two independent keys? Also, if one is a CSPRNG, then it cannot be biased (to be cryptographically secure means that it can't be biased).
Dec
6
comment If H(m) = 0 for some m, how can a DSA signature be forged?
As DrLecter says, when asking this sort of question, please make sure to describe what you've tried and where you got stuck. We expect you to make a serious effort before asking here and to show us what you've tried and where you got stuck.
Dec
6
comment Is an elliptic curve over $\mathbb{F}_p$ order preserving for the points $(x,y) \in \mathbb{Z}_p$?
Could you define what you mean by $E(x)=y$? If $E$ is the curve, then $E(x)$ is not well-defined. Do you mean $x,y$ such that $(x,y)$ is on the curve (i.e., $y^2=x^3+ax+b \pmod p$)?
Dec
6
comment Is there any analysis of freebsd's “geli” encrypted geometry provider?
Got any suggested links for reading about how geli works and how its crypto works? Any overviews or other resources that you think might be a helpful place to start for those who might want to start taking a look at it? If yes, that might be worth editing into your question.