19,602 reputation
32171
bio website
location
age
visits member for 2 years, 11 months
seen 11 hours ago

Sep
25
reviewed Needs Improvement How to supply the GCM authentication tag to the OpenSSL command line tools?
Sep
25
reviewed Excellent Does there exist a two-pass AKE protocol that is secure in eCK model and also has PFS?
Sep
25
reviewed Satisfactory What to watch for with openssl generating weak keys? (low entropy)
Sep
25
reviewed Excellent What criteria make the theta step of Keccak's round function reversible?
Sep
25
reviewed Satisfactory Does the GCM authentication tag need to be protected?
Sep
25
reviewed Satisfactory Is it theoretically possible to construct a string that contain its own hash value?
Sep
25
reviewed Excellent Generate Elliptic Curve Private Key from User Passphrase?
Sep
25
answered Is this a structural weakness of Feistel networks?
Sep
25
comment Is this a structural weakness of Feistel networks?
What makes you think this "could violate the diffusion property of the cipher"? It looks to me like that's where your reasoning went awry, but without further details, I'm not able to diagnose with any more specificity what would help clarify this.
Sep
25
revised Is there any existing analysis for this construction to turn a tweakable blockcipher into a PRF?
tags
Sep
25
comment Is there any existing analysis for this construction to turn a tweakable blockcipher into a PRF?
Got it. Sounds like you should either omit the nonce from the question, or edit the question to explain this business more clearly. (Incidentally, this construction is going to impose some unfortunate limitations on how people can choose the nonce. If your block cipher admits a 128-bit tweak, and you want to encrypt messages up to $2^{40}$ blocks long, then you're only left with 88 bits for the nonce. In that case, it's not safe to generate nonces randomly: after $2^{44}$ nonces, by the birthday paradox, there's a good chance some nonce will be repeated. A bit painful.)
Sep
25
comment Is there any existing analysis for this construction to turn a tweakable blockcipher into a PRF?
@nightcracker, if you are sharing the same key with some other construction (not presented in the question), then that radically changes the question. You need to mention that! This question asks whether the MAC is secure in isolation, but even if this MAC is secure in isolation (if the key is not used for anything else), that doesn't mean it will be secure when combined with your encryption mode. I think, if you don't already have a proof of security for your combined construction, you are following a dangerous path -- this whole concept does not seem like a good idea to me....
Sep
25
revised Can a nested block cipher avoid the meet in the middle attack by using a secret initialization vector for the inner encryption?
Added link to the paper. (Thank you, Citeseer!)
Sep
25
comment Is there any existing analysis for this construction to turn a tweakable blockcipher into a PRF?
@nightcracker, sorry, I probably won't have time to look at the pre-print soon. Apologies about that. The alternatives that I suggest also allow for one-pass processing of a message in parallel with encryption. (On the other hand, if you want to share the same key for both the MAC and the encryption, that's a-whole-nother level of trickiness. At that point you really need an extremely careful security proof, and not just a handwavy sketch, because it is so easy to go awry. I would not trust any construction that reused the same key for both purposes without a super-detailed proof.)
Sep
25
comment Is there any existing analysis for this construction to turn a tweakable blockcipher into a PRF?
@nightcracker, (regarding your first comment:) yup, I understand that. I don't think that contradicts anything in my answer. I think my answer remains valid.... If I've missed some implication or connection or inference, you might need to spell it out, as I'm not seeing it.
Sep
25
revised Is there any existing analysis for this construction to turn a tweakable blockcipher into a PRF?
fix typo.
Sep
25
revised Is there any existing analysis for this construction to turn a tweakable blockcipher into a PRF?
added 623 characters in body
Sep
25
answered Is there any existing analysis for this construction to turn a tweakable blockcipher into a PRF?
Sep
24
revised How broken is a xor of two LCGs?
added 525 characters in body
Sep
24
revised How broken is a xor of two LCGs?
added 1762 characters in body