Reputation
21,829
Next tag badge:
98/100 score
23/20 answers
Badges
4 29 79
Impact
~463k people reached

Dec
17
comment Help with linear cryptanalysis
@Antimony - yup, that's certainly possible! The only thing I couldn't tell was: what is the best characteristic you've gotten? How many rounds, and with what bias (or what probability)? It's possible that if you asked a new question giving that specific characteristic and asking if anyone can do better, maybe someone would be inspired to try to find a better one and see if they can beat what you got. Anyway, great question -- sorry I wasn't able to give a more specific answer focused on this particular cipher.
Dec
16
revised Help with linear cryptanalysis
References.
Dec
16
revised Help with linear cryptanalysis
References.
Dec
16
revised Help with linear cryptanalysis
added 2357 characters in body
Dec
16
answered Help with linear cryptanalysis
Dec
16
comment Combining two hashing functions
possible duplicate of Guarding against cryptanalytic breakthroughs: combining multiple hash functions
Dec
16
comment Combining two hashing functions
Are you using cryptographic hash functions? If not, this is off-topic for Cryptography.SE.
Dec
15
comment Randomized stream cipher using multivariant quadratic equations
@Antimony, yeah, $n^2/2$ should suffice. I wasn't trying to optimize the constant factors (just laziness). Thank you.
Dec
12
awarded  Nice Answer
Dec
11
revised Block Cipher Mode Amicable to Fast Key Change/Rotation Like XOR?
added 519 characters in body
Dec
11
comment Block Cipher Mode Amicable to Fast Key Change/Rotation Like XOR?
@DrLecter, thanks for the elaboration -- good point. If the document changes, you can consider the new version a new document (with its own key). I've edited my answer correspondingly. Thank you!
Dec
11
comment Do test vectors ensure a cipher is free of backdoors?
@CodesInChaos, yup, absolutely. But, I don't think mikeazo ever claimed that's the best or only way to insert a backdoor. To answer the question in the negative, it suffices to show one example of a backdoor -- it doesn't have to be the best possible backdoor.
Dec
11
revised Block Cipher Mode Amicable to Fast Key Change/Rotation Like XOR?
added 10 characters in body
Dec
11
comment Block Cipher Mode Amicable to Fast Key Change/Rotation Like XOR?
@noloader, It's not a problem. Think about it this way: What does knowledge of the document key for document $D$ let you do? It lets you decrypt document $D$. But if you give that key to everyone who should be able to read $D$, then you're not allowing them to do anything they shouldn't be able to do. It's not the same "everyone shares the wireless gateway password" because my answer shows how to communicate the document key to a person. There is no revocation: once you've allowed someone to download document $D$, you're done, there's no going back: they've got a copy of $D$, period.
Dec
11
answered Block Cipher Mode Amicable to Fast Key Change/Rotation Like XOR?
Dec
11
revised RC2, RC4, RC5 key length
added 278 characters in body
Dec
11
answered Can one use a Cryptographic Accumulator to efficiently store Lamport public keys without the need of a Merkle Tree?
Dec
10
comment Slow one-way pseudo-random permutation?
@K.G., cool! Would you care to add that as a separate answer, so we can upvote it? Also, do you know anything about the security of the discrete log on such curves? Is it also the case that the best currently-known algorithm is a square-root algorithm (i.e., we don't know how to do better than the generic algorithms for square roots in a black-box group)?
Dec
9
revised How hard is to invert the function that computes the middle-bits of (x^2)?
Improve based upon poncho's suggestion.
Dec
9
comment Slow one-way pseudo-random permutation?
Why do you need to store the permutation as $2^m$ words of $m$ bits, rather than just using any short-block cipher on $m$-bit blocks? Also: what's the security gap you expect from this? (i.e., the ratio in workfactor to break vs the workfactor for the legitimate parties to compute this function.) My rough back-of-the-envelope estimate suggests you should expect a very small security gap. If we precompute the discrete log of all primes up to $2^{21}$ (about $2^{17}$) of them, the time to compute a single discrete log is about 200 smoothness tests (sieving + ECM on a $\le 84$-bit number).