20,228 reputation
32371
bio website
location
age
visits member for 3 years, 1 month
seen 4 hours ago

Nov
30
revised AES timing attacks
deleted 1 characters in body; edited tags
Nov
30
answered Stopping timing attacks on AES: Why is it important to prevent the OS from interrupting the AES computation?
Nov
30
revised Stopping timing attacks on AES: Why is it important to prevent the OS from interrupting the AES computation?
added 5 characters in body; edited tags; edited title
Nov
30
comment AES timing attacks
@cooky451, it's not that someone misses it -- it's that it clutters up the thread. I encourage you to post it here on this site, but just post it separately: as it is an almost entirely different question, it deserves a separate post (in my opinion).
Nov
30
comment AES timing attacks
The second question is, well, a different question and probably worth posting separately. The site seems to work best when there's one question per question. I encourage you to post the other questions separately!
Nov
30
revised Is there an authenticated encryption scheme where the recipient can attribute the message to a single sender?
The original questioner has made pretty clear that he is not looking for non-repudiation. See his comment on my answer. (He may think he wants "non-repudiation", but he is a bit confused about what non-repudiation actually means. What he wants does not seem to have anything to do with repudiating
Nov
30
answered AES timing attacks
Nov
29
comment Counter mode secure hash algorithm
@owlstead, thanks for pointing that out! I added links to where you can get the papers and read more.
Nov
29
revised Counter mode secure hash algorithm
added 487 characters in body
Nov
29
comment Counter mode secure hash algorithm
@owlstead: Look, let me put it another way. If you want to innovate, the starting point is to start by understanding what has already been done and what has already been tried. That is what I am trying to outline in my answer. What I'm saying is that there is existing research on this topic, and reading about the past work would be a good place to start for anyone who is interested in the topic. (Maybe you've heard the saying: "a month in the lab can save you a day in the library".)
Nov
29
comment Counter mode secure hash algorithm
@owlstead, thanks for your comments. Well, all I can say is: You asked "I cannot find if it has been tried". I'm telling you it has been tried ... and the results have been found to be unsatisfactory. As you say, the resulting schemes are too slow to be very practical. The takeaway is that the kind of approach you sketch does not appear to be promising -- or, at least, no one knows how to make it work in a way that is secure and efficient enough to be terribly useful.
Nov
29
comment Counter mode secure hash algorithm
"hence the group members must be twice as big in order to keep the second-preimage problem as difficult as expected" - Actually, they have to be a lot bigger than that (for typical groups, such as addition modulo a large number). The birthday attack you describe is one attack, but it is not optimal. Generalized birthday attacks are even more efficient. Resisting them requires even larger group elements. Therefore, following the advice in your answer ("use twice-as-wide group elements") is likely to lead to an insecure scheme. See my answer for more.
Nov
24
comment Pseudorandom generator and AE-secure encryption
Is this homework?
Nov
24
answered Pseudorandom generator and AE-secure encryption
Nov
24
comment Questions about William's p+1
@Antimony, it might be worth splitting your 2 questions into, well, two separate questions on this site. They seem to be unrelated. In this case, since no one has attempted to answer the 2nd, I think you could post a new question with the content of your second question (why not a different recurrence?), then edit this one to remove the overlap.
Nov
24
comment Should we sign-then-encrypt, or encrypt-then-sign?
@RickyDemer, s far as why your comments are being formatted funny, it appears to be because you are manually inserting LaTeX spacing commands (e.g., \;, \hspace, manual linebreaks, etc.) into your comment text. It has been suggested to you before that you avoid doing that, if you want to avoid the funny formatting of your comments. I think that remains valid advice.
Nov
24
comment Should we sign-then-encrypt, or encrypt-then-sign?
@RickyDemer, I've never heard of this "bounded-CCA2 non-malleable" until now; as far as I can tell, it has approximately zero practical relevance. Anyone can invent some crazy security notion, but that doesn't make it relevant. I stand by all of my recommendations and statements in my answer. To be honest, I'm not sure where you're going with your comments. If you have questions, you may want to raise them in a separate question -- I'm not sure if I understand what you are getting at, but they seem to be a bit of a tangent.
Nov
24
comment Should we sign-then-encrypt, or encrypt-then-sign?
@RickyDemer, I don't know. This is the first time I've heard of SIM-NME', whatever that is. IND-CCA2 security is the standard notion of security for a public-key encryption scheme that is intended to be secure against chosen-ciphertext attacks. For a definition of IND-CCA2 security, see any good textbook on modern (theoretical) crypto ... or, if you're feeling brave, see Wikipedia.
Nov
24
comment Should we sign-then-encrypt, or encrypt-then-sign?
sashank, in my experience it is very rare for there to be any value in verifying that a signature is valid without being able to verify the contents of the message. (As far as auditing, in my experience any auditor is going to demand to see the contents of the message.)
Nov
24
comment Is quantum key distribution safe against MITM attacks too?
See also this article and the accompany comments section for extensive discussion about the strengths and weaknesses of quantum key distribution, from many experts.