19,761 reputation
32271
bio website
location
age
visits member for 3 years
seen 12 mins ago

May
31
answered Security of the iterated Hill Cipher
May
31
answered Creating a license system based on asymmetric encryption (RSA or ECDSA)
May
27
revised What is the “artificial abort” technique?
Explanation from comment thread.
May
24
revised Cryptographic pseudo-random generation of address subsets
added 37 characters in body
May
24
revised Cryptographic pseudo-random generation of address subsets
Add information from fgrieu.
May
22
revised Prefix property for variable length pseudo-random generators
added 487 characters in body
May
22
answered Prefix property for variable length pseudo-random generators
May
22
comment how to use common modulus attack?
This is not a homework-answering or exercise-solving service. We want to help you, but we can't do that if you haven't shown us what you have tried. So, I suggest you edit the question to show us what you have tried and where you got stuck. Finally, make sure you give proper attribution to the source where you copied this from.
May
22
comment Which tamper-protection algorithm provides the shortest output?
@Gilles, as you say, there are two separate issues: (1) uses out of context, and (2) replays. In my opinion, a good solution needs to solve both ("you may want to" is not enough). In my opinion, this is something that is not optional; it's mandatory, if we want to deploy this in practice and be secure. So, I think this answer would benefit from more on how to handle the practical security challenges (the hard parts of this problem are not the crypto algorithms but how to ensure they'll be used appropriately in practice). Optional security will often fall short, because it be left disabled.
May
22
comment Security assessment between $g^{a_ix_i+r_i}$ and $g^{x_i+r_i}$
@curious, that belongs in your question. Don't ask "chameleon questions", where new requirements get revealed or drip-fed to us only after someone posts a valid answer to the original question. Think through your requirements and all relevant information, and make sure they are present in the question from the start.
May
22
comment Security assessment between $g^{a_ix_i+r_i}$ and $g^{x_i+r_i}$
Why are you trying to invent some new mechanism? Why aren't you using standard "semantically secure" public-key encryption? (You can use additively homomorphic public-key encryption, if that's what you need.) Also, I agree with the comments that the requirements don't seem clear. Finally: please edit the question to include all relevant information in the question itself. Don't just drop them in the comment thread. Comments exist only to help you improve the question, and the question needs to stand on its own (without having to read the comments).
May
22
comment Which tamper-protection algorithm provides the shortest output?
This answer is not sufficient, because it doesn't provide freshness (it doesn't prevent replaying of old values). The fact that your scheme provides both confidentiality and integrity/authenticity for all values is a good thing, though.
May
22
comment Which tamper-protection algorithm provides the shortest output?
This answer is not sufficient, because it doesn't provide freshness (it doesn't prevent replaying of old values). Also, in practice you probably want to encrypt by default, too, because if you make encryption optional it is too easy for there to be some value that was confidential but where you forgot to enable encryption.
May
22
answered Which tamper-protection algorithm provides the shortest output?
May
22
answered Cryptographic pseudo-random generation of address subsets
May
22
comment Cryptographic pseudo-random generation of address subsets
I don't understand the third solution. Are you assuming that each device can see all other addresses broadcast by all other devices (reliably, without missing one), and can store all of them? That doesn't seem very realistic. 1. It requires lots of storage: far more than your first solution. Thus, it seems much worse than the first solution. 2. It seems fragile. For instance, what if one device fails to overhead some broadcasts? What if you add a new device later? It will have missed all prior broadcasts.
May
22
comment Cryptographic pseudo-random generation of address subsets
Is there something wrong with storing $X$ addresses on each device? It looks like $X$ is quite small, so this should be a very reasonable solution (with excellent security, and simple to implement), unless your devices have extremely limited storage.
May
22
comment Can you determine an unknown value when it is combined with a known value and you are given the resulting hash?
How much entropy does the hidden string have? What have you tried? Are you familiar with the random oracle model? Have you tried figuring out what answer you'd get in the random oracle model? For that matter, what have you tried? Please edit the question to show your work.
May
14
comment Cryptographically secure keyed rolling hash function
@cyril42e, I don't know. That sounds a bit dangerous to me, because the collision probability of the rolling hash is too high. (It'd be nice if the collision probability were negligibly small, e.g., $\Pr_k[R_k(x)=R_k(y)]$ to be very small (say, at most $1/2^{80}$) for all $x,y$ where $x\ne y$, but that's not attainable with a 16-bit or 32-bit rolling hash.) As a result, your scheme might leak significant unwanted information about the message, even if it is a secure PRF. (I don't know if it is a secure PRF; I'm not sure I understood the proposal exactly.)
May
13
comment Hash collision resistance of $\mathcal H^\prime(m) = \mathcal H(\mathcal H(m)|m)$
@jthill, you're right. I don't have a working attack with Joux multicollisions. I'm still skeptical. Without a proof, I don't know how we could be confident that this construction adds any security (Joux multicollisions are an example of something that showed simple intuitions regarding techniques for strengthening hashes can be very wrong). I'm not at all confident that this construction cannot be attacked -- maybe it does have nice security properties, but I think we'd need a proof before we could trust that it does.