Reputation
23,246
Top tag
Next privilege 25,000 Rep.
Access to site analytics
Badges
4 33 85
Newest
 Nice Answer
Impact
~584k people reached

Jan
27
comment Is TLS secure against VM reset attacks?
@RichieFrame, as far as I know, the answer is "no": SSL was designed before these attacks were even known in the cryptographic community.
Jan
27
comment Is TLS secure against VM reset attacks?
You seem to be claiming that there are no protocol-level vulnerabilities. Can you support that claim with evidence, analysis, citations, or other reasoning? (Just because there exist some implementation-level vulnerabilities doesn't mean there are no protocol-level vulnerabilities. Put it another way, just because we know of some implementation-dependent vulnerabilities doesn't mean that there are no vulnerabilities that apply to all implementations.)
Jan
15
comment Are there any advantages in using proprietary encryption?
This has been covered in incredible depth over at Security. SE. See security.stackexchange.com/q/66552/971, security.stackexchange.com/q/24449/971, security.stackexchange.com/q/44094/971, security.stackexchange.com/q/2430/971, security.stackexchange.com/q/32064/971, security.stackexchange.com/a/2210/971. I'm not sure there's much purpose in repeating all of those points here...
Dec
22
comment Differences Between White-Box Cryptography and Code Obfuscation
@NeilSmithline, everything I wrote still seems valid. There have of course been new results and new developments in obfuscation since then, but nothing that invalidates my answer, as far as I know. For instance, you might enjoy reading about indistinguishability obfuscation.
Oct
27
comment Block Cipher Without Key Schedule?
@CodesInChaos, Huh. Confusing. The question doesn't mention anything about two individual ciphers. In contrast, it does mention a 2-round cipher (which would be natural to apply a MITM attack to, on its own, without needing another cipher for the exercise to make sense). Puzzling.
Oct
27
comment Block Cipher Without Key Schedule?
I don't understand why you need to avoid the key schedule. The implementation of the meet-in-the-middle attack can ignore the key schedule and treat the cipher as if it has two independently keyed round subkeys. (Alternatively, you could rip out the key schedule and use independent round subkeys as part of the cipher spec.) So I can't understand where the question is coming from.
Oct
23
comment Proof of storage scheme
@JohnTromp, I don't have a specific time period in mind, so a scheme that works for any of those would be interesting -- you pick. :-)
Oct
16
comment Memory-hard proof-of-work: are they ASIC-resistant?
@CodesInChaos, thanks. Here's my super-crude back-of-the-envelope calculation: a RAM chip costs about \$20; a CPU costs about \$200; so it feels like we're already talking about a potential for a 10x speedup if the cost of the ASIC is as low as \$20 per chip. That sounds like more than a small advantage. Does that sound right?
Oct
16
comment Does an encrypted random sequence conserve its “randomness”?
Minor nitpick: I don't think it's the pigeon-hole principle you mean to quote here.
Oct
12
comment For any hash value, is there an infinite number of inputs that hash to it?
See also crypto.stackexchange.com/q/9910/351.
Oct
5
comment How does RSA compute such enormous numbers?
See also security.stackexchange.com/q/13674/971
Oct
5
comment How does RSA compute such enormous numbers?
What research have you done? This is covered in textbooks and courses on cryptography. We expect you to do a significant amount of research before asking, and to show it in the question. See security.stackexchange.com/help/how-to-ask: "Have you thoroughly searched for an answer before asking your question? Sharing your research helps everyone. Tell us what you found and why it didn’t meet your needs. This demonstrates that you’ve taken the time to try to help yourself, it saves us from reiterating obvious answers, and above all, it helps you get a more specific and relevant answer!"
Sep
20
comment Is ChaCha20 alone sufficient for securing data-at-rest?
You say "ChaCha20 protects your file from being read", but that's an overstatement. ChaCha20 alone doesn't prevent the file from being read: chosen-ciphertext attacks may be able to not only let the attacker flip bits, but also let the attacker learn the plaintext. I realize this is counter-intuitive for many people: it feels like encryption ought to be enough to protect at least confidentiality, but when you have a chosen-ciphertext attack model and an encryption scheme that is only secure against chosen-plaintext attacks, that's the situation you're in.
Sep
15
comment A secure function evaluation problem and an alternative of 1 out of n oblivious transfer?
I think you should explain that these constructions are only secure in the "honest-but-curious" model, which is an odd kind of threat model where we are worried about a malicious adversary but we somehow don't believe the adversary will do anything too malicious. Needless to say this often doesn't match up to what adversaries can actually do in the real world, so we often need something that's secure in "the malicious model".
Sep
11
comment Is there an encryption format that preserves length and only outputs alphanumerics?
I'm not sure that 4 rounds is enough; for a 100-bit block width, you only get a $2^{25}$ level of security, which is uncomfortably low. The scheme would probably be safer with 8 rounds. (There are more modern results than Luby-Rackoff which show better security with more than 4 rounds, as you probably already know.)
Sep
8
comment Theoretical pi-based stream cipher
@CodeJockey, see mathoverflow.net/a/26970/37212 and rec-puzzles.org/index.php/Pi%20Solution.
Sep
3
comment Is there a secure source of entropy on a typical microcontroller?
In practice you should almost never use a strong extractor; simply hashing using a cryptographic hash function will almost always make more sense. (Assuming you are a practitioner/engineering building a product, rather than a theoretician interested in what theorems we can prove.)
Sep
3
comment Could eVoting on the bitcoin blockchain be done?
What research have you done? Have you searched Google Scholar? I feel sure I've seen papers on using the bitcoin blockchain for some aspects of e-voting.
Aug
28
comment Are there ANY text strings that will generate the same SHA-512 Hash output?
Already answered at crypto.stackexchange.com/q/12301/351 and crypto.stackexchange.com/q/8765/351; see also crypto.stackexchange.com/q/301/351 and crypto.stackexchange.com/q/8092/351. In the future please make more of an effort to search for related questions here before posting a new one. Thank you!
Aug
14
comment Is (AES-)GCM parallelizable?
Please ask only one question per question. This site format works best when you ask only one question. If you ask two questions, you can create problems (e.g., if one answer explains the answer to question #1, and another explains the answer to question #2, how are you going to choose which one to accept?). It's usually better to avoid this: if you have two questions, it is often better to post two separate questions -- in 2 separate posts. Thank you.