19,732 reputation
32171
bio website
location
age
visits member for 2 years, 11 months
seen 2 hours ago

6h
comment Is it secure to use Diffie-Hellman key agreement to generate a nonce?
@YoavR., it sounds like you are using terminology in a non-standard manner. I don't know what you mean by "this is Nonce - by design it uses counter". I don't understand why you think a MAC "doesn't fit"; your explanation didn't make any sense to me. Again, if you want to receive help, edit your question to specify the security goals you are trying to achieve, what your requirements are, what mechanisms you have considered, what ones you have rejected, and why. I have to say this sounds like an instance of an XY problem.
6h
comment Is it secure to use Diffie-Hellman key agreement to generate a nonce?
@YoavR., no, that is not correct. The purpose of an IV is not to prevent replays. The purpose of an IV is to provide confidentiality (to ensure that if the sender encrypts the same message twice, this won't be apparent to an eavesdropper). If you want to prevent replays, you should use a different mechanism: e.g., sequence numbers and a MAC. Please edit your question to describe what you are trying to achieve, as it looks very much like you are making some (incorrect) assumptions about the best way to achieve it.
17h
comment Is it secure to use Diffie-Hellman key agreement to generate a nonce?
There's no need/reason to use Diffie-Hellman to generate a nonce. Instead, have Alice generate one nonce $N_A$, and have Bob generate another nonce $N_B$, and use both nonces -- or use the hash $H(N_A || N_B)$ as your random value. Alternatively, if all you want is an IV for a symmetric-key cryptosystem, you don't need them to cooperate to form a nonce: just have the sender generate the IV randomly. Both endpoints are presumably trusted (since they both know the shared key) and had better have been authenticated, so there's no need to combine both of their contributions to form the IV.
1d
comment Elliptic Curve Cryptography
Cross-posted on Math.SE: math.stackexchange.com/q/879643/14578. Please don't cross-post -- that is prohibited by site rules.
1d
comment Elliptic Curve Cryptography
What have you tried? Do you know the equation that defines the tangent line?
1d
comment Known plaintext attack on ElGamal encryption
What are your thoughts? What have you tried? Sounds like an exercise. We're not here to do your exercise for you; this is not a site where you can paste your exercise and we'll solve it for you. Instead, we expect you to make a serious effort, to show us what you tried in the question, and to formulate a specific question about a specific aspect of the problem or your approach.
1d
comment CSPRNG that cannot be used as random extractor
@owlstead, OK, I've edited the answer accordingly, and to try to make it match my understanding. Now the answer makes more sense to me. AES CTR_DRBG is different from AES CTR.
1d
comment CSPRNG that cannot be used as random extractor
OK, so I think part of the problem here is that you don't yet have a clear definition of what you mean by CSPRNG: what it is intended to achieve, what its API is, what its security definition is. A PRG is one well-defined notion in cryptography (AES-CTR, RC4, etc. are examples of a PRG). A CSPRNG is another, different primitive (Yarrow, /dev/urandom, etc. are examples of this primitive; it typically must accept non-uniformly distributed inputs, provide robustness to state compromise extension attacks, etc.). See my comment underneath otus's answer for some elaboration.
1d
comment CSPRNG that cannot be used as random extractor
Based upon the answers it has become clear that there is some confusion about what you mean by CSPRNG (e.g., the distinction between CSPRNG and PRG). I suggest you edit the question to give us your definition of what you mean by CSPRNG: do you mean something like Yarrow, /dev/urandom, etc? or something like AES-CTR, RC4, etc.?
1d
comment Whitening and randomness extraction
What definition of whitening would you like us to use? I have not heard the term "whitening" used in this particular context, so you'll probably need to define your terms (or provide some more context and more information about why you're asking and how you will use the answer) before I could answer this.
1d
comment Can you help me understand this “Message Modification by Meet-in-the-Middle” related to Tiger Hash?
I'm afraid we probably can't explain this to you. We want to help, but there are limits to what kinds of help can be expected from this kind of site. It looks like you first need to gain more fundamental knowledge about cryptanalysis before you will be in a good position to understand that research paper. Mathematics is the language of cryptanalysis; asking us to explain it without mathematics is not reasonable. If you have a specific question about a specific aspect of that article, I suggest you edit the question accordingly; otherwise, this is simply too broad as it currently stands.
Jul
22
comment MAC using a modified CBC mode of operation
What have you tried? What are your thoughts? What kinds of attacks have you considered? Have you tried to see if you could prove it secure? Have you looked at the special case where there are exactly 2 plaintext blocks? I don't think copy-pasting an exercise from an earlier course is a great fit for this site. We want to help clear up any confusions you might have, but as for doing an exercise problem for you -- well, maybe not so much. I don't think it benefits the world for us to be a site where people can paste exercises and have someone else produce a complete solution for them.
Jul
20
comment Turning PRPs in PRGs with a counter
You might like to read about the PRP/PRF switching lemma, which helps show that CTR mode is a secure PRG "up to the birthday bound" (i.e., as long as you don't generate too many outputs).
Jul
18
comment Modes of operation that allow padding oracle attacks
Can you define what you mean by padding oracle attacks? If you count switching the order of the blocks around in ECB mode to be a padding oracle attack, then you're using a non-standard meaning of the phrase (since in that case you're not even attacking the padding function nor using it as an oracle). Do you maybe simply mean chosen-ciphertext attacks on confidentiality?
Jul
16
comment Does having a known plaintext prefix weaken AES256?
What research have you done? This is already answered by several questions on this site, e.g., crypto.stackexchange.com/q/1512/351, crypto.stackexchange.com/q/3952/351. (If you'd searched, you should have found them immediately; and they already show up in the related questions list.) We expect you to do a significant amount of research before asking here, including searching on this site for other questions and answers that might shed light on your question. At worst, it will help you frame a better, more focused question; at best, it might answer your question for you.
Jul
10
comment CBC-MAC length extension attack with IV simulation
Please edit the question to make clearer what the problem is. We don't have the second part of 49th problem in Matasano's problem set memorized in our head. Right now, the question does not seem answerable to me. Also, I suggest you edit the question to tell us what research you've done, what attacks on CBC-MAC you are familiar with, and what you've tried.
Jul
10
comment Choosing primes in the Paillier cryptosystem
I can't understand what you are asking. What does "Give me a reference if proof for above equation complex otherwise provide a proof." mean? Also, what research have you done? Did you read the original research paper?
Jul
2
comment Password-based encrypted key storage?
@otus, RFC 5959 only uses AES in ECB mode if the plaintext is exactly 128 bits long. That is not malleable (not in any useful way that would enable related-key attacks).
Jun
26
comment RSA: Common modulus attack problem
CGFox, rather than editing your question here, it would be better to propose an edit to the answer on the other thread that adds a clarification of how to deal with a negative exponent, i.e., what it means to raise to the $s_1$ power if $s_1$ is negative.
Jun
25
comment Choose a random number that is different from a bunch of other secret numbers
@CedricMartin, the standard commutative encryption algorithms (e.g., Pohlig-Hellman) do not require a TTP to hold any keys. The prime $p$ is public and shared by everyone; each participant's exponent is secret and is their key and is generated by them and known only to them. No TTP is needed. If you have questions how to use commutative encryption in practice, I suggest reading the existing questions, then posting a new question if it's not covered by the ones that are already on this site.