Reputation
23,868
Top tag
Next privilege 25,000 Rep.
Access to site analytics
Badges
6 37 88
Newest
 Nice Answer
Impact
~635k people reached

Apr
12
comment Is there an AES identity key?
Please clarify what you are asking. Are you asking whether there exists a key k and a plaintext x such that E_k(x)=x? Or are you asking whether there exists a key k such that E_k(x)=x for all x?
Apr
9
comment Is it possible to utilize an AES-128 encryption hardware unit for AES-256?
it depends. Which processor? How does the AES-128 encryption hardware unit work on that processor?
Mar
12
comment Given enough RSA signature values, is it possible to determine the public key value?
@poncho, yup. That too.
Mar
12
comment Given enough RSA signature values, is it possible to determine the public key value?
I don't believe it. There's something wrong with your math if it suggests that $\min_{i,j} \gcd(t_i,t_j)$ is better than $\gcd(t_1,\dots,t_k)$. It's easy to prove that $\gcd(t_1,\dots,t_k) \mid \min_{i,j} \gcd(t_i,t_j)$, so if pairwise min works, then $\gcd(t_1,\dots,t_k)$ definitely works -- and one can also find cases where $\gcd(t_1,\dots,t_k)$ works but pairwise min doesn't. In other words, $\gcd(t_1,\dots,t_k)$ is strictly better. Double-check the math?
Mar
12
comment Given enough RSA signature values, is it possible to determine the public key value?
Instead of computing the min of the pairwise gcd's, it's better to compute $\gcd(t_1,t_2,\dots,t_k)$. You'll get a significant improved success probability.
Mar
4
comment Why is OTP not vulnerable to brute-force attacks?
This answer seems confused. OTP keys are not "valid for only a limited period of time". I think you are confusing the one-time pad with one-time authenticators (e.g., challenge-response authentication). The question is asking about the one-time pad, not one-time authenticators or challenge-response authentication.
Mar
3
comment Public-key encryption with associated data
@SEJPM, poncho, this is great stuff. Turn it into an answer? (For many public-key schemes, this is a clean solution that avoids any message expansion. For some other schemes, it's suboptimal -- for instance, RSA-KEM+AES-GCM will have more message expansion than RSA-OAEP, so I suspect that something better should be possible. But this does provide an answer to my question by showing some examples, so if it sounds good to you, I'll post a separate follow-up asking about RSA.)
Mar
3
comment Public-key encryption with associated data
@poncho, nice! Can you do something similar for any KEM-based method? (basically, any use of hybrid crypto, where the public-key part is used to exchange a symmetric key, and then the symmetric key is used to encrypt the message) Does that work in general?
Mar
1
comment Constant time multiplicative inverse within a word
For what value of $p$? How large is your $p$? If $p$ is small you can use a table lookup.
Feb
22
comment Are checksums essentially non-secure versions of cryptographic hashes?
@kasperd, that's a difference, but far from the only relevant difference. For instance, hashes are required to be one-way; a MAC isn't, and a checksum isn't. You could compare the CRC to a hash, but then you'd find that a hash has extra requirements that don't show up for checksums and seem orthogonal, so the comparison gets messy. In contrast, MACs and checksums serve a similar purpose, with the only difference being adversarial vs not, so I personally find it more intuitive to think of checksums as being vaguely analogous to MACs.
Feb
18
comment Why does the FBI ask Apple for help to decrypt an iPhone?
It's important to specify whether you are talking about an iPhone with Secure Enclave (5S and newer) or without Secure Enclave (5C and older). The answer differs significantly, as there are major differences in how the crypto works.
Jan
27
comment Is TLS secure against VM reset attacks?
@RichieFrame, as far as I know, the answer is "no": SSL was designed before these attacks were even known in the cryptographic community.
Jan
27
comment Is TLS secure against VM reset attacks?
You seem to be claiming that there are no protocol-level vulnerabilities. Can you support that claim with evidence, analysis, citations, or other reasoning? (Just because there exist some implementation-level vulnerabilities doesn't mean there are no protocol-level vulnerabilities. Put it another way, just because we know of some implementation-dependent vulnerabilities doesn't mean that there are no vulnerabilities that apply to all implementations.)
Jan
15
comment Are there any advantages in using proprietary encryption?
This has been covered in incredible depth over at Security. SE. See security.stackexchange.com/q/66552/971, security.stackexchange.com/q/24449/971, security.stackexchange.com/q/44094/971, security.stackexchange.com/q/2430/971, security.stackexchange.com/q/32064/971, security.stackexchange.com/a/2210/971. I'm not sure there's much purpose in repeating all of those points here...
Dec
22
comment Differences Between White-Box Cryptography and Code Obfuscation
@NeilSmithline, everything I wrote still seems valid. There have of course been new results and new developments in obfuscation since then, but nothing that invalidates my answer, as far as I know. For instance, you might enjoy reading about indistinguishability obfuscation.
Oct
27
comment Block Cipher Without Key Schedule?
@CodesInChaos, Huh. Confusing. The question doesn't mention anything about two individual ciphers. In contrast, it does mention a 2-round cipher (which would be natural to apply a MITM attack to, on its own, without needing another cipher for the exercise to make sense). Puzzling.
Oct
27
comment Block Cipher Without Key Schedule?
I don't understand why you need to avoid the key schedule. The implementation of the meet-in-the-middle attack can ignore the key schedule and treat the cipher as if it has two independently keyed round subkeys. (Alternatively, you could rip out the key schedule and use independent round subkeys as part of the cipher spec.) So I can't understand where the question is coming from.
Oct
23
comment Proof of storage scheme
@JohnTromp, I don't have a specific time period in mind, so a scheme that works for any of those would be interesting -- you pick. :-)
Oct
16
comment Memory-hard proof-of-work: are they ASIC-resistant?
@CodesInChaos, thanks. Here's my super-crude back-of-the-envelope calculation: a RAM chip costs about \$20; a CPU costs about \$200; so it feels like we're already talking about a potential for a 10x speedup if the cost of the ASIC is as low as \$20 per chip. That sounds like more than a small advantage. Does that sound right?
Oct
16
comment Does an encrypted random sequence conserve its “randomness”?
Minor nitpick: I don't think it's the pigeon-hole principle you mean to quote here.