D.W.

8,057 reputation

827

bio	website
	location
	age
visits	member for	1 year, 9 months
	seen	5 hours ago
stats	profile views	137

	8,057 reputation	bio	website		visits	member for	1 year, 9 months
827 badges		location			seen	5 hours ago

summary answers questions tags badges favorites bounties reputation activity

381 Comments

suggestions reviews revisions comments badges posts accepts all

1d	comment	Requiring a “supervisor” key pair and a “user” key pair to decrypt multiple-recipient messages Ahh, that makes a lot more sense. Thanks, @RickyDemer. If that is the intent, I think the question should be edited to be a clearer about the intent.
1d	comment	Requiring a “supervisor” key pair and a “user” key pair to decrypt multiple-recipient messages I think there's something wrong with your proposal. How does step 1 work, if Bob knows the message and Jim doesn't? What does it mean to encrypt with a private key? (Are you talking about signing? Signatures are not the same thing as encrypting with a private key.) When you say "his", who does that pronoun refer to: Jim, Bob, or Mark?
2d	comment	Hill-cipher, disordered alphabet user9, Please do not deface your question! This site is intended to be a question-and-answer site for the common good. In particular, when you post here, you accept that the community has some ownership of your question; you are not a sole owner. If you deface your question, you render it useless to others -- which is inappropriate, as the main purpose of this site is to be useful to the world, not just to you. It is considered inappropriate to deface or delete your own question after you received an answer. See, e.g., meta.stackoverflow.com/q/106807/160917
2d	comment	How random are comercial TRNGS I think the question, as stated, is a perfectly fine question. It's not asking for product recommendations; it is asking about how one can evaluate a range of products out there. Seems like a great question to me! (The follow-on questions in the comments about specific products, however, are not good questions: they do not belong on this site. Search for "shopping question" to learn more about why not.)
2d	comment	How much data can I encrypt with AES before I need to change the key in CBC mode? @makerofthings7, to understand what it means, start by understanding what 'advantage' means at a deep level. At a very rough, crude level, you can think of it as representing the probability that an attacker learns some information about the message. (However, strictly speaking, this is a simplification.) In this case, we are saying roughly "If you encrypt no more than $2^{48}$ blocks of data under the same key, the probability that the attacker learns some information about the message is at most $1/2^{32}$". Roughly.
May 20	comment	Is this a sensible cryptographic protocol intending to reduce the impact of compromised security? @MattFellows, well, here's one scenario that comes to mind: what if they breach one of those systems first, then use it as a jumping-off point to attack your server? P.S. If the server is only intended to be accessed by limited IP addresses, it might be worthwhile to set up a firewall (or TCP wrappers policy) to actively block connection attempts from any other IP address.
May 20	comment	Are there any hand ciphers not obsoleted by computer cryptanalysis? Thanks, @PaŭloEbermann. Yes, I'm aware of it. (For reasons that probably aren't relevant to anyone else, it doesn't work for me: on my primary platform, something on my browser's configuration makes the "close" link not work. Maybe an ad blocker or something, I've never taken the time to fully trouble shoot it. My apologies for cluttering things up with comments as a result.)
May 19	comment	Recommended way of adding a pepper/secret key to password before hashing? @TheDisintegrator, the pepper should be truly random (e.g., generated from /dev/urandom and kept secret thereafter). I don't know about what order your $hash_h mac$ accepts parameters in; I explain where the inputs should go in my answer. As far as how to call bcrypt, that will depend upon your particular language and library's API. If you want to know how to code this up, that's better for StackOverflow. You choose the work factor for bcrypt so that computing bcrypt takes, say, 50ms.
May 19	comment	Are there any hand ciphers not obsoleted by computer cryptanalysis? Duplicate of crypto.stackexchange.com/q/1653/351 (see also crypto.stackexchange.com/q/844/351).
May 18	comment	When truncating an AES MAC value by “w” , how do I justify that “w” is still negligible? @Maeher, I have a different take. I think it's a perfectly reasonable use of the term. Outside of complexity theory, the standard engineering meaning of the term "negligible" is "so small it can be safely ignored/safely treated as zero". That seems to apply fine here.
May 18	comment	Alternatives to HMAC + CBC? It doesn't matter whether you separate out the signature into a separate column or not.
May 17	comment	Is this a sensible cryptographic protocol intending to reduce the impact of compromised security? "The assumption that the compromise wouldn't be permanent is made due to monitoring of all network traffic." - That makes no sense. It is not accurate or prudent to assume that monitoring of network traffic will detect all, or even most, of all compromises (or of instances of exfiltration of data by an attacker). I'm afraid your confidence in ability to detect compromises is sorely misplaced. Just look at some of the APT threats that have managed to penetrate systems and avoid detection for years.
May 16	comment	Is this a sensible cryptographic protocol intending to reduce the impact of compromised security? This sounds like a better fit for the IT Security site. It's not really about the cryptography per se, but about threat mitigation. If you click "flag" and ask the moderators to move it, they'll do so.
May 16	comment	Understanding Feldman's VSS with a simple example @mikeazo, that's correct. With those parameters, the Legendre symbol doesn't leak anything about $s$: the Legendre symbol $(g^s\|p)$ will always be $1$, regardless of $s$, so no leakage. Actually, with those parameters, I don't see any way that $g^s$ leaks anything about $s$, so I don't know what the Wikipedia comment is referring to. (Maybe it's what happens if you don't choose $p,q$ that way? Maybe it's the fact that you can verify a guess at $s$ using $g^s$? Or something else entirely? The statement is unsourced, so I can't tell.)
May 16	comment	Generating IV in TLS 1.2 @poncho, OK, thanks. It looks like if you encrypt a (generalized) counter, CBC mode is OK -- but here it's critical that it's a counter that the attacker has no control over. If you allow the attacker any control over the counter-like-thing you're encrypting, then that proof doesn't apply, and I suspect attacks become possible.
May 16	comment	SHA-1:Is there any mathematical result that gives us the minimum number of 1's in a 160-bit SHA-1 hash output? @Adnan, see pg1989's answer for the correct approach to get the right answer.
May 16	comment	What is a fair exchange scheme? Have you done a literature search on fair exchange protocols? If you've found only one paper, you've done it wrong.
May 16	comment	True random numbers generated by sensors @user1028028, why you need something that's a TRNG? What's wrong with a cryptographic-quality PRNG? Most people who think they need a TRNG, don't actually need one, and would actually be better off with a crypto-strength PRNG. (And are you aware that if you're hashing or otherwise processing sensor output, you've essentially built a crypto-strength PRNG, not a TRNG?)
May 16	comment	SHA-1:Is there any mathematical result that gives us the minimum number of 1's in a 160-bit SHA-1 hash output? Adnan, your calculation of the probability in the second half of the question is wrong.
May 16	comment	Generating IV in TLS 1.2 How do you know that it's safe to re-use the same key for encrypting the IV and for CBC encryption? That smells fishy to me. (For instance, in a chosen-nonce chosen-message attack scenario, this smells like it might allow distinguishing attacks.) Superficially, re-using the same key in this way seems like dangerous practice, unless there's a proof of security to demonstrate that nothing can go wrong. Do you know of a proof of security for this construction?