D.W.

8,815 reputation

828

bio	website
	location
	age
visits	member for	1 year, 10 months
	seen	yesterday
stats	profile views	140

	8,815 reputation	bio	website		visits	member for	1 year, 10 months
828 badges		location			seen	yesterday

summary answers questions tags badges favorites bounties reputation activity

404 Comments

suggestions reviews revisions comments badges posts accepts all

Dec 20	comment	What is an easy method of proving that a cryptographic oracle attack is possible? OK, I'd refer penetration testers to my second paragraph: "an easy way to prove that such an attack is possible is to actually implement the attack and demonstrate that it works". Of course, evaluating a cryptographic system to determine whether any attack is possible (and if so, to find the attack) remains challenging and non-trivial and not something that can be automated; for that, my best advice is "hire a cryptographer".
Dec 20	comment	construct an election protocol for the following election problem..? I see you have confirmed that this is a homework question. Please don't ask homework on this site without specifying that it is homework. Also, please make sure to read the FAQ section titled "Do we accept basic level/homework questions?". In particular, you should be writing out what you have tried, what you do not understand, etc. It looks like you have just copied the homework question, and that is not acceptable. As it stands, your question may be closed. If you'd like it to stay open, please revise it to comply with the site's standards.
Dec 20	comment	Why is asymmetric cryptography bad for huge data? Sorry, I'm not sure what you mean by "it". Are you asking, why does public-key encryption need to encrypt data that is smaller than its key length? If so, you should revise your question, because that's not what I'm getting out of your question at all.
Dec 19	comment	construct an election protocol for the following election problem..? Can you say anything about what practical context this problem arose in?
Dec 19	comment	How many bits of hash are realistically needed for key verification? 160 bits is overkill and bad for usability. I do not recommend it. See my answer for elaboration.
Dec 19	comment	Why is asymmetric cryptography bad for huge data? Welcome to Crypto.SE. I encourage you to read the FAQ. In particular, we expect you to have "done your homework" before posting a question. This particular question must have been asked a dozen times on this site. Did you try a search? Also try looking at the questions in the Related bar. For instance, the 3rd in the list is crypto.stackexchange.com/q/586/351 which seems to answer your question satisfactorily.
Dec 18	comment	Probability that an attacker wins the discrete logarithm game when exponents are drawn from a subset By the way, welcome to Crypto.SE! I hope you'll stay in the community. May I encourage you to read the faq, to learn more about this site?
Dec 18	comment	Probability that an attacker wins the discrete logarithm game when exponents are drawn from a subset @user52914, again, that is off-topic. If you want to discuss it, please post a separate question. The more you discuss it here, the more sorry I am that I responded to your second question at all. As far as explaining the site -- well, it sounds like you are not clear on how to use it properly and so I do need to explain the site policies. And no, it is not this way to maximize reputation of users -- it is this way to maximize the utility of the site as an archive of quality answers to relevant questions. Off-topic comments reduce the ability of others to find this information.
Dec 18	comment	Probability that an attacker wins the discrete logarithm game when exponents are drawn from a subset @user52914, hire a cryptographer to prove it for you? At a meta level: this has now deviated pretty far from the original topic of this question, so I don't think it's on-topic on this question. FYI, Crypto.SE is not a discussion forum: it's a question-and-answer site. One question per question. If you have a question about the design of a particular system, I think you'll need to post a separate question. If you do that, make sure you post detailed enough information about the design of the system that analysis is possible.
Dec 17	comment	Probability that an attacker wins the discrete logarithm game when exponents are drawn from a subset @user52914, as far as I can see, nothing terribly bad should happen. Releasing $y_1+y_3$ and $y_2+y_3$ doesn't reveal much more information than releasing $y_1-y_2$. And releasing $y_1-y_2$ does not help find $y_1$ or $y_2$ (though if you somehow manage to learn one of $y_1$ or $y_2$, obviously knowledge of $y_1-y_2$ reveals the other).
Dec 6	comment	Speeding up partially known plaintext preimage recovery attack on MD5 @poncho, ahh, yes, you are (of course) absolutely right. I missed that modchan told us the length of `B`. I've edited my answer accordingly. Thank you!
Dec 6	comment	How can I add more rounds to AES? @quantumSoup, yes, but Bruce also wrote: "choosing the number of rounds for a cipher is a combination of experience and guesswork. The AES rounds of 10, 12, and 14 were arbitrary, but represented the designers' best guess as to what would be secure. In my 2000 paper, I recommended increasing the number of rounds considerably, based on my best guess at the time. The round recommendations I gave above -- 16, 20, 28 -- are designed to restore AES's security cushion. They're off the top of my head, and certainly not the last word on the topic."
Dec 5	comment	Webcam random number generator @Thomas, Usually, the purpose of cryptography is to be secure against malicious attackers, not to "be creative". If you want to be secure, then you should use best practices, even if it feels like that's "repeating itself". A creative-but-insecure solution isn't going to help anyone.
Dec 4	comment	Sigma-protocol for 3SAT problem Welcome to Crypto.SE! This looks like an interesting question, but it would help to have a little more information. What have you tried so far? What research have you done on your own so far? As the faq suggests, it is important to "do your homework" and show us what you've done so far. I encourage you to read the links in this comment -- they may provide helpful background about this site!
Dec 3	comment	Bent Combining Functions @WilliamHird, OK, you are right! It does make sense to use standard terminology. I withdraw my comment about names. (A suggestion for future questions: maybe including the definition of the term you are asking about in the question would help others answer?)
Dec 3	comment	Is Convergent Encryption really secure? The probability of obtaining a weak key in this way is negligibly small (unless your crypto algorithm is incredibly broken). Better to worry about getting struck by lightning...twice...in the same hour.... or to worry that a cosmic ray may cause a bitflip error during the crypto computation and cause your secrets to be accidentally printed in the clear.
Dec 3	comment	Webcam random number generator I would want to see a lot more detailed analysis than that the idea "sounds good" before recommending this to users of cryptography. In other words: I don't think this is good advice to end users. I don't think it does a service to users to encourage them to roll their own entropy sources like this; I think giving users this kind of advice is likely to lead to increased incidence of poorly seeded crypo. Instead, I think it is better to stick to advising them to use standard, well-vetted crypto PRNGs provided by the system.
Dec 3	comment	Webcam random number generator @CodesInChaos, nonetheless, I stand by my comment. End users of cryptography shouldn't be rolling their own PRNG; they should use a standard system PRNG, and let the system designers take care of ensuring it has sufficient entropy. (Let the system designers choose to use webcam data if that is appropriate and improves security, but most users of cryptography should not be making decisions like this.)
Dec 1	comment	Webcam random number generator I've never heard of this randcam thing, and wouldn't recommend using it. Instead, I recommend using a standard random-number source, such as `/dev/urandom`, `CryptGenRandom()`, or similar (depending upon what platform your code is running on).
Nov 30	comment	AES timing attacks @cooky451, it's not that someone misses it -- it's that it clutters up the thread. I encourage you to post it here on this site, but just post it separately: as it is an almost entirely different question, it deserves a separate post (in my opinion).