17,730 reputation
32063
bio website
location
age
visits member for 2 years, 8 months
seen 2 hours ago

Sep
28
comment How to attack a fixed LCG with partial output?
@nightcracker, in that case, it sounds like your question is not about cryptography per se, so I don't think it is on-topic here. The cryptographic aspect of the question has been answered....
Sep
27
comment How much does a successful Distinguishing Attack “break” the attacked stream cipher?
It sounds like your real question is: "Does a distinguishing attack count as a complete break, from a practical perspective?" If so, you might want to re-write your question from this much more general perspective (whether it's a linear distinguishing attack or some other distinguishing attack is probably of limited relevance).
Sep
27
comment How does Dissent protect against Sybil Attacks?
Have you read the research paper? That would be the best place to start, for this sort of question. (Often presentations don't include all of the detail; a lot of details are left to the paper, so you really need to read the paper if you want to answer detailed questions like this.)
Sep
25
comment Is this a structural weakness of Feistel networks?
pg1989, Ahh, now I see: you are uncertain about the definition of diffusion. The definition of diffusion is that each bit of the input affects all bits of the output. For instance, if you flip one bit in the input to the block cipher, then about half of the bits of the output of the block cipher should change. Notice that this doesn't impose any restrictions on what happens internally, inside the block cipher; it only has to do with how the inputs ultimately affect the final outputs of the cipher. See the strict avalance criterion.
Sep
25
comment How broken is a xor of two LCGs?
Many thanks, @fgrieu! You're right, that wasn't right. It should have been "top 40 bits of $x_0$", not "bottom 20 bits of $x_0$". Fixed. Thank you for spotting that!
Sep
25
comment Is this a structural weakness of Feistel networks?
What makes you think this "could violate the diffusion property of the cipher"? It looks to me like that's where your reasoning went awry, but without further details, I'm not able to diagnose with any more specificity what would help clarify this.
Sep
25
comment Is there any existing analysis for this construction to turn a tweakable blockcipher into a PRF?
Got it. Sounds like you should either omit the nonce from the question, or edit the question to explain this business more clearly. (Incidentally, this construction is going to impose some unfortunate limitations on how people can choose the nonce. If your block cipher admits a 128-bit tweak, and you want to encrypt messages up to $2^{40}$ blocks long, then you're only left with 88 bits for the nonce. In that case, it's not safe to generate nonces randomly: after $2^{44}$ nonces, by the birthday paradox, there's a good chance some nonce will be repeated. A bit painful.)
Sep
25
comment Is there any existing analysis for this construction to turn a tweakable blockcipher into a PRF?
@nightcracker, if you are sharing the same key with some other construction (not presented in the question), then that radically changes the question. You need to mention that! This question asks whether the MAC is secure in isolation, but even if this MAC is secure in isolation (if the key is not used for anything else), that doesn't mean it will be secure when combined with your encryption mode. I think, if you don't already have a proof of security for your combined construction, you are following a dangerous path -- this whole concept does not seem like a good idea to me....
Sep
25
comment Is there any existing analysis for this construction to turn a tweakable blockcipher into a PRF?
@nightcracker, sorry, I probably won't have time to look at the pre-print soon. Apologies about that. The alternatives that I suggest also allow for one-pass processing of a message in parallel with encryption. (On the other hand, if you want to share the same key for both the MAC and the encryption, that's a-whole-nother level of trickiness. At that point you really need an extremely careful security proof, and not just a handwavy sketch, because it is so easy to go awry. I would not trust any construction that reused the same key for both purposes without a super-detailed proof.)
Sep
25
comment Is there any existing analysis for this construction to turn a tweakable blockcipher into a PRF?
@nightcracker, (regarding your first comment:) yup, I understand that. I don't think that contradicts anything in my answer. I think my answer remains valid.... If I've missed some implication or connection or inference, you might need to spell it out, as I'm not seeing it.
Sep
24
comment What stops the Multiply-With-Carry Random Number Generator from being a Cryptographically Secure Pseudo-Random Number Generator?
@e-sushi, "statistical purposes" is not an answer to CodesInChaos's question. There is no statistical simulation ever done that will use $2^{256}$ outputs from such a generator.
Sep
22
comment Is SSH public key authentication weakened by 'none' cipher?
@CatalinPatulea, for SSH, compromise of your session is already devastating (because the attacker can insert a single command that places a backdoor into your account on the server), so leaving the session unprotected would be extremely dangerous.
Sep
22
comment Theoretical pi-based stream cipher
Your assumption that there are no patterns in the digits of pi, surprisingly, turns out to be false. Amazing, but true!
Sep
20
comment Is the inverse of a secure PRP, also a secure PRP?
@nightcracker, I don't know of any real-world examples of a PRP that's not a sPRP. (The closest is 3-round Luby-Rackoff -- i.e., 3 rounds of a Feistel network with an absolutely perfect F function -- is a PRP but not a sPRP. However, no one uses something like that in practice.) So, yeah, I think it's just a theoretical issue.
Sep
19
comment Explaining weakness of Dual EC DRBG to wider audience?
@Nemo, well... in some sense, yeah, you're out of the mainstream. The reason for this notation is that mathematicians have been studying elliptic curves for far longer than cryptographers have been using them in crypto, and mathematicians have used the additive notation ($eQ$ rather than $Q^e$), for reasons that make sense in the mathematical context. That said, many folks studying crypto have the same reaction you do, because they were initially trained on the integer discrete log problem rather than elliptic curve discrete log problem, and their intuition follows what they learned first.
Sep
19
comment Is the inverse of a secure PRP, also a secure PRP?
nightcracker, when you say PRP, do you mean "secure against chosen-plaintext attacks" (as in my answer), do you mean "secure against chosen-plaintext/ciphertext attacks" (what I call sPRP in my answer)? This affects the meaning of your question. I've edited your question to introduce one possible interpretation, but please edit the question if that isn't what you had in mind.
Sep
19
comment Is the inverse of a secure PRP, also a secure PRP?
@RickyDemer, huh! I didn't know that. Maybe the terminology isn't completely standard, or maybe I've been reading the wrong references. My recollection was that in the references I've seen, PRP = secure against chosen-plaintext attacks, strong PRP = secure against chosen-plaintext/ciphertext attacks (example: Boneh's class), but it's possible that different authors use different definitions, or that the definitions have evolved over time. Bellare and Rogaway's notes now refer to prp-cpa and prp-cca, to avoid ambiguity.
Sep
19
comment Is the inverse of a secure PRP, also a secure PRP?
@Reid, This is not a duplicate. The other question is related but not identical. The other question asks whether AES's inverse is a PRP, so the other question is only asking about AES (one specific example of a PRP). This question asks whether it is true that for every PRP, its inverse is also a PRP. That's a more general question. As a quick way to see that they are two different questions, they happen to have different answers: the inverse of AES is a PRP, but the inverse of a PRP is not necessarily a PRP. (See my answer below.)
Sep
19
comment Explaining weakness of Dual EC DRBG to wider audience?
@Sid, OK, I edited my answer to explain the mathematics as well. I apologize that my answer got so long. You can decide whether this will be of interest to them or whether it's just too darn much. If you're giving a presentation, pictures might help. :-)
Sep
15
comment bcrypt and pbkdf2 double hashing
@ytti, we generally try to mitigate that risk through test vectors, thorough testing, and code review. That's probably cleaner than adding more code (which provides more opportunities for bugs).