17,765 reputation
32063
bio website
location
age
visits member for 2 years, 8 months
seen 3 hours ago

Sep
6
comment Who uses Dual_EC_DRBG?
@MichaelKjörling, I don't think the standard reasons for discouraging link-only answers apply here. It is part of NIST's job to maintain the list of algorithms that they've validated, so I don't think they're going to just stop publishing the list. Moreover, they are the authoritative source of this information, and the information changes over time, so copying the information there into this answer would be a bad idea (this answer would get out of date). Bottom line: I think pointing to the authoritative source for this information is useful and appropriate, in this case.
Sep
6
comment Known-plaintext attack on Blowfish in ECB mode
@AntonSamsonov, I've edited my answer to explain in greater detail. For more detail, please read about the Hellman time-space tradeoff and rainbow tables to make sure you understand them before diving into this any further.
Sep
6
comment Known-plaintext attack on Blowfish in ECB mode
@AntonSamsonov, each step is one trial decryption of one block of data (e.g., the key setup + the decryption operation of Blowfish). The way that "rainbow tables" work is by inverting some one-way function $f(x)$. If $c$ is a Blowfish encryption of a known plaintext $p$, we can define $f(k) = E_k(p)$ and then use rainbow tables to find the $k$ such that $f(k)=c$.
Sep
4
comment Known-plaintext attack on Blowfish in ECB mode
Actually, @PaŭloEbermann, ECB mode can be much worse than other modes for key-recover attacks (because it makes it easier to do time-space tradeoffs, if you have a full block of known plaintext). However that doesn't seem to apply here.
Sep
4
comment Known-plaintext attack on Blowfish in ECB mode
What protection scheme are you referring to? (Is there some reason to keep it secret?)
Sep
4
comment Known-plaintext attack on Blowfish in ECB mode
Where did you encounter this? What application uses this scheme?
Sep
4
comment What is the relation between hash chaining and chosen prefix attack
@user129789, no it doesn't. That's a totally different sort of chaining than the one in the lecture notes you posted in your earlier comment. Like I said in my comment on the question, first you need to be clear about what you mean by "hash chaining", and edit the question to make that clear. You seem unclear on what you even mean by that phrase -- so how do you expect us to answer your question, if you're not even clear on what you're asking?
Sep
3
comment One-way function and $EXP$
"even if $P=NP$ this not immediately correct that we can easily invert one way functions" - Yes it is. If $P=NP$, all one-way functions can be inverted in polynomial time. This is a simple theorem. (Remember, a one-way function must be computable in the forward direction in polynomial time. This means if you have a guess at the inverse, you can check whether your guess is correct in polynomial time. That in turn means that finding the inverse is a problem in $NP$: it's a problem whose solution can be verified in polytime, which is basically the definition of $NP$.)
Sep
3
comment Why the symmetric key layer in PGP?
See crypto.stackexchange.com/q/14/351 and crypto.stackexchange.com/q/586/351 and crypto.stackexchange.com/q/5782/351, which already contain answers to your question.
Sep
2
comment What is the relation between hash chaining and chosen prefix attack
@user129789, it doesn't prevent collisions; it is just a strategy for dealing with collisions when building a hash table. And, the context of those lecture notes has nothing to do with cryptography, and thus nothing to do with this site.
Sep
1
comment What is the relation between hash chaining and chosen prefix attack
@user2726531, those lecture notes relate to non-cryptographic hashes. Here we are talking about cryptographic hashes. Moreover, now that I see the lecture notes, your use of the phrase "hash chaining" was ambiguous; in cryptography, the most natural interpretation of the word "chaining" is the Merkle-Damgaard construction used to build a hash function, which is apparently not what you meant. That's why I asked you to edit your question to define what you meant by hash chaining, but it seems you still haven't done that...
Sep
1
comment What is the relation between hash chaining and chosen prefix attack
You might want to edit the question to (1) define what you mean by hash chaining, (2) tell us what research you've done so far, and (3) where you've gotten stuck.
Sep
1
comment Feedback requested on a method of posting a message without revealing the author
I suggest editing your question to make clearer what the question is. It's important to have a clear, focused question, but right now the body of the question doesn't contain any questions (just statements).
Aug
30
comment The security of an encrypt and MAC
@RickyDemer, you are right (on both points). I mis-read your statement. Sorry about that. Thank you for your comments.
Aug
29
comment RC4 system pitfalls
You're still missing a lot of details. Can you provide the exact algorithms? e.g., what is the HMAC computed on? (on the ciphertext/on the plaintext?) How is the HMAC key for each segment chosen: is it the same for all files and all segments, or does it vary? How is the RC4 key for each segment generated? is it a function of some master key, and if so, what's the function? Can you specify the exact DH key exchange more precisely? How is the DH exchange authenticated? There are many possible problems; your question doesn't specify enough detail to analyze the scheme at a technical level.
Aug
29
comment The security of an encrypt and MAC
@zof, a one-time pad is impractical, for all the standard reasons (use search to find more discussion of this). See also the comment by fgrieu. (Ilmari, if you are deriving per-message keys from a master key using some computationally secure method, then it is not fair to call what you've got a one-time pad any longer.)
Aug
29
comment LogSpace Merkle Traversal
I suggest that you provide a self-contained definition of all mathematical notation and algorithms, in your question, so that people don't have to go look elsewhere to understand what is being asked.
Aug
29
comment Authentication protocols for authenticating devices to a server
Why don't you start by describing what you want "authenticate" to mean. Ultimately, after the server has "authenticated" the client, what do you want to be guaranteed? How will you use the information that the client is "authenticated"? In what way will you treat the client differently, and why? There are so many possible goals for authentication: to verify that you're talking to a client that's administered by someone in the same organization, that you're talking to a client that was authorized by one of your legitimate users, that you know the serial number of the device you're talking to...
Aug
28
comment How secure is this use of Ziv-Lempel encoding?
Can you give a self-contained description of the algorithm here? (Reading patents is absolutely miserable.)
Aug
28
comment Generate Elliptic Curve Private Key from User Passphrase?
If have a way to keep data secret from an attacker but ensure it is known to authorized users, then don't mess around with passwords or salts or anything: just use a cryptographic key that is known to authorized users but not available to attackers. On the other hand, if you don't have a way to do that, then no amount of additional salt (that's known to the attacker) will change any of my bottom line conclusions.