D.W.

8,034 reputation

827

bio	website
	location
	age
visits	member for	1 year, 9 months
	seen	13 hours ago
stats	profile views	137

	8,034 reputation	bio	website		visits	member for	1 year, 9 months
827 badges		location			seen	13 hours ago

summary answers questions tags badges favorites bounties reputation activity

379 Comments

suggestions reviews revisions comments badges posts accepts all

Oct 23	comment	How does one calculate the cryptoperiod? @D.H., many textbooks will mention this. It might be filed under "birthday attack on CBC". I like Cryptography Engineering and Handbook of Applied Cryptography for practical details about designing crypto. See also CBC key lifetime, or, “how big is too big?”.
Oct 23	comment	symmetric-key cryptography based key establishment techniques @fgrieu, sure! Wikipedia has some discussion of the flaw and fixes. For an introduction to Kerberos v4, I like Designing an Authentication System: a Dialogue in Four Scenes, though you're not going to get a crisp specification of the Kerberos v4 protocol in that paper. (I think there are RFCs with that, though I'm not sure.)
Oct 23	comment	Blum Blum Shub vs. AES-CTR or other CSPRNGs Perfect, thank you @PaŭloEbermann! I appreciate it.
Oct 23	comment	symmetric-key cryptography based key establishment techniques +1 to this answer. I don't know why this answer was down-voted. It is perfectly valid and responsive to the original question.
Oct 23	comment	symmetric-key cryptography based key establishment techniques It should perhaps be stated that PAKE isn't symmetric-key cryptography. PAKE protocols use asymmetric (public-key) cryptography internally, e.g., Diffie-Hellman or similar asymmetric cryptography. Also, using symmetric-key cryptography does not require relying upon a passphrase. You could have a pre-shared symmetric key, and use that for key derivation.
Oct 23	comment	Blum Blum Shub vs. AES-CTR or other CSPRNGs @PaŭloEbermann, perhaps my wording was crummy. Sorry about that. I was referring to a scheme that gathers imperfect entropy from multiple sources and uses them to generate crypto-quality pseudorandom bits. Think of `/dev/urandom` or Fortuna or Yarrow or that sort of mechanism. Dealing with non-uniformly distributed inputs of uncertain entropy is a major challenge. In contrast, a PRG is a scheme that takes a perfect seed (uniformly random distributed), which is easier (a stream cipher suffices).
Oct 23	comment	Is AES-256 weaker than 192 and 128 bit versions? @quantumSoup, thanks for asking! No, it's not intended to imply that at all. Sorry for giving that impression. I'm a huge fan of Bruce Schneier. He's arguably done more for the field of cryptography than any other single person, and he's a role model for me. Bruce's blog post is one of the more responsible ones on this topic. He explicitly says not to panic. I was thinking of others who were less restrained. But I'll edit the sentence, since I can easily see how it might give that impression.
Oct 22	comment	Problems with implementation of ElGamal using OpenSSL I suggest that you post a new question where you ask a single specific question (not: are there any errors in my code, but something more like "should I reduce this value mod p or mod q?"); in that question, use math, not code; and then close this question.
Oct 22	comment	Problems with implementation of ElGamal using OpenSSL Reading code is painful. I recommend that you remove the code and focus on figuring out how to ask a concise question that can be expressed without requiring us to read code. Conceptual questions are much better suited to this site's format, and more likely to be relevant to other readers. For example, you said "several parts of the book do not agree with things i've found online"; perhaps you might try identifying one of those where you've seen conflicting advice, and asking what is the right procedure?
Oct 20	comment	Self-expiring symmetric keys, or: cryptography in absence of secure deletion @vincenzoml, I already gave an example of such a solution in 3rd paragraph of my answer ("an example of such a solution: ..."). If this example does not meet your needs, then I encourage you to edit the question to clarify the threat model and application domain and in what ways this falls short of your needs. It would help to understand better what you're looking for and how you will evaluate candidate answers.
Oct 19	comment	Using pairings to verify an extended euclidean relation without leaking the values? Also, I don't understand what information is known to which parties. Who knows $s$? Who knows $S$? Does anyone know the polynomials $P_i(x)$ and $q_i(x)$? Who knows the value of $P_i(s)$ and $q_i(s)$ (these polynomials evaluated at $s$)? And, your definition of $P_i(s)$ does not seem to have any dependence on $i$. Did you mean to use $S_i$ instead of $S$ in that equation? If so, who knows the $S_i$'s?
Oct 19	comment	Using pairings to verify an extended euclidean relation without leaking the values? There seems to be a typo or grammatical error in the question, which has me lost. "...for some secret s that the prover which is...": is there some word or sequence of words missing in the middle of this?
Oct 18	comment	Is secure remote snap possible? @mikeazo, it returns the intersection. (But it could be modified, e.g., by pre-hashing all elements or something.) Why do you say this will not work?
Oct 18	comment	Is secure remote snap possible? @RickyDemer, Right, I mis-spoke. I've fixed it. What I intended is that you apply private set intersection to the set of individuals (a subset of $U$), not the set of IDs, but somehow what came out of my fingers didn't match what was I intended. My mistake! $P_1$ has a set of individuals ($f_1^{-1}(a)$), and $P_2$ has another set ($f_2^{-1}(b)$); a private set intersection protocol lets us check for non-empty intersection; the set of individuals never leaves $P_1$ or $P_2$, but we have a way to learn whether $P_1$'s set $P_1$ has any overlap with $P_2$'s set.
Sep 16	comment	Encryption scheme with equivalent keys? @Harel, OK, thanks! Well, that's the best I can do at the moment. A friendly suggestion: It's possible you might get better answers if you ask a separate question where you list your requirements: e.g., explaining your application and listing in what ways broadcast encryption is not suitable. Right now your question pre-supposes that a particular mechanism (based upon equivalent keys) is going to be the best way to solve your actual problem. It's possible that presupposition might be false.
Sep 16	comment	Encryption scheme with equivalent keys? Yes, thank you @fgrieu! I've edited my answer to fix this. Thanks for pointing it out!
Sep 15	comment	Encryption scheme with equivalent keys? If that's what you want, you should look at the literature on traitor tracing, watermarking, and such topics. There's been a great deal of research on solving that problem -- though it doesn't necessarily take the form you have described. For instance, Bluray's AACS scheme is a good example of a state-of-the-art approach to this problem. There is a lot written about AACS on the Internet.
Sep 15	comment	What is a “rewinding argument”? Thanks, @RickyDemer. You have a good point: rewinding arguments can be used in showing soundness of other interactive arguments / proofs of knowledge (it is not limited to just zero-knowledge proofs). In my defense, I did mention in my answer that "rewinding arguments can be used to show soundness", but I appreciate your reminder that this applies more broadly than zero-knowledge proofs. That's a great point.
Sep 8	comment	What is the harm if I publish an encrypted RSA private key publicly? @DustyWilson, CodesInChaos's point remains valid. Given what we know about how users choose passwords, your proposed method is probably not very safe. (P.S. I don't understand why you think this is more secure than publishing a list of password hashes in the same location as you are currently publishing the password-encrypted private keys. Seems roughly comparable to me: neither one is very secure.)
Sep 8	comment	Are picture files “random enough” to be usable as a one-time pad? Yes, it is insecure. The "number of configurations" is not the parameter that is relevant to security. The security of the one-time pad relies upon the requirement that the pad be truly random, with no patterns whatsoever. Violate that requirement, and it's not a one-time pad any longer. Anyway, the one-time pad is not really suitable for practical use in any case, so this is pretty much moot in practice anyway. Use modern crypto; its key generation time is negligible.