20,776 reputation
32575
bio website
location
age
visits member for 3 years, 4 months
seen Dec 16 at 17:04

Oct
3
comment Reordering non-block-aligned parts with DES in ECB mode
Can you tell me the context where you ran into this? What makes you think it is possible to exchange the first line with the last? Why are you so set on that specific goal? That seems awfully specific (as opposed to, say, swapping some pair of entries of the attacker's choice). I assume you know that you can swap any pair of ciphertext blocks, and the corresponding plaintext blocks will be swapped? So if you can find a pair of blocks that, when swapped, leaves the format of the plaintext undisturbed (and such that the exchange is favorable to the attacker), that's a valid attack.
Oct
3
comment Using multiple secret keys
Yeah, that's not gonna work. Someone who is not physically at the specific location, but who knows where the specific location is, can still infer the key and decrypt the ciphertext. There's been academic work on this sort of problem (e.g., by Dorothy Denning), but it's a much harder problem than you seem to realize.
Oct
2
comment Extracting only the entropy
@Blaze, oh, good grief. No it doesn't. Read the paper. Nowhere does the paper say "/dev/random is no good". I challenge you to find anywhere where it says that. If you are thinking of the title ("/dev/random is not robust"), by 'robust' they are referring to a particular technical/mathematical definition of robustness. Failure to meet that definition doesn't mean that "/dev/random is no good". As the abstract says "it remains unclear if these attacks lead to actual exploitable vulnerabilities in practice".
Oct
2
comment Using multiple secret keys
Why do you want to use these keys? What are your goals? What threat are you trying to avoid? What are you trying to achieve? What bad outcomes are you trying to avoid?
Oct
2
comment Extracting only the entropy
@Blaze, OK, well, I'll put it this way then: it sounds to me like you may be drawing unwarranted and overly strong conclusions. The research you cite does not imply that "/dev/random is no good" (nor do the authors of those papers make broad claims like that). Be careful; cryptography is a subtle and nuanced business, you can't always reduce things to simple sound bites.
Oct
2
comment Paillier Crypto System : Pros and Cons?
Please also make sure to describe what research you've done. We expect you to show some evidence of effort on your own before asking. Make sure to read the help center.
Oct
2
comment Extracting only the entropy
@Blaze, careful there. There is no good way to do accurate entropy estimation (at least not in general, without knowing anything about the source). But be careful about what inferences you draw. That doesn't mean /dev/random is no good. In general, there's a lot of work on this sort of topic; I encourage you to read up on it before drawing too many conclusions.
Oct
2
comment Extracting only the entropy
@CodesInChaos, Ahh, that might explain it. Thank you! That would suggest the follow-up question: why does he/she want that? If we knew the source of this requirement, there might be a better solution. (Especially when /dev/random already exists...)
Oct
2
comment Extracting only the entropy
I don't know what you mean by "inject pseudo entropy". A hash does not inject entropy. I'm not familiar with "pseudo entropy" as a technical term. Can you tell us more about what your real problem is? You might want to edit the question to provide more context and to explain the particular application setting and what you're trying to achieve or what problem you're trying to fix.
Oct
1
comment Estimating bits of entropy
Can you tell us more? Why do you want to measure the amount of entropy? What do you know about the source of the byte stream? The answer is going to depend heavily on the answers to these questions and on other details, so if you can give us more details, we might be more likely to be able to give you a good answer. This is not a simple subject with a simple one-line answer...
Oct
1
comment How to calculate y value from ((y*y) mod prime) efficiently
Duplicate of crypto.stackexchange.com/q/6518/351
Sep
30
comment Are NIST's changes to Keccak/SHA-3 problematic?
@K.G., actually, no, I have it right in the question. Remember, I am summarizing the criticisms/concerns raised in the blog post. I have accurately quoted the concerns listed in that blog post. If you mean to suggest that the blog post has it wrong, feel free to post an answer explaining (indeed, I do suspect some possible confusion in the blog post; that's one of the things I was asking about) -- but it's not an error in the question.
Sep
30
comment What are requirements for this grille?
I don't understand the question. What makes you think there are any requirements on the grille? Where does this talk of rotation come from? As far as I know, there is no rotation: you use the grille you have. It looks to me like the question starts from erroneous premises. In any case, I'm having a hard time understanding what you are asking or what the question is; you might need to edit the question to provide more details and more motivation/justification for your assumptions (e.g., what rotation has to do with anything).
Sep
30
comment how to mathematically prove a key exchange algorithm
Welcome to Crypto.SE! Unfortunately, this question is probably too broad and open-ended to be a good fit for this site. What have you studied so far? What's the real problem you have in front of you? What's the context and motivation for your problem? Providing a more detailed and narrowly focused question makes it more likely that it will be possible to provide a useful answer, within the constraints of a StackExchange site.
Sep
30
comment Friedman Index of Coincidence, pruning multiples of the keylength
OK. I suspect, when the IC was invented, it was typically used together with human judgement, so there might not be any standard rules to address this issue. Anyway, it seems like it might be easy to add a special case for this situation: choose the one with the highest IC, except that if it has a divisor whose IC is within 5% of it, choose the divisor. Another plausible solution would be to try running the rest of your attack on both candidates. I would imagine either of these might work fine. Have you tried either of these approaches?
Sep
30
comment Friedman Index of Coincidence, pruning multiples of the keylength
Do you need a solution that is 100% automated (no human involvement), or are you OK with involving human judgement? If the latter, it seems pretty easy for a human to recognize this situation and choose the smaller keylength.
Sep
30
comment Are NIST's changes to Keccak/SHA-3 problematic?
Personally, I am skeptical that there is anything to worry about here, but I'm interested in a better answer about whether we should be concerned.
Sep
28
comment How to attack a fixed LCG with partial output?
@nightcracker, I think it does mean that. A $2^{16}$ attack means the generator is broken. It means absolutely no one should use the generator. At that point, who cares whether there is a $2^8$ attack? How will that affect your decision-making? If news of a $2^8$ attack will cause you to avoid the generator, when news of a $2^{16}$ attack wouldn't, then there is something wrong with your decision-making. P.S. If your question is about other generators like the Windows rand(), but different (say with larger parameters), then that's a different question: post a new question.
Sep
28
comment How to attack a fixed LCG with partial output?
@nightcracker, in that case, it sounds like your question is not about cryptography per se, so I don't think it is on-topic here. The cryptographic aspect of the question has been answered....
Sep
27
comment How much does a successful Distinguishing Attack “break” the attacked stream cipher?
It sounds like your real question is: "Does a distinguishing attack count as a complete break, from a practical perspective?" If so, you might want to re-write your question from this much more general perspective (whether it's a linear distinguishing attack or some other distinguishing attack is probably of limited relevance).