17,875 reputation
32063
bio website
location
age
visits member for 2 years, 8 months
seen 4 hours ago

Jun
20
comment Recommended authenticated stream cipher for minimum overhead?
[@Nuoji, Oops, I just realized my last comment had a massive typo. I'll re-print it, but this time with a correction. See also my edited answer.] No, a counter is not equivalent to a running hash. I'm suggesting a running hash as a hardening measure, so that it's hard to forge a single packet and then allow the other packets through unchanged. A counter doesn't provide that same benefit.
Jun
14
comment Encrypting and MACing different data with same key
@curious, yes, it's safe to use the same MAC key to authenticate multiple messages/packages.
Jun
14
comment Would this simple encrypted chat program be feasible using One Time Pads?
@zuallauz, Sorry to hear that you viewed this as a personal attack. It wasn't meant that way. My focus is on the scheme, not about you as a person. My comments are not meant to be disparaging, but to help guide design of such a mechanism. The purpose of this site is to serve as a general reference for others who come across this question (e.g., by searching), so it's not just for you: it's for everyone else who comes to this page. When doing cryptographic design, being open to consider potential threats and failure modes of one's own ideas is a valuable skill.
Jun
13
comment Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
@zuallauz, I see many misconceptions here. Again, as I stated before, what you are calling "pseudorandom" is perfectly fine for this purpose. Also, if SSL is broken, you have far bigger problems: other attacks become possible. The OTP is a poor choice for practical security. Finally, if you need very high-assurance security, for heaven's sakes, don't use Javascript and the web to implement it!
Jun
12
comment Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
@zuallauz, Ahh, I see, Javascript! Right. For Javascript, see my edited answer. (This would have been a good requirement to list in the original question.) For /dev/random vs /dev/urandom, you've been misled by a poorly written man page: that's a very common misconception, but it's still wrong. See security.stackexchange.com/q/3936/971 and security.stackexchange.com/a/14314/971
Jun
12
comment Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
As far as I know those theoretical constructions have no known practical advantages over simply hashing it all using a cryptographic hash function.
Jun
12
comment Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
@zuallauz, "I need actual random not psuedo random" - I very much doubt this. The entropy sources I listed are designed to be cryptographic-strength: i.e., adequate for generating cryptographic keys. (Moreover, the kind of approach you were sketching in your question also generates pseudorandom numbers, not true random ones, so if pseudorandom is insufficient for some unlikely reason, the approach you were sketching is insufficient too. But realistically I think you've misinterpreted the requirements for generating cryptographic keys.)
Jun
12
comment Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
@zuallauz, "language... does not have access" - Are you sure? What language and platform are you using? (Those primitives are generally available to all user-level programs; you don't need root or administrator permissions to access them.)
Jun
12
comment Have these compositions of block ciphers the same security?
"Such a result would totally destroy the triple DES scheme" - This is not true. The first 4 paragraphs of your answer, and the last paragraph, are fine -- but the business about $k_1,k_2,k_3$ is not correct. I would suggest you edit the answer to delete the paragraphs "But in general....as bad as single-DES".
Jun
11
comment Have these compositions of block ciphers the same security?
@user7060, I'd answer the same for AES.
Jun
10
comment What's efficient MPC protocol for determining if sum's bigger than y?
@Richard, yes, the input size is likely to matter (at least if you use a boolean circuit).
Jun
9
comment Which areas in CS will be (or have been) most affected by fully homomorphic cryptography?
@c3ntury, a great first step would be to do some reading on these topics. That will likely give you a much better sense of how to focus your essay. Start by searching for "homomorphic" on this site and on Wikipedia and on Google; you'll find some good information and some pointers to where to learn more, and that ought to give you a reasonable overview, for starters.
Jun
9
comment Which areas in CS will be (or have been) most affected by fully homomorphic cryptography?
What research have you already done? We expect you to do some research on your own before asking here. (And, by the way, a bit of friendly advice: do your own homework. There's a reason your instructors assign you homework: because it will help you learn!)
Jun
8
comment Can substrings of a long string be efficiently authenticated?
@RickyDemer, once again, you are right and I was wrong. Sorry about that; I don't know what I was thinking.
Jun
6
comment Does collision resistance stay when extending a hash function to a set domain?
Richard, I think we need you to specify whether the product is in $\mathbb{N}$ (the integers) or in some other group. I understand you want to leave it unspecified, but the answer depends heavily upon whether this is over the integers or over some group (and if the latter, which group).
Jun
6
comment Block cipher fixed points
On algebra and block ciphers, you should separate that out into a separate question: post a separate question with that. (It might be a bit too broad or open-ended to get good answers, but you can try.) Are you familiar with, for instance, the results that DES encryption is not a group (does not generate a small subgroup)?
Jun
3
comment How insecure in practice?
Thanks for the great edits, @JohnDeters!
Jun
3
comment With HMAC, can an attacker recover the key, given many known plaintext/tag pairs?
@PaŭloEbermann, I don't think that's right. If the key space is too small, then it's not secure against known-plaintext attacks. If you know that it is secure against known-plaintext attacks, then you know that the key space has to be large enough to avoid brute-forcing.
Jun
2
comment HMAC collision probability bounds
@Eugen, Yes, absolutely. That's why I mentioned that the need for assumptions -- I even mentioned this twice, in case you missed them the first time. The entire point of making assumptions is that they have not been proven. If they'd been proven, we wouldn't need to list them as an assumption. Would you like to clarify what you're getting at? If you are only interested in answers that can be formally proven with no unproven assumptions whatsoever, then I suggest you edit your question to make this a lot clearer, as this significantly changes the question.
Jun
2
comment With HMAC, can an attacker recover the key, given many known plaintext/tag pairs?
@Eugen, people expect you to do some independent research of your own to try to answer your own question, and show your work (show what you've tried so far). In this case, reading an elementary textbook that describes chosen-plaintext attacks and describes the theory of message authentication codes should be enough for you to work out the answer on your own.