20,347 reputation
32371
bio website
location
age
visits member for 3 years, 1 month
seen Sep 12 at 1:44

Sep
3
comment Why the symmetric key layer in PGP?
See crypto.stackexchange.com/q/14/351 and crypto.stackexchange.com/q/586/351 and crypto.stackexchange.com/q/5782/351, which already contain answers to your question.
Sep
2
comment What is the relation between hash chaining and chosen prefix attack
@user129789, it doesn't prevent collisions; it is just a strategy for dealing with collisions when building a hash table. And, the context of those lecture notes has nothing to do with cryptography, and thus nothing to do with this site.
Sep
1
comment What is the relation between hash chaining and chosen prefix attack
@user2726531, those lecture notes relate to non-cryptographic hashes. Here we are talking about cryptographic hashes. Moreover, now that I see the lecture notes, your use of the phrase "hash chaining" was ambiguous; in cryptography, the most natural interpretation of the word "chaining" is the Merkle-Damgaard construction used to build a hash function, which is apparently not what you meant. That's why I asked you to edit your question to define what you meant by hash chaining, but it seems you still haven't done that...
Sep
1
comment What is the relation between hash chaining and chosen prefix attack
You might want to edit the question to (1) define what you mean by hash chaining, (2) tell us what research you've done so far, and (3) where you've gotten stuck.
Sep
1
comment Feedback requested on a method of posting a message without revealing the author
I suggest editing your question to make clearer what the question is. It's important to have a clear, focused question, but right now the body of the question doesn't contain any questions (just statements).
Aug
30
comment The security of an encrypt-and-MAC
@RickyDemer, you are right (on both points). I mis-read your statement. Sorry about that. Thank you for your comments.
Aug
29
comment RC4 system pitfalls
You're still missing a lot of details. Can you provide the exact algorithms? e.g., what is the HMAC computed on? (on the ciphertext/on the plaintext?) How is the HMAC key for each segment chosen: is it the same for all files and all segments, or does it vary? How is the RC4 key for each segment generated? is it a function of some master key, and if so, what's the function? Can you specify the exact DH key exchange more precisely? How is the DH exchange authenticated? There are many possible problems; your question doesn't specify enough detail to analyze the scheme at a technical level.
Aug
29
comment The security of an encrypt-and-MAC
@zof, a one-time pad is impractical, for all the standard reasons (use search to find more discussion of this). See also the comment by fgrieu. (Ilmari, if you are deriving per-message keys from a master key using some computationally secure method, then it is not fair to call what you've got a one-time pad any longer.)
Aug
29
comment LogSpace Merkle Traversal
I suggest that you provide a self-contained definition of all mathematical notation and algorithms, in your question, so that people don't have to go look elsewhere to understand what is being asked.
Aug
29
comment Authentication protocols for authenticating devices to a server
Why don't you start by describing what you want "authenticate" to mean. Ultimately, after the server has "authenticated" the client, what do you want to be guaranteed? How will you use the information that the client is "authenticated"? In what way will you treat the client differently, and why? There are so many possible goals for authentication: to verify that you're talking to a client that's administered by someone in the same organization, that you're talking to a client that was authorized by one of your legitimate users, that you know the serial number of the device you're talking to...
Aug
28
comment How secure is this use of Ziv-Lempel encoding?
Can you give a self-contained description of the algorithm here? (Reading patents is absolutely miserable.)
Aug
28
comment Generate Elliptic Curve Private Key from User Passphrase?
If have a way to keep data secret from an attacker but ensure it is known to authorized users, then don't mess around with passwords or salts or anything: just use a cryptographic key that is known to authorized users but not available to attackers. On the other hand, if you don't have a way to do that, then no amount of additional salt (that's known to the attacker) will change any of my bottom line conclusions.
Aug
27
comment RC2, RC4, RC5 key length
Thanks, @Thomas, that's a good suggestion! I made the edit you suggested.
Aug
26
comment RC2, RC4, RC5 key length
Brownbat, nice, I like it. +1.
Aug
26
comment Lagrange Interpolation for finite field GF(2^8), for Secret Reconstruction
This question appears to be off-topic because it is about code review. Code review is out of scope for this site; see meta.crypto.stackexchange.com/q/303/351.
Aug
25
comment Generating an IV for ESP 3DES-CBC
I don't recommend using /dev/random, for a number of reasons (do a search here or on IT Security.SE to see why). Instead, use /dev/urandom or any crypto-quality pseudorandom number genreator.
Aug
25
comment Is there any research about cryptography on nondeterministic Turing machines?
[..] Also, w.h.p, the real key $K$ is the only key that fulfills all of these requirements, since there are about $2^{1780380}$ such input sequences and only about $1/2^{1000000}$ of them are consistent with the known keystream and only about $(1-1/e)^{1185858}=1/2^{784715}$ of the remainder pass the rest of the tests. Therefore, this attack will find the real key $K$ and output it.
Aug
25
comment Is there any research about cryptography on nondeterministic Turing machines?
Here's an attack that breaks your scheme. Suppose we have 1000000 bits of known (debiased) keystream. Guess $K$. Guess a 1876000-bit sequence containing at most 690142 0's; it is a possible input to the von Neumann debiaser. Test whether applying von Neumann debiasing to this yields the known keystream; reject if not. Guess $M_i$ for each position $i$ where this sequence has a 1 bit. Test whether $H(K,N,i,M_i)=0$ for each such $i$; reject if not. If all tests pass, accept and output $K$. w.h.p, the debiaser only needed $\le 1876000$ bits of input, and at most 690142 in its input were 0's. [..]
Aug
23
comment what is pairing in cryptography?
What reading have you done? What effort have you made? Have you looked in Wikipedia? Have you looked in modern textbooks? Have you searched via Google? Have you read course notes on the topic? We expect you to do some investigation on your own before asking here: ask only questions that you actually care about -- and if you care about it, do a little research on your own. In this case, it is very easy to find basic information on pairings (e.g., on Wikipedia).
Aug
23
comment The specification of modern, non-communicating cipher machinery
These questions all seem pretty standard, for applied cryptography. Have you read Cryptography Engineering, by Ferguson, Schneier, and Kohno? Or other good textbooks on applied cryptography? They'll tell you about things like how long your IV should be, why you need a message authentication code, how to resynchronize after corruption, etc. You should start by studying what is already known about computer-based systems, then analyze for yourself how they apply to your situation, and come back if there's anything that you can't work out from the standard references.