D.W.

8,825 reputation

828

bio	website
	location
	age
visits	member for	1 year, 10 months
	seen	12 hours ago
stats	profile views	140

	8,825 reputation	bio	website		visits	member for	1 year, 10 months
828 badges		location			seen	12 hours ago

summary answers questions tags badges favorites bounties reputation activity

405 Comments

suggestions reviews revisions comments badges posts accepts all

Jun 2	comment	HMAC collision probability bounds @Eugen, Yes, absolutely. That's why I mentioned that the need for assumptions -- I even mentioned this twice, in case you missed them the first time. The entire point of making assumptions is that they have not been proven. If they'd been proven, we wouldn't need to list them as an assumption. Would you like to clarify what you're getting at? If you are only interested in answers that can be formally proven with no unproven assumptions whatsoever, then I suggest you edit your question to make this a lot clearer, as this significantly changes the question.
Jun 2	comment	With HMAC, can an attacker recover the key, given many known plaintext/tag pairs? @Eugen, people expect you to do some independent research of your own to try to answer your own question, and show your work (show what you've tried so far). In this case, reading an elementary textbook that describes chosen-plaintext attacks and describes the theory of message authentication codes should be enough for you to work out the answer on your own.
Jun 2	comment	More technical details on the ongoing (alleged) Chinese cyberattacks Discussion on meta: meta.crypto.stackexchange.com/q/277/351
May 28	comment	Size of Parameters in Polynomial Key-Splitting Algorithm @0xFE, yes, that's correct.
May 28	comment	Size of Parameters in Polynomial Key-Splitting Algorithm @RickyDemer, yes, I know, but at the level of understanding that this question-er is prepared for, I think my answer is simplest. (And I'm not aware of any significant reason why using $GF(p^n)$ is better than $GF(p)$, in practice.)
May 28	comment	Linkable ring signature scheme Welcome to Crypto.SE, sor.rge! Regarding your question about known vulnerabilities, have you done a literature search to look for follow-on work? Any published work that describes vulnerabilities in the scheme is likely to cite this paper, so a literature search should give you a better sense whether there are any known vulnerabilities and whether the scheme is state-of-the-art.
May 23	comment	Requiring a “supervisor” key pair and a “user” key pair to decrypt multiple-recipient messages Ahh, that makes a lot more sense. Thanks, @RickyDemer. If that is the intent, I think the question should be edited to be a clearer about the intent.
May 23	comment	Requiring a “supervisor” key pair and a “user” key pair to decrypt multiple-recipient messages I think there's something wrong with your proposal. How does step 1 work, if Bob knows the message and Jim doesn't? What does it mean to encrypt with a private key? (Are you talking about signing? Signatures are not the same thing as encrypting with a private key.) When you say "his", who does that pronoun refer to: Jim, Bob, or Mark?
May 22	comment	Hill-cipher, disordered alphabet user9, Please do not deface your question! This site is intended to be a question-and-answer site for the common good. In particular, when you post here, you accept that the community has some ownership of your question; you are not a sole owner. If you deface your question, you render it useless to others -- which is inappropriate, as the main purpose of this site is to be useful to the world, not just to you. It is considered inappropriate to deface or delete your own question after you received an answer. See, e.g., meta.stackoverflow.com/q/106807/160917
May 22	comment	How random are commercial TRNGS I think the question, as stated, is a perfectly fine question. It's not asking for product recommendations; it is asking about how one can evaluate a range of products out there. Seems like a great question to me! (The follow-on questions in the comments about specific products, however, are not good questions: they do not belong on this site. Search for "shopping question" to learn more about why not.)
May 22	comment	How much data can I encrypt with AES before I need to change the key in CBC mode? @makerofthings7, to understand what it means, start by understanding what 'advantage' means at a deep level. At a very rough, crude level, you can think of it as representing the probability that an attacker learns some information about the message. (However, strictly speaking, this is a simplification.) In this case, we are saying roughly "If you encrypt no more than $2^{48}$ blocks of data under the same key, the probability that the attacker learns some information about the message is at most $1/2^{32}$". Roughly.
May 20	comment	Is this a sensible cryptographic protocol intending to reduce the impact of compromised security? @MattFellows, well, here's one scenario that comes to mind: what if they breach one of those systems first, then use it as a jumping-off point to attack your server? P.S. If the server is only intended to be accessed by limited IP addresses, it might be worthwhile to set up a firewall (or TCP wrappers policy) to actively block connection attempts from any other IP address.
May 20	comment	Are there any hand ciphers not obsoleted by computer cryptanalysis? Thanks, @PaŭloEbermann. Yes, I'm aware of it. (For reasons that probably aren't relevant to anyone else, it doesn't work for me: on my primary platform, something on my browser's configuration makes the "close" link not work. Maybe an ad blocker or something, I've never taken the time to fully trouble shoot it. My apologies for cluttering things up with comments as a result.)
May 19	comment	Recommended way of adding a pepper/secret key to password before hashing? @TheDisintegrator, the pepper should be truly random (e.g., generated from /dev/urandom and kept secret thereafter). I don't know about what order your $hash_h mac$ accepts parameters in; I explain where the inputs should go in my answer. As far as how to call bcrypt, that will depend upon your particular language and library's API. If you want to know how to code this up, that's better for StackOverflow. You choose the work factor for bcrypt so that computing bcrypt takes, say, 50ms.
May 19	comment	Are there any hand ciphers not obsoleted by computer cryptanalysis? Duplicate of crypto.stackexchange.com/q/1653/351 (see also crypto.stackexchange.com/q/844/351).
May 18	comment	When truncating an AES MAC value by “w” , how do I justify that “w” is still negligible? @Maeher, I have a different take. I think it's a perfectly reasonable use of the term. Outside of complexity theory, the standard engineering meaning of the term "negligible" is "so small it can be safely ignored/safely treated as zero". That seems to apply fine here.
May 18	comment	Alternatives to HMAC + CBC? It doesn't matter whether you separate out the signature into a separate column or not.
May 17	comment	Is this a sensible cryptographic protocol intending to reduce the impact of compromised security? "The assumption that the compromise wouldn't be permanent is made due to monitoring of all network traffic." - That makes no sense. It is not accurate or prudent to assume that monitoring of network traffic will detect all, or even most, of all compromises (or of instances of exfiltration of data by an attacker). I'm afraid your confidence in ability to detect compromises is sorely misplaced. Just look at some of the APT threats that have managed to penetrate systems and avoid detection for years.
May 16	comment	Is this a sensible cryptographic protocol intending to reduce the impact of compromised security? This sounds like a better fit for the IT Security site. It's not really about the cryptography per se, but about threat mitigation. If you click "flag" and ask the moderators to move it, they'll do so.
May 16	comment	Understanding Feldman's VSS with a simple example @mikeazo, that's correct. With those parameters, the Legendre symbol doesn't leak anything about $s$: the Legendre symbol $(g^s\|p)$ will always be $1$, regardless of $s$, so no leakage. Actually, with those parameters, I don't see any way that $g^s$ leaks anything about $s$, so I don't know what the Wikipedia comment is referring to. (Maybe it's what happens if you don't choose $p,q$ that way? Maybe it's the fact that you can verify a guess at $s$ using $g^s$? Or something else entirely? The statement is unsourced, so I can't tell.)