19,582 reputation
32171
bio website
location
age
visits member for 2 years, 11 months
seen 44 mins ago

Jun
18
comment SHA1 collision event probability after n iterations
Did you look at crypto.stackexchange.com/q/15068/351 ? (Did you remember to use search before asking?)
Jun
18
comment SHA1 collision event probability after n iterations
What do you think? What have you tried? Where did you get stuck? Where did you run into this question? What is the context/motivation for your question? This is not a site where you copy-paste your exercise and we do your exercise for you.
Jun
18
comment What are good combinations of public key algorithms or primitives for long term security?
I wouldn't recommend lattice-based methods at this point in time, for long-term security; they haven't been studied in as much detail as others. It wouldn't be shocking if someone discovered a new attack 10 years from now that breaks them significantly faster than we currently know how to.
Jun
11
comment Does this protocol provide Perfect Forward Secrecy / are there potential security flaws?
Please make sure to provide a specific technical question in the body of the question. The title is for, well, a title -- and does not replace to need to ask a specific question in the body of the question.
Jun
7
comment Security of a security protocol for key exchange, using symmetric-key cryptography
OK, I see, I apologize for my misunderstanding.
Jun
7
comment Obfuscate an “I'll reveal if you do” function
An interactive commitment protocol would be fine, as long as the verification is non-interactive (given an alleged opening of the commitment from Alice, Bob can check entirely on his own whether it is indeed a valid opening). If this problem gets easier for Naor commitments, that would be fascinating and useful!
Jun
7
comment Obfuscate an “I'll reveal if you do” function
@mikeazo, I don't recall what the standard definition of a commitment scheme is; my recollection is that it doesn't really matter what $V(C(x,r),x,r')$ outputs, if $r \ne r'$ (it could output either $0$ or $1$, and no harm would be done either way).
Jun
7
comment Update to “Cryptographic Right Answers”
@otus, absolutely! You make a very timely and accurate point. The challenge is to find a simpler protocol that one can recommend to developers to provide a secure channel. I'm not aware of one; but maybe you have some suggestions?
Jun
7
comment Obfuscate an “I'll reveal if you do” function
Thank you! Yes, I do have an a-priori bound on the length of $x$ and $y$, so that removes one possible complication. It would be fine to use any commitment scheme that makes the obfuscation task easy, so if Merkle tree based commitments make obfuscation easier, that would be fine.
Jun
6
comment Attack on a key-exchange,symmetric-key cryptography protocol
I don't understand this answer yet. Are you thinking of gathering this information for all possible values of the nonce? Normally, nonces are chosen to be from a large enough space that such an attack will be wildly impossible: e.g., a nonce might be a random 128-bit number. Would you like to try editing your answer to clarify what attack you had in mind and what security property is violated by your attack?
Jun
5
comment Universal Circuits in Indistinguishability Obfuscation Candidate Construction
I don't know. Maybe the security proof requires use of the universal circuit? (e.g., to ensure the branching program will have the same structure regardless of what the original circuit is, or something)
Jun
3
comment Theory for pre-paid debit card: card-to-card transfer
That's one kind of approach. The other kind is to use a coin-based scheme for e-cash, e.g., Chaum-style e-cash (based upon blind signatures).
Jun
3
comment Theory for pre-paid debit card: card-to-card transfer
What research have you done?
Jun
2
comment Which one of the Block Cipher modes is the best?
There is no "best". Best for what purpose? They have different characteristics. Those characteristics are well-documented.
Jun
2
comment Security of a security protocol for key exchange, using symmetric-key cryptography
Have you tried using an automated protocol analyzer, like AVISPA, ProVerif, CryptoVerif, Scyther, Tamarin, EasyCrypt, CertiCrypt, Maude-NPA, etc.?
Jun
2
comment Why is plain-hash-then-encrypt not a secure MAC?
@IlmariKaronen, Good point! This is worth considering and discussing. Looks like there are many possibilities. Another possibility that might make even more sense would be to close this question as a dup of crypto.stackexchange.com/q/6069/351, since they are both specifically about stream ciphers. (I do not suggest closing Gilles' older question as a dup of this one; I think Gilles' older question is better-written and better-researched, whereas I find this question a bit confusing and hard to follow.)
May
31
comment Security of the iterated Hill Cipher
@LinearAlgebra, OK, I've edited my answer to show how to break the revised scheme, given your updated question.
May
31
comment Creating a license system based on asymmetric encryption (RSA or ECDSA)
@CodeX, sure. I expanded my answer to elaborate further on revocation (your question #3) and stolen private keys (your question #4).
May
31
comment Why is plain-hash-then-encrypt not a secure MAC?
@e-sushi, this question asks whether $\text{Encrypt}(M || H(m))$ is secure, where $H$ is a hash (not a MAC). The question I linked to asks whether $E_k(M || H(M))$ is secure. It's the same question. OK, the latter question focuses on CBC encryption, but the answers there show an attack when $\text{Encrypt}$ is CBC mode encryption, which already answers this question and shows that this question's scheme is not secure in general. And the case of stream ciphers is already handled by crypto.stackexchange.com/q/6069/351. So this question is completely subsumed by existing questions.
May
31
comment Why is plain-hash-then-encrypt not a secure MAC?
possible duplicate of Does CBC encryption of a hash provide authenticity?