Reputation
22,422
Next tag badge:
107/100 score
18/20 answers
Badges
4 31 80
Newest
 Yearling
Impact
~497k people reached

Jan
15
comment Possible to use an accumulator to “license” or restrict the qty of certificates being used?
This proposed solution doesn't work. A signer can still re-use the nonce to sign multiple messages. Therefore, this scheme doesn't prevent a child CA from issuing more than the allowed number of certificates. (Of course, if the child CA does issue more than the allowed number of signatures, it might allow others to forge signatures that look like they came from the child CA, so it might have some negative consequences for the child CA, but that's a bit delicate and isn't quite what the question asked for.)
Jan
14
comment Possible to use an accumulator to “license” or restrict the qty of certificates being used?
This answer doesn't work. I think you are confused about what a $n$-time signature scheme is. A $n$-time signature scheme is a signature scheme that is secure as long as it is used only $n$ times. There is no guarantee that it's impossible to sign $n+1$ messages, and indeed every $n$-time signature scheme I've ever seen does allow signer to sign $n+1$ messages if he wishes (though this could enable others to forge additional signatures).
Jan
14
comment TimeStamp in Cache-time attacks on AES
This question appears to be off-topic because it is about the meaning of Intel x86 assembly instructions; this site is for questions about cryptography.
Jan
13
comment Automated testing of cipher security for import/export compliance
@TruthSerum, I still don't get it. In what sense does my answer not answer your question? Everything I wrote still applies. No, there is no known way to automatically test and grade the security of an arbitrary cipher. That's not how we do it in practice. Perhaps if you elaborate the question it will become clearer what you are looking for and/or why you think this doesn't answer the question?
Jan
13
comment Automated testing of cipher security for import/export compliance
@TruthSerum, you didn't state that in the question. Please edit your question, and this time make sure all relevant information is included in the question. Actually, I'm finding it difficult to guess exactly what you are asking or looking for. This is starting to look like a "chameleon question" (one that changes each time someone adds an answer); that's discouraged on this site and may discourage people from answering.
Jan
6
comment (Re-)Using deterministic IV in CTR mode / How to: deterministic AES
@SebastianS, if you have requirements on how much expansion is allowed (how much longer the ciphertext can be than the plaintext), then state that in the quesiton. Don't assume that convergent encryption cannot meet those requirements; there are certainly convergent encryption schemes with relatively small expansion. Nothing forces you to have 256 bits of expansion. Don't judge all of convergent encryption by one particular scheme with one particular set of parameters.
Jan
6
comment Is a Combined Linear Congruential Generator secure for cryptography?
See crypto.stackexchange.com/q/21212/351 for a general answer to this question..
Jan
6
comment (Re-)Using deterministic IV in CTR mode / How to: deterministic AES
@SebastianS, I can't understand what you are saying (your requirements do not seem to be stated very clearly, and I can't understand why you are rejecting convergent encryption), so I'm afraid I don't know how to help you. If you would like further help, I encourage you think about how to formulate your problem more precisely, and then edit the question.
Jan
6
comment What is the difference between CSPRNG and PRNG?
@cpast, I don't think that question (or the answer there) will help people with the confusion that my question is intended to get at. For instance, think of a typical reader who sees some awesome statistical PRNG (say, Mersenne twister) and thinks, hey, I bet I could use this for cryptography! I don't think the answer there is going to help them understand why that's a bad idea, and I don't think the question there will be meaningful to them. The question there also is a bit confused/unclear (a PRNG for key generation? no -- we use a CSPRNG for that). I think this is a better formulation.
Jan
5
comment (Re-)Using deterministic IV in CTR mode / How to: deterministic AES
@SebastianS, I can't understand what you are saying. (If you generate the IV as a hash of the plaintext, you'll still need to store it somewhere too, so I don't understand what your requirements/objections are.)
Jan
5
comment Is BBS used for generation of keys for any modem cryptosystem?
@111, right, but: if it doesn't have a security proof, then BBS has no advantages over competing schemes, so there would be no good reason to choose BBS.
Jan
5
comment Is a Combined Linear Congruential Generator secure for cryptography?
1. What research have you done? 2. What precisely is a Combined Linear Congruential Generator? 3. What makes you think it would be cryptographically secure? If it wasn't designed to be cryptographically secure, or wasn't vetted for that purpose, it probably isn't.
Jan
5
comment Luby-Rackoff on Feistel ciphers
Can you provide a self-contained description of the claim in those lecture notes (without requiring us to click elsewhere, and without relying upon a link that could disappear at any time)? How many rounds are we talking about? What kind of Feistel cipher?
Dec
22
comment Why shouldn't I use ECB encryption?
1. This is not good advice. Using encryption without authentication disregards about a decade of advice from cryptographers. Better would be to use authenticated encryption, as Ilmari Karonen recommends. 2. This answer seems to be superceded by Ilmari Karonen's answer.
Dec
22
comment Why shouldn't I use ECB encryption?
We expect you to do a significant amount of research before asking, and show what you've tried in your question. Seriously? You're asking why not to use ECB? The reasons are documented in about a billion places -- in textbooks, on the Internet (try a Google search), on Wikipedia, and on this site (as others have pointed out). Please do more research before asking. This is not a suitable question for this site.
Dec
16
comment How broken is a xor of two LCGs?
@RamchandraApte, OK, you probably know more about x86-64 than I do. Would you like to do a back-of-the-envelope estimate of the performance of this stream cipher, on x86-64? How many cycles does a 64x64 multiple take?
Nov
30
comment Does MD5 hash have quasi commutative property?
What do you mean by quasi-commutative? Please expand your question with additional details, examples, etc. to clarify what you are asking. Also, tell us what you've tried and what research you've done.
Nov
30
comment Issue about randomness : what if random looks “human” ?
What do you mean by "what if"? (Yeah, well, it could happen. So what?) I honestly can't tell what your question is. Are you looking for a discussion, or do you have a specific technical question you are looking for an answer to? "What would we say?" is not a specific technical question.
Nov
30
comment transforming RC2 keys to have effective minimum length in implementations with fixed effective lengths
Why are you using RC2? Don't use RC2. It's not a good choice for any new design. Use a better cryptosystem, e.g., AES in an authenticated encryption mode.
Nov
10
comment repeating-key xor and hamming distance
Hi @GabeHollombe, for new questions, I recommend you post a new question. But the short answer is: yes. If you guessed the key length correctly, you're looking at $\text{wt}(X \oplus K \oplus Y \oplus K) = \text{wt}(X \oplus Y)$, which is 2-3 bits. If you guessed it incorrectly, you're looking at $\text{wt}(X \oplus K \oplus Y \oplus K')$, which is about 3 bits (here all of $X,Y,K,K'$ are independently distributed English ASCII letters). ASCII lowercase letters are 0x61 to 0x7A, so the xor of four of those is close to uniform on its low 6 bits, and thus has 3 bits set on average.