meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 1 year, 9 months |
| seen | 1 hour ago | |
| stats | profile views | 137 |
|
Apr 16 |
comment |
May the problem with DES using OFB mode be generalized for all feistel ciphers I suggest amending your citation to provide a complete citation. (List the authors and the year. When you say Advances in Cryptology, do you mean the CRYPTO conference, and if so, what year?) |
|
Apr 16 |
comment |
Correct way to map random number to defined range? This seems to be essentially a duplicate of crypto.stackexchange.com/q/5708/351 Ideally, the two would be merged. |
|
Apr 16 |
comment |
Perfect secrecy and change of plaintext probability distributions Welcome to Crypto.SE, Student! Can you show us what you've tried so far? Where did you get stuck? Have you tried proving it for some special cases, like specific examples of a non-uniform probability distribution on the plaintext? Can you give us an example of a probability distribution where you are unable to prove your desired result? Make sure you read the FAQ and our advice on asking these sorts of questions. |
|
Apr 5 |
comment |
DSA signatures with related k and unknown payloads @poncho, ahh, thanks, that is much better. I've revised my answer accordingly. Thank you! |
|
Apr 5 |
comment |
DSA signatures with related k and unknown payloads @poncho, I don't understand the attack you have in mind. Care to elaborate? Are you sure what you are talking about works? How is the attacker going to apply the standard DSA signature algorithm to the message without knowing $x$ or $k$? (Keep in mind, neither $k$ nor $x$ are known to the attacker a priori.) |
|
Apr 5 |
comment |
How can mega store my login details and still be secure? @hunter, OK, I revised my answer in response to your suggestion. Thanks for the helpful comments! Keep 'em coming! |
|
Apr 5 |
comment |
DSA signatures with related k and unknown payloads The assumption that you don't know the messages is not very realistic. (And if you do know the messages, this is easy to break using Gaussian elimination, as described in the other question you linked to.) |
|
Apr 5 |
comment |
Attack on DSA with signatures made with k, k+1, k+2 I think it might be better not to give the entire answer to someone who asks about a homework question. Instead, in the future I suggest just giving a hint and let the person work on the problem on their own. One learns by trying, not by reading a finished solution written by someone else, so I think it's kinder to just give a hint than to provide a complete solution. But it's your choice. See also meta.crypto.stackexchange.com/a/98/351 |
|
Apr 5 |
comment |
Understanding one-way hash functions construction Are you looking for references on ciphers, or on hash functions? They are very different beasts. I suggest you pick one and edit the question appropriately. |
|
Apr 5 |
comment |
How can mega store my login details and still be secure? "even if a simple hash was used, [...] there's no way for an attacker to verify that they've decrypted the key successfully without actually attempting to decrypt your data with it, which would be too time-consuming" - This is incorrect. Doubly incorrect, actually. 1) There is a way to verify a guess at a password without decrypting all your data. To verify a guess at your password, hash it, compute the resulting decryption key, and then just decrypt some of your data and see if it looks correct. 2) This is not too time-consuming. It'd be a serious threat, if they used a fast hash/KDF. |
|
Mar 28 |
comment |
How to design a practical and secure MAC scheme? Say you use HMAC$_K(v|l|s|p)$ for a $PEB \leftrightarrow LEB$ mapping, and HMAC$_K(x)$ for some other purpose (say, authenticating the hash of the volume name). Note that both $v|l|s|p$ and $x$ are exactly 160 bits long. Therefore, given an $x$ that is the hash of a volume name, the attacker can parse $x$ as $x=(v|l|s|p)$, and then the attacker knows a valid MAC on a $PEB(p) \leftrightarrow LEB(v,l)$ mapping that doesn't actually exist -- a security violation. For a slightly different perspective on this, see this answer. |
|
Mar 28 |
comment |
How to design a practical and secure MAC scheme? If the only thing you use the key $K$ for is for MACing the combination $v | l | seqnum | p$, you're good: you don't need to worry about doing anything more. If you also use the same key $K$ to MAC other things (in a different format), then you have to worry about it (you don't want a MAC on a record with different semantics to be replayable as a $v | l | seqnum | p$ record ... if you follow my drift). |
|
Mar 27 |
comment |
How to design a practical and secure MAC scheme? This might get better responses on security.stackexchange.com (since it is not about how to invent a new crypto primitive, but rather how to use existing tools in a particular domain). You can click the "flag" button to ask that it be moved there. |
|
Mar 25 |
comment |
Are safe primes $p=2^k \pm s$ with $s$ small less recommandable than others as a discrete log modulus? Thank you for the fantastic answer! Great stuff! |
|
Mar 22 |
comment |
Sensible usecase for restricting special characters in passwords? This looks like a duplicate of Why Not Allow Special Characters In a Password? on IT Security (a sister Stack Exchange site). That page has good answers. (Incidentally, for future reference, this sort of question would probably be a better match for IT Security than for Crypto.) |
|
Mar 21 |
comment |
How would one crack a weak but unknown encryption protocol? Please don't post the same question on two sites. Instead, flag one of them to ask the moderator to move it to the other site (you can click the "flag" button to ask that it be moved). We don't want a copy of the same question on two different sites. |
|
Mar 18 |
comment |
What is total key space in transposition algorithms Hi @SKh, Thanks for your interest. For your question about time complexity, you should post a separate question about that, if you want an answer to it. I'm afraid I'm not going to answer that question here. I'm not trying to be rude; it's just how this site works. Please read the FAQ for an explanation of why -- this is a question-and-answer site that attempts to provide archival-quality answers (one single, specific question per page). It is not a general discussion site. |
|
Mar 18 |
comment |
What is total key space in transposition algorithms Glad you found it helpful, @SKh! If it answered your question, please feel free to click the checkmark under the score to mark it as your accepted answer. As for time complexity, that's a different question and should be asked in a separate question, to keep things clean. |
|
Mar 18 |
comment |
Understanding a Blowfish cryptanalysis @Psyberion, yes, a clear pencil-and-paper picture of the last 2 rounds of Blowfish, labelled with the various quantities, will help a lot. Hint: the figure you have shown isn't quite right. It's missing the final xor done in the last round of Blowfish. It also is not labelled with $C$/$L$/$R$. (You copied a figure from the paper. That figure was intended to illustrate the iterative characteristic, not to show what's going on in the last 2 rounds.) Being able to prepare such a figure will be a very helpful stepping stone for understanding what's going on here. |
|
Mar 18 |
comment |
Does Linear Cramer-Shoup have pseudo-random ciphertexts? The OP is not asking about IND-CCA2 security. The OP wants to know if the ciphertexts are computationally indistinguishable from uniform random. That's not implied by IND-CCA2 (you can have IND-CCA2, but not uniform random ciphertexts). |
