19,622 reputation
32171
bio website
location
age
visits member for 2 years, 11 months
seen 17 hours ago

May
31
comment The improvement of the private key exponent in the M.Weiner Attack
I'd expect you to do more research on your own before asking here (on this site we expect you to do a significant amount of research before asking). In the future, one way to answer this sort of thing on your own is to do a literature search.
May
22
comment how to use common modulus attack?
This is not a homework-answering or exercise-solving service. We want to help you, but we can't do that if you haven't shown us what you have tried. So, I suggest you edit the question to show us what you have tried and where you got stuck. Finally, make sure you give proper attribution to the source where you copied this from.
May
22
comment Which tamper-protection algorithm provides the shortest output?
@Gilles, as you say, there are two separate issues: (1) uses out of context, and (2) replays. In my opinion, a good solution needs to solve both ("you may want to" is not enough). In my opinion, this is something that is not optional; it's mandatory, if we want to deploy this in practice and be secure. So, I think this answer would benefit from more on how to handle the practical security challenges (the hard parts of this problem are not the crypto algorithms but how to ensure they'll be used appropriately in practice). Optional security will often fall short, because it be left disabled.
May
22
comment Security assessment between $g^{a_ix_i+r_i}$ and $g^{x_i+r_i}$
@curious, that belongs in your question. Don't ask "chameleon questions", where new requirements get revealed or drip-fed to us only after someone posts a valid answer to the original question. Think through your requirements and all relevant information, and make sure they are present in the question from the start.
May
22
comment Security assessment between $g^{a_ix_i+r_i}$ and $g^{x_i+r_i}$
Why are you trying to invent some new mechanism? Why aren't you using standard "semantically secure" public-key encryption? (You can use additively homomorphic public-key encryption, if that's what you need.) Also, I agree with the comments that the requirements don't seem clear. Finally: please edit the question to include all relevant information in the question itself. Don't just drop them in the comment thread. Comments exist only to help you improve the question, and the question needs to stand on its own (without having to read the comments).
May
22
comment Which tamper-protection algorithm provides the shortest output?
This answer is not sufficient, because it doesn't provide freshness (it doesn't prevent replaying of old values). The fact that your scheme provides both confidentiality and integrity/authenticity for all values is a good thing, though.
May
22
comment Which tamper-protection algorithm provides the shortest output?
This answer is not sufficient, because it doesn't provide freshness (it doesn't prevent replaying of old values). Also, in practice you probably want to encrypt by default, too, because if you make encryption optional it is too easy for there to be some value that was confidential but where you forgot to enable encryption.
May
22
comment Cryptographic pseudo-random generation of address subsets
I don't understand the third solution. Are you assuming that each device can see all other addresses broadcast by all other devices (reliably, without missing one), and can store all of them? That doesn't seem very realistic. 1. It requires lots of storage: far more than your first solution. Thus, it seems much worse than the first solution. 2. It seems fragile. For instance, what if one device fails to overhead some broadcasts? What if you add a new device later? It will have missed all prior broadcasts.
May
22
comment Cryptographic pseudo-random generation of address subsets
Is there something wrong with storing $X$ addresses on each device? It looks like $X$ is quite small, so this should be a very reasonable solution (with excellent security, and simple to implement), unless your devices have extremely limited storage.
May
22
comment Can you determine an unknown value when it is combined with a known value and you are given the resulting hash?
How much entropy does the hidden string have? What have you tried? Are you familiar with the random oracle model? Have you tried figuring out what answer you'd get in the random oracle model? For that matter, what have you tried? Please edit the question to show your work.
May
14
comment Cryptographically secure keyed rolling hash function
@cyril42e, I don't know. That sounds a bit dangerous to me, because the collision probability of the rolling hash is too high. (It'd be nice if the collision probability were negligibly small, e.g., $\Pr_k[R_k(x)=R_k(y)]$ to be very small (say, at most $1/2^{80}$) for all $x,y$ where $x\ne y$, but that's not attainable with a 16-bit or 32-bit rolling hash.) As a result, your scheme might leak significant unwanted information about the message, even if it is a secure PRF. (I don't know if it is a secure PRF; I'm not sure I understood the proposal exactly.)
May
13
comment Hash collision resistance of $\mathcal H^\prime(m) = \mathcal H(\mathcal H(m)|m)$
@jthill, you're right. I don't have a working attack with Joux multicollisions. I'm still skeptical. Without a proof, I don't know how we could be confident that this construction adds any security (Joux multicollisions are an example of something that showed simple intuitions regarding techniques for strengthening hashes can be very wrong). I'm not at all confident that this construction cannot be attacked -- maybe it does have nice security properties, but I think we'd need a proof before we could trust that it does.
May
12
comment Finding the LFSR and connection polynomial for binary sequence.
Cross-posted on Math.SE. Please don't cross-post. That fragments answers and violates site rules.
May
12
comment are deterministic pseudorandom based hash functions chaotic?
Again, I suggest you edit your question to try to provide a precise technical definition. You might start by quantifying what "small" means in this context, and what you mean by a "difference", and what you mean by "initial conditions", in this specific context. If you can't do that.... you might want to re-think your "not a buzzword" stance. This site is best used for well-posed technical questions, not for open-ended or subjective discussions, so it's important to spend a lot of thought into how to frame a precise technical question.
May
12
comment are deterministic pseudorandom based hash functions chaotic?
"chaos", "deterministic chaos" - that's not a useful concept in crypto (they're buzzwords). Anyway, you haven't defined those terms. I suggest you edit your question to provide a precise technical definition of what you mean by chaos, and what the motivation/context for the question is, and what problem you're actually trying to solve.
May
12
comment Cryptographically secure keyed rolling hash function
You got 50 or 56 MB/s, and your goal was about 60 MB/s: sounds like you're basically done. Intel processors are widely deployed on servers, and modern Intel processors do support AES-NI. If in your application domain the processors typically don't support AES-NI, then you might want to measure what processors are used by your users (hint: make sure to measure), then do some research on other efficient block ciphers/PRFs (there are other candidates). SipHash is probably fine, if it meets your performance requirements, but I haven't studied it in detail. 128-bit keys are plenty.
May
10
comment Cryptographically secure keyed rolling hash function
Thanks, @RickyDemer, I've edited my answer accordingly. Universality is all that matters (all that matters is the probability that two inputs yield the same output.) I agree with both of your comments -- thank you for them.
May
10
comment Cryptographically secure keyed rolling hash function
Sorry, I'm still not clear on how Tarsnap works. When is the substitution done? Is it applied to the input data, or to the output? If it substitutes from bytes to 32-bit values, does it expand the size of the input by 4x before hashing (or expand the size of the output by 4x after hashing)?
May
10
comment Cryptographically secure keyed rolling hash function
@cyril42e, have you benchmarked it? The AES-NI instructions are surprisingly fast. So you might want to implement, benchmark, and see if it meets your performance requirements. If it doesn't, I suggest editing your question to describe your performance requirements and how close this scheme gets and what you tried, to improve performance. Selecting the fastest block cipher for your platform is beyond the scope of this question, but you can find lots of other questions here that talk about that, or you can ask a new question.
May
9
comment Cryptographically secure keyed rolling hash function
Thanks for the update. I'm still not clear on how Attic and Tarsnap work. Is the substitution applied to the input data, or to the output of the Rabin-Karp/cyclic hash? I don't know what you mean by "HMAC of indexes". Would you like to try expressing it in mathematics?