17,765 reputation
32063
bio website
location
age
visits member for 2 years, 8 months
seen 4 hours ago

Dec
26
comment Security Level Estimate when Cascading/Compositing Ciphers?
You've loaded too many questions together into one. Please pick one question per question. Your first question is too broad; the answer will depend upon whether you're talking about a block cipher or something else. I suggest you just tell us about the real problem you have; or else ask multiple separate questions.
Dec
23
comment Now that quantum computers have been out for a while, has RSA been cracked?
This answer does not seem to add any added value over the existing answers.
Dec
20
comment Is this algorithm demonstrating “proof of work”
In the future, we generally ask that questions on Crypto.SE should use pseudocode to describe the algorithm concisely -- rather than giving a full implementation. Here the code makes it harder to understand what is going on, whereas you could describe the basic algorithm in one or two lines of simple mathematics. Just letting you know for the future....
Dec
20
comment Is this algorithm demonstrating “proof of work”
@kylek, I think you've misunderstood rolfl's answer. Rolfl is 100% correct on both of his criticisms, and I think you misunderstood his points and haven't fully grokked his critique yet. Maybe read it a second time? (Rolfl clearly does understand that this is for proof-of-work, not for authentication.)
Dec
19
comment Are those two distributions indistinguishable?
Thanks, @curious, that was a typo on my part. I certainly intended it to be mod $N^2$, but that did not make it from my brain to my fingers -- oops. Fixed. Thank you again.
Dec
19
comment Are those two distributions indistinguishable?
Are you sure you've got the definition of the decisional quadratic residuosity problem right? Do you have a reference? I'm not familiar with this specific hardness assumption, but based on the name, I would have expected something called the "decisional quadratic residuosity problem" to be about $x^2 \bmod N^2$ vs $r \bmod N^2$.
Dec
19
comment Is a Mersenne-twister cryptographically secure if I truncate the output?
Greg, the first step is to start by asking questions rather than drawing conclusions (such as the conclusion that Mersenne Twister is fine). You should be especially careful when your conclusions seem to run counter to what others have told you. Asking questions shows that you want to learn. Here's a starting tip: Mersenne Twister is insecure from a cryptographic perspective, and the fact that you only output partial output does not change that. You need cryptographic-level security, and the best way to get that is a CSPRNG -- which Mersenne Twister is not.
Dec
19
comment Is a Mersenne-twister cryptographically secure if I truncate the output?
Wow. There's a pretty impressive amount of misconception shown here. All I can say is: You are not qualified to write a casino game. Don't do it. There is specific technical knowledge required to do this right, and you do not have it. Try to find someone more qualified to do this aspect of design, because your instincts are leading you astray, your reasoning is wrong, your conclusion is wrong (and worse, you seem convinced that you are right).
Dec
17
comment Help with linear cryptanalysis
@Antimony - yup, that's certainly possible! The only thing I couldn't tell was: what is the best characteristic you've gotten? How many rounds, and with what bias (or what probability)? It's possible that if you asked a new question giving that specific characteristic and asking if anyone can do better, maybe someone would be inspired to try to find a better one and see if they can beat what you got. Anyway, great question -- sorry I wasn't able to give a more specific answer focused on this particular cipher.
Dec
16
comment frequency analysis substitution
Cross-posted on CS.SE (where it got a very good answer). cs.stackexchange.com/q/19007/755
Dec
16
comment Combining two hashing functions
possible duplicate of Guarding against cryptanalytic breakthroughs: combining multiple hash functions
Dec
16
comment Combining two hashing functions
Are you using cryptographic hash functions? If not, this is off-topic for Cryptography.SE.
Dec
15
comment Randomized stream cipher using multivariant quadratic equations
@Antimony, yeah, $n^2/2$ should suffice. I wasn't trying to optimize the constant factors (just laziness). Thank you.
Dec
11
comment Block Cipher Mode Amicable to Fast Key Change/Rotation Like XOR?
@DrLecter, thanks for the elaboration -- good point. If the document changes, you can consider the new version a new document (with its own key). I've edited my answer correspondingly. Thank you!
Dec
11
comment Do test vectors ensure a cipher is free of backdoors?
@CodesInChaos, yup, absolutely. But, I don't think mikeazo ever claimed that's the best or only way to insert a backdoor. To answer the question in the negative, it suffices to show one example of a backdoor -- it doesn't have to be the best possible backdoor.
Dec
11
comment Block Cipher Mode Amicable to Fast Key Change/Rotation Like XOR?
@noloader, It's not a problem. Think about it this way: What does knowledge of the document key for document $D$ let you do? It lets you decrypt document $D$. But if you give that key to everyone who should be able to read $D$, then you're not allowing them to do anything they shouldn't be able to do. It's not the same "everyone shares the wireless gateway password" because my answer shows how to communicate the document key to a person. There is no revocation: once you've allowed someone to download document $D$, you're done, there's no going back: they've got a copy of $D$, period.
Dec
10
comment Slow one-way pseudo-random permutation?
@K.G., cool! Would you care to add that as a separate answer, so we can upvote it? Also, do you know anything about the security of the discrete log on such curves? Is it also the case that the best currently-known algorithm is a square-root algorithm (i.e., we don't know how to do better than the generic algorithms for square roots in a black-box group)?
Dec
9
comment Slow one-way pseudo-random permutation?
Why do you need to store the permutation as $2^m$ words of $m$ bits, rather than just using any short-block cipher on $m$-bit blocks? Also: what's the security gap you expect from this? (i.e., the ratio in workfactor to break vs the workfactor for the legitimate parties to compute this function.) My rough back-of-the-envelope estimate suggests you should expect a very small security gap. If we precompute the discrete log of all primes up to $2^{21}$ (about $2^{17}$) of them, the time to compute a single discrete log is about 200 smoothness tests (sieving + ECM on a $\le 84$-bit number).
Dec
8
comment Slow one-way pseudo-random permutation?
Right. This answer doesn't work. If the matrix is non-invertible, then this won't be a permutation. The original question asks for a one-way permutation. (If it didn't need to be a permutation, this question would be easy to solve: you could just use SHA256 truncated appropriately.)
Dec
7
comment PRP representation size
@Bush, your question still has the same problems. Have you tried answering the questions in the last paragraph of my question? They are intended to get you thinking along lines that enable you to clear up your confusion on your own.