1,037 reputation
321
bio website
location
age
visits member for 1 year, 9 months
seen yesterday

Jul
20
comment Could the Enigma algorithm be classified as a Feistel network?
@John Callas Interesting. You say "Computer stream ciphers are a PRNG that is XORed onto the plaintext to yield ciphertext." and you say Enigma is a SC. But Enigma does not xor keystream with paintext since it does not produce any keystream as any SC would (see eSTREAM for state of the art SC; RC4; A5/1) :D I do not see the operate on characters thing as distinguishing since you can define keyed PRPs on small blocks (see e.g. Perfect Block Ciphers with Small Blocks by Granboulan and Pornin).
Jul
18
comment Advantages of making streamcipher stream depend on plaintext?
@e-sushi hence the wording "attack model". Designers assume powerful attackers and aim to counter them. In practice attackers are hopefully less powerful... Again, a designer assumes the attacker has the keystream corresponding to a known IV and some (unknown) key to be recovered and should resist the attacker's attempts (theoretically speaking, the attacker should have a negligible advantage in this setting). However, this obviously does not mean that in a real world use case of the algorithm the attackers will effectively put their hands on the keystream...
Jul
18
comment Advantages of making streamcipher stream depend on plaintext?
@e-sushi For the Fluhrer, Mantin and Shamir attack: "Because the first byte of the plaintext comes from the WEP SNAP header, an attacker can assume he can derive the first byte of the keystream from B ⊕ 0xAA."
Jul
18
comment Advantages of making streamcipher stream depend on plaintext?
@e-sushi In practice, an attacker does not have direct access to the keystream (as this would mean access to the plaintext in the case of a synchronous stream cipher!) So a first step is to recover at least part of the keystream from the ciphertext and this is done by relying upon the structure/redundancies of the underlying plaintext. The A5/1 attack is a perfect example of that. The designers of stream ciphers thus assume that the attacker has the keystream for a given key and any chosen IV at will...
Jul
18
comment Advantages of making streamcipher stream depend on plaintext?
@otus For the auhtentication, exactly what I said in the third paragraph of my answer: "due to the lack of authentication". Also note that asynchronous stream ciphers help concealing the underlying structure even if they do not provide authentication (as I said, not all asynchronous stream ciphers provide authentication, e.g. the self-synchronizing ones are asynchronous but do not provide full authentication such as the one provided by Helix/Phelix).
Jul
18
comment Advantages of making streamcipher stream depend on plaintext?
@e-sushi I interpret the first two paragraphs of your question together with its title as implying that Wikipedia does not mention "streams that depends on the plaintext". As I said, this is just what the asynchronous stream ciphers do. As for second part, see my previous comment.
Jul
18
comment Advantages of making streamcipher stream depend on plaintext?
Nope: if you have ASCII text encrypted with, say, RC4, it is straightforward for an attacker, to e.g. uppercase all lowercase letters. This would not happen with Helix for instance. Also note I never wrote "conceal plaintext" but rather conceal the structure of the underlying plaintext (redundancies or format)... This is heavily relied upon in practice by attackers and is among the reasons why the keystream is assumed to be available to attackers in the attack models for stream ciphers.
Jul
18
comment Polynomial representation of the affine part of the AES S-box
Nope: that's the whole point of using the interpolation of the affine transform over $\text{GF}(2^8)$, getting rid of the $\psi$ and $\psi^{-1}$, see page 7 of the paper of Sean Murphy and Matt Robshaw.
Nov
14
comment Efficient set up for a Montgomery multiplication
@mikeazo: I said you're correct and also +1'd your comment as it is indeed one way to solve the thing. But you know how it is in today's world: you spare every single bit that you can :D Also, the computation of $R^2 \mod N$ must be performed each time the modulus changes, so depending on the setting, this can happen often and might not be easily precomputed.
Nov
14
comment Efficient set up for a Montgomery multiplication
@mikeazo: This is one way to do it, of course. But it is not efficient as it requires a true multiplication mod $N$ whereas the purpose of Montgomery's multiplication was to be more efficient. Hence, although the cost for it gets lower with the number of Montgomery multiplications performed in this representation, one wants to reduce it if possible.
Nov
14
comment Efficient set up for a Montgomery multiplication
@B-Con: I'd say as much as Montgomery multiplication has: I'm not sure if there are many other settings where one wants to compute modular exponentiations with a modulus of 4096 bits :D
Nov
9
comment Randomized algorithms and the one time pad
If one think of the key as the whole set of pads, as described above, there is no problem at all provided you always pad the same message with the same pad. (The only problem is that "standard one-time pad" does not really specify what happens when you come to encrypt the same message twice.) The resulting scheme will be semantically secure, assuming the events from your dice are uniformly distributed. (I'm actually thinking of such truly random pads in the example scheme defined above.) Still, the resulting encryption algorithm is fully deterministic (not randomized/probabilistic).
Nov
8
comment Randomized algorithms and the one time pad
@PaŭloEbermann: Indeed, thank you.
Nov
8
comment Randomized algorithms and the one time pad
@John Deters: You're correct. This is why I stressed that one-time pad does not fit the framework. I'll change the wording accordingly. Thanks.
Nov
8
comment Randomized algorithms and the one time pad
@fgrieu: I fail to see what you mean by "difficult goal". A randomized algorithm can be used for any kind of goal. Although it is true that they are often the only known algorithms to efficiently solve some difficult problems, it is also not known that there cannot always be a deterministic algorithm solving the same problem at least as efficiently. Also, in your example, the randomized version for factorization you give is less efficient than the deterministic one. I guess this comes from the typical representation of an attacker as a probabilistic polynomial time algorithm.
Nov
8
comment How can I use eulers totient and the chinese remainder theorem for modular exponentiation?
To do the computations, you use what is the most efficient: -1 or 4. For instance, I'd compute the $5^7 \mod 11$ above as $5^{-3} \mod 11$ instead. (As $5^3=4\mod 11$ and $4\cdot 3=1\mod 11$, $4^{-1}=3\mod 11$.) For a mathematician, there's an equivalence class, the label does not really matter, although common practice is indeed to use non negative numbers.
Nov
8
comment Randomized algorithms and the one time pad
The standard naming, coined by Goldwasser and Micali, is probabilistic encryption.
Nov
3
comment Why does HOTP use such a complex truncate function?
You meant from $2^{80}$ to $2^{16}$.
Oct
30
comment Modifications of CBC-MAC
A message of length bigger than $2^n$ does not exist :D This is forbidden by the format constraint. (You've to understand that the actual limit value is not crucial: you could also take a limit of $2^{2n}$ and code the bit length over two blocks, this would achieve the same effect.)
Oct
29
comment Modifications of CBC-MAC
@Avery: the constraint on the message format prevents a valid message from being extended into another valid message by a simple append.