2,705 reputation
213
bio website
location
age
visits member for 1 year, 11 months
seen 21 hours ago

1d
comment Checking the share membership in secret sharing schemes
Information theoretically, this is the almost same case as knowing two shares and wanting to get the secret or a 3rd share. If you have a way to verify something, you can eliminate certain input or output values. And that breaks this type of security. The reasoning is similar to that of Shannon for perfect secrecy of OTP.
1d
comment Random vs. Fixed Paddings
Random paddings can be used as side channels, etc. But fixed paddings might be vulnerable to replay attacks. If something is deterministic, the attacker also knows all the relevant values. The impact of this depends on what scheme you are actually looking at.
1d
comment Checking the share membership in secret sharing schemes
If you assume knowledge of $t-1$ shares and not the secret, then you can exclude possible shares for the one you are missing by checking membership. This breaks information theoretic security.
1d
comment Checking the share membership in secret sharing schemes
If $P_i$ knows the secret, there's no point giving $P_i$ a share, because it generated it. The information theoretic aspect is correct tho: If a party without the secret but only a share can find out if a share is valid, it leans something about the secret already. This isn't information theoretic secure any more.
Sep
19
comment Diffie-Hellman and man-in-the-middle attacks
If you have a public key infrastructure or know the other party's public information (encryption key, verification key, etc.), you can do authenticated key exchange. If you don't, you have no idea how to distinguish a real key exchange from Alice or a MitM attempt by Eve. The other question might look different, but it is essentially the same.
Sep
15
comment Why would an RSA library tell me that the public key must be at least 512 bits in size?
You got 32 hexadecimal symbols as keylength, which is 128 bit. Therefore, your library is telling you exactly what you did wrong. And as mikeazo said, 512 as lower limit is outdated and not secure any more. Anything less than 1024 is considered questionable, and 1280 are recommended as lower limit.
Sep
9
comment Privacy-Preserving Protocols and Proofs of Security
If you have $x$ and $y$ uniformly distributed, then $x+y$ is also distributed uniformly in most of our typical algebraic structures (there are exceptions ofc). Multiplication is the tricky one, because $x \cdot y$ is usually not uniform. But if you have a homomorphic scheme to get $E(a+b)$ from $E(a)$ and $E(b)$, you deal with the additive case.
Sep
8
comment Generating S boxes that satisfy Coppersmith's criteria?
My estimate of the number of functions is wrong, I am sorry. The correct amount can be found in picarresursix answer. And those $2^{256}$ can not be iterated through.
Sep
8
comment Generating S boxes that satisfy Coppersmith's criteria?
6 to 4 bit boxes are not that many, you can just check them all for whatever criteria you choose. I think there are $2^{4 \times 6}$ different boxes, but quite a lot can be ignored straight away (e.g. if at least one input has no effect on the result or one output bit is constant). About implementation: Lookup tables are pretty much the most efficient way for any kind of S-box.
Sep
4
comment Would xoring 2 independant AES CTRs to produce p-rand introduce vulnerabilities?
Using the expression 'pseudo-OTP' gives you a false sense of security, as you already said: "... so a higher level of security is implied". This is just plain wrong, if you use anything else than true randomness for every single bit of they entire keystring. As otus said, this is a stream cipher, and you should treat it that way.
Sep
1
comment Are partial hashes used in cryptographic protocols?
I think that in most scenarios, where covert channels are an issue, "user consent" has no meaning: If you assume the computer to be corrupted (such that the attacker has enough control over it to hide information in the traffic), then it is quite hard to ensure that the user clicked on the consent button and not the attacker. But it really comes down on your assumptions about the entire system and the attacker.
Sep
1
comment Are partial hashes used in cryptographic protocols?
In theory, covert channels are a threat if you say so (by giving the attacker this power). In practice, covert channels are definitely a threat, but it depends very much on the context: What kind of machine is used, how easy is it to corrupt the system, etc. Additionally: You can not get rid of all covert channels, unless you disable all communication to/from a device. There are so many aspects, where you can embed information in a networking protocol and/or messages, that you can't say that there is no covert information.
Aug
8
comment RSA, finding p,q
You can skip step 1. $\lambda(n)$ is even, $ed$ has to be odd, and $ed-1$ has to be even again.
Aug
7
comment Interleaving bytes to make an effectively larger block size
Comparing DES Cracker and a full search on AES is roughly on the scale of comparing single atom with an entire solar system (rough guess here, humans are so bad at understanding exponential growth). But what 3DES does is to increase the keyspace only (and unlike 2DES there is no easy meet-in-the-middle algorithm). But the general misconception here is, that larger blocks are good. They are not, larger blocks are considered a flaw. Just look at AES, Rijndael was proposed with larger blocksizes for the upper modes. But AES was changed in that aspect.
Aug
5
comment Interleaving bytes to make an effectively larger block size
What is the meaning of "much stronger cipher" in this context? Do you get a PRP over a larger blocksize? Yes, kinda. Is it harder to break? That's a tricky question. If there is no efficient attack on AES and brute force is not applicable, then we are already at the limit. And any fundamental attack against AES would break this too. Is it efficient? Ewk, no. Applying the original scheme three times on every value is two times too often.
Jul
28
comment Vigenère cipher: Security when key length and plaintext length are the same
Fixed. Something came up when I was writing the answer earlier.
Jul
28
revised Vigenère cipher: Security when key length and plaintext length are the same
added 102 characters in body
Jul
28
answered Vigenère cipher: Security when key length and plaintext length are the same
Jul
24
comment Protocol composition
You got a view recommendations already, so hopefully there was something useful for you. But anyway, reference recommendations are offtopic here.
Jul
24
comment Vigenère cipher: Security when key length and plaintext length are the same
If the key has the same length as the message and it used only once, then it is called a One-Time-Pad. And that is information theoretically secure. If you re-use the key, security is gone. And that's true for any key-length of Vigenere: Re-using a key means that security has left the building.