2,675 reputation
213
bio website
location
age
visits member for 1 year, 10 months
seen 6 mins ago

1d
comment Are partial hashes used in cryptographic protocols?
I think that in most scenarios, where covert channels are an issue, "user consent" has no meaning: If you assume the computer to be corrupted (such that the attacker has enough control over it to hide information in the traffic), then it is quite hard to ensure that the user clicked on the consent button and not the attacker. But it really comes down on your assumptions about the entire system and the attacker.
1d
comment Are partial hashes used in cryptographic protocols?
In theory, covert channels are a threat if you say so (by giving the attacker this power). In practice, covert channels are definitely a threat, but it depends very much on the context: What kind of machine is used, how easy is it to corrupt the system, etc. Additionally: You can not get rid of all covert channels, unless you disable all communication to/from a device. There are so many aspects, where you can embed information in a networking protocol and/or messages, that you can't say that there is no covert information.
Aug
8
comment RSA, finding p,q
You can skip step 1. $\lambda(n)$ is even, $ed$ has to be odd, and $ed-1$ has to be even again.
Aug
7
comment Interleaving bytes to make an effectively larger block size
Comparing DES Cracker and a full search on AES is roughly on the scale of comparing single atom with an entire solar system (rough guess here, humans are so bad at understanding exponential growth). But what 3DES does is to increase the keyspace only (and unlike 2DES there is no easy meet-in-the-middle algorithm). But the general misconception here is, that larger blocks are good. They are not, larger blocks are considered a flaw. Just look at AES, Rijndael was proposed with larger blocksizes for the upper modes. But AES was changed in that aspect.
Aug
5
comment Interleaving bytes to make an effectively larger block size
What is the meaning of "much stronger cipher" in this context? Do you get a PRP over a larger blocksize? Yes, kinda. Is it harder to break? That's a tricky question. If there is no efficient attack on AES and brute force is not applicable, then we are already at the limit. And any fundamental attack against AES would break this too. Is it efficient? Ewk, no. Applying the original scheme three times on every value is two times too often.
Jul
28
comment Vigenère cipher: Security when key length and plaintext length are the same
Fixed. Something came up when I was writing the answer earlier.
Jul
28
revised Vigenère cipher: Security when key length and plaintext length are the same
added 102 characters in body
Jul
28
answered Vigenère cipher: Security when key length and plaintext length are the same
Jul
24
comment Protocol composition
You got a view recommendations already, so hopefully there was something useful for you. But anyway, reference recommendations are offtopic here.
Jul
24
comment Vigenère cipher: Security when key length and plaintext length are the same
If the key has the same length as the message and it used only once, then it is called a One-Time-Pad. And that is information theoretically secure. If you re-use the key, security is gone. And that's true for any key-length of Vigenere: Re-using a key means that security has left the building.
Jul
24
comment RSA with modulus n=p²q
That might be oversimplifying it. But either way you can get any modulus size you want, by picking primes in the correct size. As a rule of thumb: factoring $p^2q$ or $p'q'$ is only as hard as finding the smallest prime factor. Therefore, if you have two modulus of the same size, the normal RSA modulus is probably harder to factor than the one with one factor squared, because the lowest prime factor accounts only for $1/3$ of the total size.
Jul
23
comment RSA with modulus n=p²q
The "bigger numbers" argument is not valid, because you can set $p'$ and $q'$ to primes of arbitrary size. The exponentiation with $e$ is done in a group with $|n|$ bits, it doesn't matter if $n$ is a product of two primes, or the construction with one prime squared.
Jul
23
comment Advantages using Diffie-Hellman or Elgamal
One is a key agreement protocol, the other an encryption scheme. They are not interchangeable. However, they are two mechanisms based on the same computational problem, which is the CDH problem.
Jul
22
comment Ciphertext indistinguishability (IND-CPA) for symmetric cryptography
any encryption scheme which isn't IND-CPA can't be IND-CCA. The security game is basically the same, with additional access to a decryption oracle, which may be used on any ciphertext which isn't the challenge.
Jul
21
comment How to calculate complexity of ElGamal cryptosystem?
Your time complexity assumptions are correct for this algorithm, and space complexity is $O(1)$ in the number of variables or $O(n)$ if you consider the length of the numbers. However, the algorithm can be achieved faster, because of what poncho wrote in his answer. Basically, it is like calculating $a \cdot b$ as $a+a+a...+a$ with $b$ summands.
Jul
15
comment Leak-proof protocol: is such a thing possible?
There is no proof that no other communication channels exist. The only statement you can make about a system is "we don't know any other channel". And with an abstract model in mind, you might already have removed channels which can be used in reality. Timing, power, EM radiation, etc. are only some side channels. There are others like ordering of packets, length of messages, sound (for the air gaped example), choice of identifiers, etc. Even if you have e.g. something like a set of elements, in reality it will come as an ordered list of elements, and this can be used to transfer information.
Jul
15
answered Leak-proof protocol: is such a thing possible?
Jul
15
comment Protocol: Coin Flipping over phone
Since this looks like a homework question, I didn't want to spoil the answer right away. Even preimage resistance isn't needed, it just has to be a binding commitment scheme. Of course, preimage resistance provides some computational binding scheme.
Jul
15
comment Protocol: Coin Flipping over phone
What is "uncertainty" in this context? And to 2: No it is wrong. The function is not binding at all, even without knowledge of $n$.
Jul
15
comment A question about elliptic curves and finite fields in bilinear pairings
Formulas can be inserted here with common Latex notation, by using '$ $'.