2,725 reputation
314
bio website
location
age
visits member for 2 years, 1 month
seen 11 hours ago

Oct
6
comment What does “nonlinear mapping” mean?
It seems, you have your answer already. If any summand of the function formula contains a term with higher degree than 1, it's called nonlinear. Another good reference for this is the wiki page about degree of a polynomial
Oct
1
comment Bridging the gap between security proofs and “real-world” security
If there was an answer to this question, it would probably fill hundreds of journals, I guess. And even then, scientists would not be able to agree on common assumptions, I guess.
Oct
1
comment How do you interpret the p-values from the Dieharder testsuite to evaluate an RNG?
Although cryptography has a lot of statistics (the subfield of mathematics) in certain areas, you might get better suited answers over at math SE
Sep
30
comment How do you interpret the p-values from the Dieharder testsuite to evaluate an RNG?
The question is: Is this about cryptography? If it's just about the statistical test, this should be on a math board... For cryptography, these statistical tests are quite pointless.
Sep
29
comment Vigenere ciphertext encrypted with another vigenere cipher
In short: Your new keylength is LCM of both keylengths. But any keylength is leaked by statistical analysis of auto-correlation in a very obvious way (Friedman test gets more inaccurate for longer keys, due to derivation). Anyway, it is just a longer Vigenere, not something more secure.
Sep
29
comment In HMQV, can one use multiple identities with one public key?
It would be beneficial, if you provided a reference, to what scheme you're referring to. Google scholar told me, but it also gave a hit for Another Look at HMQV from A. Menezes. Maybe have a look at it, because that paper claims, HMQV is insecure. I didn't get further than the abstract in both papers, tho.
Sep
29
comment Encrypting and obscuring data between site/user without SSL
In the Internet layer model, TLS is usually located between TCP and the application. If the filter just checks for this specific structure, you can circumvent it, by placing some other frame around the actual TLS messages, e.g. making it look like HTTP requests and responses, where you embedd the actual TLS communication in something else (pictures, input fields of forms, etc.)
Sep
29
comment Does brute force attack use the program that created the ciphertext?
The assumption, that encryption is compute intense, is wrong. It is a design goal for new ciphers to be very fast, and the basic primitives all are. "High computation time" is only a goal in the actual usage of cryptographic primitives, e.g. in PBKDF, where you can set the number of iterations of a hash function. One more thing: GUI doesn't matter at all, and no cryptanalysis will ever deal with the actual GUI of an application. Specifications are known, and cryptanalysis or any reasonable attack happens in bits and bytes.
Sep
26
comment Are there any obvious techncial faults in F. Ruiz's 2013 URSA javascript cryptography?
This question appears to be off-topic because it is about an implementation and not about cryptography itself. And the question is about its usage, not it's design.
Sep
25
comment what is the difference between IBE and ABE schemes
ABE can be seen as a generalization of IBE: IBE is an ABE with a single attribute namely the ID. In ABE a user is only able to decrypt, if he matches all the specified attribute values.
Sep
22
comment Checking the share membership in secret sharing schemes
Information theoretically, this is the almost same case as knowing two shares and wanting to get the secret or a 3rd share. If you have a way to verify something, you can eliminate certain input or output values. And that breaks this type of security. The reasoning is similar to that of Shannon for perfect secrecy of OTP.
Sep
22
comment Random vs. Fixed Paddings
Random paddings can be used as side channels, etc. But fixed paddings might be vulnerable to replay attacks. If something is deterministic, the attacker also knows all the relevant values. The impact of this depends on what scheme you are actually looking at.
Sep
22
comment Checking the share membership in secret sharing schemes
If you assume knowledge of $t-1$ shares and not the secret, then you can exclude possible shares for the one you are missing by checking membership. This breaks information theoretic security.
Sep
22
comment Checking the share membership in secret sharing schemes
If $P_i$ knows the secret, there's no point giving $P_i$ a share, because it generated it. The information theoretic aspect is correct tho: If a party without the secret but only a share can find out if a share is valid, it leans something about the secret already. This isn't information theoretic secure any more.
Sep
19
comment Diffie-Hellman and man-in-the-middle attacks
If you have a public key infrastructure or know the other party's public information (encryption key, verification key, etc.), you can do authenticated key exchange. If you don't, you have no idea how to distinguish a real key exchange from Alice or a MitM attempt by Eve. The other question might look different, but it is essentially the same.
Sep
15
comment Why would an RSA library tell me that the public key must be at least 512 bits in size?
You got 32 hexadecimal symbols as keylength, which is 128 bit. Therefore, your library is telling you exactly what you did wrong. And as mikeazo said, 512 as lower limit is outdated and not secure any more. Anything less than 1024 is considered questionable, and 1280 are recommended as lower limit.
Sep
9
comment Privacy-Preserving Protocols and Proofs of Security
If you have $x$ and $y$ uniformly distributed, then $x+y$ is also distributed uniformly in most of our typical algebraic structures (there are exceptions ofc). Multiplication is the tricky one, because $x \cdot y$ is usually not uniform. But if you have a homomorphic scheme to get $E(a+b)$ from $E(a)$ and $E(b)$, you deal with the additive case.
Sep
8
comment Generating S boxes that satisfy Coppersmith's criteria?
My estimate of the number of functions is wrong, I am sorry. The correct amount can be found in picarresursix answer. And those $2^{256}$ can not be iterated through.
Sep
8
comment Generating S boxes that satisfy Coppersmith's criteria?
6 to 4 bit boxes are not that many, you can just check them all for whatever criteria you choose. I think there are $2^{4 \times 6}$ different boxes, but quite a lot can be ignored straight away (e.g. if at least one input has no effect on the result or one output bit is constant). About implementation: Lookup tables are pretty much the most efficient way for any kind of S-box.
Sep
4
comment Would xoring 2 independant AES CTRs to produce p-rand introduce vulnerabilities?
Using the expression 'pseudo-OTP' gives you a false sense of security, as you already said: "... so a higher level of security is implied". This is just plain wrong, if you use anything else than true randomness for every single bit of they entire keystring. As otus said, this is a stream cipher, and you should treat it that way.