3,357 reputation
317
bio website
location
age
visits member for 2 years, 5 months
seen 11 hours ago

Mar
23
comment Why would using a random seed with other variables be bad for ecrypting if you can't guess the key?
Because no one said it so far: Schneier's law: "any person can invent a security system so clever that she or he can't think of how to break it.". To sum up a modern point of view: something which has security only against ciphertext only attacks is considered insecure. Arguments like "but you can't guess X from Y" are almost always neglecting actual cryptographic advances during the last 30 years.
Mar
23
comment security of pairing based cryptography
I had only a quick glance, but they present an attack on one single specific group. Advances like these are achieved now and then, but techniques like these usually can not be generalized for every group. From a theoretical point of view: If you just assume to use a pairing friendly group, this is irrelevant. From a practical point of view: Pairing friendly curves are usually not implemented outside of research, because pairings are efficient only in a theoretical sense but not a practical one.
Mar
20
comment How dangerous is it to encrypt with AES 256 if the end user knows the unencrypted value?
Security decisions should never be made without the proper knowledge. Things like that lead to all those little pieces of negative publicity, because someone botched something trivial royally.
Mar
19
comment What prime lengths are used for RSA?
A common assumption is equal length, $q<p<2q$ or at most a length difference of $1$. But that is not really a question about security, it is more about the policy for the usage of RSA. Allowing uneven factors is a potential security risk, because "small factors" can be found more easily. In general, the factoring problem scales with the smallest prime factor, not with the total length. Multiplying $2^{1000000}$ to any RSA modulus does not make it harder to factor.
Mar
19
answered Deciphering text encrypted with a changing cipher
Mar
19
comment Applying Trapdoor Function directly to plaintext
What does "secure" mean in this context? It can't be IND-CPA, because that does not work with a deterministic encryption function. It can't be in the context of signatures, because there you use $F^{-1}$ to generate the signature.
Mar
17
comment Practical strength of non-2^n RSA key lengths
The other question covers the topic nicely already. This is like asking "Why is the data type int in most common programming languages 32 bits?"
Mar
16
comment Reusing a one-time pad?
Your first idea is basically a Vigenere cipher. Its security in modern understanding: None.
Mar
13
comment Why is this a fix to Bleichenbacher's attack?
Basically, if the computation time/length/effort/energy consumption/other_sidechannel is independent of whether the PKCS format has been fulfilled or not, then there is no information to do the attack.
Mar
13
comment Why is this a fix to Bleichenbacher's attack?
In short: The entire attack is based on being able to distinguish whether the padding is correct or not, and that can be derived if the server immediately sends an error message on detecting a wrong padding.
Mar
13
answered Self verifying hash algorithm
Mar
12
comment What is the difference between a hash and a permutation?
This is completely wrong. It seems to me, that you are taking permutation as some sort of container (e.g. list, set, etc.) and think of hash only of the case of HashSets. A permutation is the process re-ordering, and does not say anything about the underlying structure. But it is also implicitly a reversible process, while hashing is not. There you just get a fancy "checksum", which can be checked for equality of objects and not much else. But ofc it is fast.
Mar
12
comment what is the current actual budget - as of 2015 - needed to build a DES breaker machine?
Check out CloudCracker. It was a cloud service to break DES in the cloud. That's roughly 2 years ago, and it seems they are not online any more. Still worth reading the news about it.
Mar
12
comment Is the 1st Encrypted Block Less Secure Than Subsequent Ones?
The only possible problem arises, if the attacker can somehow control the previous ciphertext. But under the assumption, that the cipher behaves like a pseudorandom permutation, he can't control the the first ciphertext, even if he can know or manipulate the first plaintext. The only property the "random input" (IV or previous ciphertext) requires, is that it does not repeat. Confidentiality is not needed, it is even public. Basically, you could just use alternatively an increasing counter. This would be similar to the difference between OFB and CTR.
Mar
11
comment Inconsistent terminology for ciphers and algorithms
From a practical point of view, asymmetric cryptosystems can be seen as block ciphers (and e.g. BouncyCastle does label them that way), because you have an input and an output of fixed length, which are usually the same. So you could theoretically use some mode of operation like CBC, and use RSA encryption / decryption. Performance will be horrible tho... when talking about asymmetric encryption, people usually think implicitly about messages, which fit within the structure. If your real message is longer, use hybrid encryption.
Mar
11
answered Is the 1st Encrypted Block Less Secure Than Subsequent Ones?
Mar
9
comment Performing differential cryptanalysis for randomly generated S-boxes
Key dependent s-boxes can surely be done, but what does random imply then? And then there's the question, whether the (sub)key just chooses from a fixed set of s-boxes or generates it based on the key. This is all unclear from the question, but will make a difference in cryptanalysis. And if you just say "random s-box", then it quite surely will have some weakness. Good s-boxes require precice design, because nonlinearity and all the other properties are not so easy to balance out.
Mar
9
comment If a cipher has key length shorter than plaintext, then it is not perfectly secure
You should not call the 2nd example a cryptosystem, because under key $2$ your function is not injective: a and d both are encrypted as A, so decryption is impossible.
Mar
6
awarded  Revival
Mar
6
comment Performing differential cryptanalysis for randomly generated S-boxes
The main question is: how do you want to use S-boxes, which are unknown to the attacker, but can be used by a legitimate user? And if you present today a cryptosystem, where it is required that the s-boxes are unknown to the attacker, people will rightfully say "we don't want security by obscurity".