Reputation
4,592
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
5 18
Newest
 Yearling
Impact
~74k people reached

12h
comment To what extent is WhatsApp's statement on secure messaging realistic?
Or alternatively, they could even do normal key gen. And afterwards send not only the public key (which they need on the server, to make it available to other users), but also the private key to the server. Then it also depends if there is some kind of key exchange for session keys, etc. Basically, without verifying the source code, there is no way to tell if their claims hold or not.
12h
comment To what extent is WhatsApp's statement on secure messaging realistic?
"...would even think about risking their business by publishing claims they can’t hold." Unfortunately, that is pretty much common practice concerning security features of any closed source software. If it can't be verified by the public, that's pretty much ideal for marketing. And if it turns out to be vulnerable, you just say "they must have hacked it. we did nothing wrong".
12h
comment To what extent is WhatsApp's statement on secure messaging realistic?
I agree with the assumption, that probably they didn't screw up entirely. However, I disagree with the other assumptions: If they want to, they can switch to an encryption mode, which is entirely transparent to them alone, and most likely the users wouldn't be able to notice it. It all comes down to what kind of cryptographic keys and random numbers are used. For example they could just use a few specific keys - where "few" means "little enough to make full search possible". And if the App would somehow indicate some ID of that key, surveillance cost and detection risk would be zero.
15h
comment Is it safe to encrypt data using XOR along with CSPRNG seeded with a truly random number?
If the attacker has the ability to intercept/change/suppress packages between Alice and Bob, he can shut down the connection anyway or just send any amount of randomness to Bob. Any way of cryptographic verification will also take some computation time, and thus the attacker can always keep Bob busy.
Apr
11
comment What is a Non-Interactive Zero Knowledge Proof?
That is a different kind of simulator. You think of the simulator to actually prove the zero knowledge property. However, that is not the simulator mentioned here. In order to get a NIZK protocol, you first have to prove that it is actually zero knowledge. And then you can apply e.g. Fiat-Shamir or use a common reference string to make it non-interactive. The simulator mentioned here just runs the protocol and does choices according to the heuristic or CRS (or any other setup assumption), nothing more. You can't use this instead of the zero knowledge proof.
Feb
4
comment How many polynomials are used in Secure Multiparty Computation?
The question is too broad, in the sense that the only answer can be "as many as your algorithm or protocol requires". It is like asking "how many stones do you need to build a house?" without stating the size or the number of appartments.
Jan
13
comment ElGamal with elliptic curves
You're right, it doesn't work for every $x$. It was a simplified version of the paper's function $(2)$ in section $3$. Basically they suggest for $m < q/1000 - 1$ and then look for $x$ with $1000m \leq x < 1000(m+1)<q$ and a solution for the curve equation. It's a probabilitstic embedding, which still has a chance that there is no sulition in the interval. The inverse can then be calculated by dropping the last 3 decimal digits of x..
Nov
30
comment Using a SHA512 hash to encrypt data
There is evidence for frequency analysis in the 9th century by Al-kindi. Vigenere was broken in 1863. And that breakthrough was how to find out the key length. The rest was just using techniques, which were a millenium old already. That was the problem, even if it isn't any more today with our current knowledge.
Nov
30
comment Using a SHA512 hash to encrypt data
I've never seen the term "crip" used in any serious cryptanalytic publication. Mostly, because it is such a imprecise expression. It is much better to talk about frequency analysis (uni-, bi, trigrams), frequently used (or expected) words and phrases (like in the enigma attacks), which is a form of known plaintext attack (with high probability).
Nov
18
comment Using a SHA512 hash to encrypt data
Vigenere would imply that the keylength is unknown, which was for a long time the main problem, when frequency analysis could already be used to break Caesar.
Nov
17
comment Are all encryption tools made equal?
Well, "uses SHA256" is a good start. But if it is just a single hash operation, dictionary attacks are still on the table. If you use a password or passphrase, you have to use a construction which is meant for low entropy input, such as passwords. And PBKDF, bcrypt, scrypt, etc. are such constructions.
Nov
17
comment Is it interesting to design stream ciphers parametrized by a CSPRNG?
The security definitions for stream ciphers and CSPRNG are pretty much the same: The attacker should not be able to predict the next bit according to previous keystream he should not be able to guess the internal state, etc. The differentiation CSPRNG and stream cipher is mostly just a different point of view in the application/protocol/goal. Security-wise, they are the same. So your trivial answer is "no, it would not be interesting".
Nov
17
comment Factorizing N to derive D
"Give a man a fish and you feed him for a day; teach a man to fish and you feed him for a lifetime." Generally, for homework questions like this pointers towards the correct way are much more useful than just handing over the result.
Nov
17
comment Prevent replay attack without storage
Okay, maybe 8 bit cpu's and crypto work together, but he also said low power sensor unit. And considering that he doesn't want to save session information because of limited memory, doing public key crypto in memory is unrealistic. For a simple square and multiply for RSA you need at least two elements in memory, so that's at least 300 bytes. Quite a lot if you can't afford 32 bytes for a session key.
Nov
16
comment Does complicating a flawed algorithm make it secure?
I doubt, most of these comments and answers make much sense for the author of the question. In short: If you're not an expert in cryptography, then most likely don't improve security at all - not even a tiny bit. "It looks different" is not a suitable measure for security. Even classical ciphers achieve that. The most basic rule for using cryptography: "Don't implement it yourself". If you're a software engineer, the best way to handle this is by designing the system s.t. you can exchange your cryptographic library if required.
Nov
9
comment What is the difference between “securely realizes” and “securely implements”?
The quoted part is exactly what it is in the contxt of MPC. It is two different points of view of (mostly) the same thing. Internal vs external.
Nov
9
comment Why do cryptographic hashes need to be fixed length?
Fixed length is no special property from the cryptographically secure part. It comes from the more general specification of hash functions. In fact, it is the defining property of hash functions: "A hash function is any function that can be used to map data of arbitrary size to data of fixed size" (Wikipedia)
Nov
9
comment Three party coin flipping protocol with only 2 active participants
This is unachievable. From Carol's point of view: She isn't involved in the protocol execution (except possibily some initial input). She doesn't trust Alice and Bob (they could in fact be just one party). And she has to trust the result of the coin toss somehow, while having no influence or ability to verify anything. Without further specification this is impossible.
Oct
28
comment ElGamal Generator g problem
If ElGamal would be defined today, it would require a Schnorr group, with "find $h$, s.t. $h^r \neq 1$". In the original paper it actually was a generator, if I recall correctly. Anyway: $1$ as $g$ is always a bad choice, because every public key will be $1$ then. And not just if you choose the elements order (or a multiple of it) as private exponent.
Oct
28
comment How to toggle a bit homomorphically ?
OR is not an addition. The addition is XOR. In order to ensure that true and true returns true, you need to have something like $A + B + AB$. Which also contains a multiplication. NOT gates are easy: Just use XOR and the constant 1