800 reputation
25
bio website
location
age
visits member for 2 years, 2 months
seen Nov 8 at 13:04

Oct
24
awarded  Yearling
Mar
4
comment Why does CTR mode XOR the plaintext into the output of the block cipher rather than XORing the plaintext into the input of the block cipher?
CTR is designed in this way as a technical equivalent of One TIme Pad where the full entropy random keystream is replaced by a pseudo random generator
Feb
13
comment Pseudo random permutation for arbitrary size domains
If I may extend the question of the OP the paper you cited states that their methods aren't suitable when the domain $X$ is such that $2^{30}<|X|<2^{60}$ and presents that gap as a open problem. Are you aware of subsequent research that solved ?
Jan
8
comment Would data be secure if a cryptographically secure PRNG was used for encryption?
Two things : First it would be somewhat pointless to do on top of AES-[insert-right-mode-of-operation-here] but as long as the AES layer and the PRNG layer are uncorrolated it won't decrease security. Also what you get from your solution is confidentiality which is great but in many situations not enough. For example what is the consequence of a bit flip by an attacker on ciphertext in transit ?
Oct
24
awarded  Yearling
Sep
23
comment Where is the S-Box generated in Rijandel/AES?
Writing a constant time efficient implementation is near impossible BECAUSE of the precomputed S-BOX. Computing an inverse in GF(2^8) on the fly would be way too expensive
Sep
22
comment With a true random number generator at hand, how to implement one-time pad?
This doesn't seem like an awesome idea : as always with OTP key management is the issue. If you're encrypting a message how are you going to get the keystream to Bob. If you're encrypting data at rest on you're hardrive then you need a secure way to keep the keystream which you could have used for the plaintext in the first place...
Sep
9
comment Automated security protocol verification tool for eCK model
I don't know about the first one but the last two work in the symbolic model while the eCK model expresses computational security.
Sep
2
comment Initialization vector in symmetric-key encryption
Could you also specify the data that is being exchanged
Sep
2
comment Initialization vector in symmetric-key encryption
I guess what Ricky is trying to say is : it largely depends on what kind of data is sent...
Aug
27
comment Why restricting SHA3 to have only two possible capacities?
For most user a hash function is mostly defined by its output size. Allowing any capacity would bring a lot of confusion and endless debugging time to those users. A few good options is much better than a ton of excellent-for-my-usage-if-i-know-what-i-m-doing ones
Aug
23
comment What signature schemes allow recovering the public key from a signature?
Why would you want to extract the public key from a signature ? If you don't a prior knowledge of the public key/Identity link then using signature scheme adds no security
Aug
8
comment Is FIPS 140-2's “Continuous random number generator test” practical?
I agree with nightcracker here, if a PRNG actually never produces the same $n$ bit block twice in succession you just built yourself a distinguisher from an idealized RNG
Aug
7
answered Allowing the user to choose the hashing formula at the registration
Aug
5
comment Does it necessarily mean that an RSA moduli generated with poor randomness is not random?
By doing exactly what they did in the paper you're talking about : calculating their gcd. In a truly random sequence of semiprimes the gcd found would be 1 with high probability...
Aug
5
comment Does it necessarily mean that an RSA moduli generated with poor randomness is not random?
Short answer is yes : If the PRNGs had been properly seeded it would have been very unlikely that two moduli share a non-trivial factor. Said otherwise the moduli generated with in that way are a particular subset (understand here non-random) of the semi-primes of a given size
Jul
23
comment Why is it a security problem that two RSA moduli are not co-prime?
Two links that you might find useful to understand exactly how often does that happen in real life freedom-to-tinker.com/blog/nadiah/… eprint.iacr.org/2012/064
Jul
23
comment Is there any weak message for an ECDSA signature?
You're right, I didn't read the question well enough. That being said I think the point is still valid since there was no technical reasons for keeping the messages short and that limitation could well have been lifted in the future
Jul
23
answered Is there any weak message for an ECDSA signature?
Jul
15
comment How can Alice prove that a message has not been tampered with?
Sorry I was in a hurry I'll flesh out my answer when I get the chance