Reputation
840
Top tag
Next privilege 1,000 Rep.
Edit questions and answers
Badges
3 6
Newest
 Caucus
Impact
~7k people reached

  • 0 posts edited
  • 0 helpful flags
  • 30 votes cast
Feb
19
answered Could use an explanation of the notation for an oracle adversary
Feb
15
comment Encrypting a key with the same key using AES
Practically speaking it's so unlikely that it cannot be called "insecure". Theoritically speaking, if you take a look at the insides of aes you'll see that the first operation is xoring the plaintext with the key, effectively cancelling the state whatever the key. From then on the only difference between $AES_K(K)$ and $AES_{K'}(K')$ will come from the difference in the key scheduling of both keys. Hope it helps
Feb
9
comment Name for identical operations for encryption and decryption
What you consider a weakness can also become a strenght in some contexts. For example, embedded designs have very strict space requirements : having a encryption algorithm that is its own inverse is then something really valuable. Even in software it can be thought of as a good idea : less code means easier maintainability. Anyways I would say that while you're not wrong, if you can avoid it, do not give an encryption oracle to your adversary in the first place !
Jan
23
comment Initialize a PRNG with a password
I think I understand but generating with weak randomness isn't worth the fact that you don't have to store your keys. If I could store 256 bytes I rather seed my DPRNG with actual randomness then use [tools.ietf.org/html/rfc2898#section-6.2] to protect the key ?
Dec
19
comment AES vs Blowfish taking key-length into account
When considering the margin of security one should not forget that AES is THE target for more than 10 years now while the cryptanalitic effort on blowfish is not as strong nowadays
Dec
18
comment Good enough deterministic PRNG based on hashes
Good point, I forgot about the key reduction step
Dec
17
comment Good enough deterministic PRNG based on hashes
"In particular if the seed is longer than 128 bytes it becomes totally insecure" why ?
Dec
13
comment Probability that an attacker wins the discrete logarithm game when exponents are drawn from a subset
There's even a tradeoff between the running time of your algorithm and the success probability since instead of failing if the input doesn't fall in the acceptable subset you can randomize your input via a multiplication by $g^r$ (with random $r$) and run it again. I think that's called Random Self Reducibility
Dec
7
comment RSA 4096 bit key benchmark
I guess it's just vocabulary here but rather than ECDH an elliptic curve alternative for mary would be ECIES which uses ECDH as a key establishment scheme
Dec
7
comment using Post-quantum asymmetric ciphers instead of RSA
@CodeInChaos what construction were you thinking about ? I don't think composition is a terrible idea but there are exemples in which it breaks. Maybe pick $r$ at random then $m_0\gets r\oplus m$ and $m_1 \gets r$ ?
Dec
7
comment Why are protocols often proven secure under the random oracle model instead of a hash assumption?
Interestingly enough while a construction $H^2:x\to H(H(x))$ does not have this length extension property it is still distinguishable from a RO H^2 & HMAC
Dec
7
comment RSA 4096 bit key benchmark
That might help you : Benchmark
Dec
7
awarded  Commentator
Dec
7
comment Factorize RSA knowing several N and E
Yeah, like CodesInChaos I would have tried gcd on the modulis...
Dec
7
comment using Post-quantum asymmetric ciphers instead of RSA
Hasn't NTRU been broken several time by Faugère's work on Gröbner basis ?
Dec
7
awarded  Editor
Dec
7
revised Why are protocols often proven secure under the random oracle model instead of a hash assumption?
added 208 characters in body
Dec
7
answered Why are protocols often proven secure under the random oracle model instead of a hash assumption?
Nov
30
answered Stopping timing attacks on AES: Why is it important to prevent the OS from interrupting the AES computation?
Nov
29
answered Message authentication codes construction