124 reputation
4
bio website
location
age
visits member for 1 year, 5 months
seen Aug 22 '13 at 14:58

Jun
3
revised With HMAC, can an attacker recover the key, given many known plaintext/tag pairs?
edited title
Jun
3
comment With HMAC, can an attacker recover the key, given many known plaintext/tag pairs?
And what was the original reason?
Jun
2
comment HMAC collision probability bounds
I didn't miss the assumptions. You just didn't make them explicit (i.e. that output is random). What makes you think it is random? I don't think the question needs editing. I clearly ask about result or (references to) proofs where the asked probability is analyzed somewhat more rigorously. I haven't asked about making additional assumptions. Don't take it personally, but if you criticize my question do it right. However it may be, thank you for participating in this (and other) discussion(s).
Jun
2
accepted With HMAC, can an attacker recover the key, given many known plaintext/tag pairs?
Jun
2
comment HMAC collision probability bounds
I understand you assume that HMAC output is totally random. However as far as I know this is not proved.
Jun
2
comment With HMAC, can an attacker recover the key, given many known plaintext/tag pairs?
Well, I did read some elementary work on MAC and HMAC. However I couldn't find somewhere an analysis of the question I am asking. Note I am not asking the recoverability of the input message. Nor I am asking about the probability of tag collisions (which in case of HMAC is given by the generic birthday attack). I wonder why some users make so many assumptions about the people that ask questions.. In any case @D.W. thank you for at least commenting on the question.
May
31
comment HMAC collision probability bounds
Pointers to actual papers is not that much to ask. If you don't want to answer the original question why bother writing answers or comments that are not helpful?
May
31
comment With HMAC, can an attacker recover the key, given many known plaintext/tag pairs?
Anyone cares to comment on the downvotes?
May
30
comment HMAC collision probability bounds
I am interested in actual numbers or pointers to papers with actual probability estimation, not in the notation itself ;)
May
30
comment HMAC collision probability bounds
I am not sure whether I don't understand your answer or whether you didn't understand my question. What is Ao, O(m1) ?
May
30
comment HMAC collision probability bounds
No. Messages m1 and m2 are both known and might even be very similar (e.g. two consecutive timestamps).
May
30
asked HMAC collision probability bounds
May
30
asked With HMAC, can an attacker recover the key, given many known plaintext/tag pairs?
Mar
22
awarded  Student
Mar
18
accepted How to verify a number encrypted with an unknown key
Mar
18
comment How to verify a number encrypted with an unknown key
@antosecret This kind of scenario could be useful when fine grained data must be known only to Alice (e.g. 40, 45, 18, etc..) but the aggregated information is ok to share with Bob (e.g. their sum). Alice could give her secret key for Bob to decrypt the sum but this would enable him also to decrypt the terms. Note that Bob takes the computation overhead by "summing" the terms in encrypted form, he only asks Alice to tell what that number is but would like to verify she is not lying.
Mar
18
comment How to verify a number encrypted with an unknown key
@DavidSchwartz The scheme is not that simple. When Alice stores data, she stores the terms (e.g. 40, 45, 18, etc.) encrypted with her secret key. The terms are then added by Bob, at some later time. So Bob would obtain 40+45+18=103 in encrypted form. 103 is encrypted with Alice's secret key. So Bob needs to ask her to decrypt the value and send it (in my case re-encrypted with Bob's key, but this is not essential). The question is how to verify Alice indeed sends the correct sum and not 103-20 = 80 for example.
Mar
18
revised How to verify a number encrypted with an unknown key
added 6 characters in body
Mar
18
asked How to verify a number encrypted with an unknown key
Feb
6
comment Is such a crypto-system available?
@poncho Regarding the storage you are right: its either storing or recomputing it every time you need to retrieve/share some data. Making new trees requires recomputing not only the hashes but re-encrypting the database on each insertion :). I hope it is understood that this is just an open discussion. I am not nitpicking or something like that.