124 reputation
4
bio website
location
age
visits member for 2 years, 1 month
seen Aug 22 '13 at 14:58

Jun
3
comment With HMAC, can an attacker recover the key, given many known plaintext/tag pairs?
And what was the original reason?
Jun
2
comment Proving HMAC collision probability bounds?
I didn't miss the assumptions. You just didn't make them explicit (i.e. that output is random). What makes you think it is random? I don't think the question needs editing. I clearly ask about result or (references to) proofs where the asked probability is analyzed somewhat more rigorously. I haven't asked about making additional assumptions. Don't take it personally, but if you criticize my question do it right. However it may be, thank you for participating in this (and other) discussion(s).
Jun
2
comment Proving HMAC collision probability bounds?
I understand you assume that HMAC output is totally random. However as far as I know this is not proved.
Jun
2
comment With HMAC, can an attacker recover the key, given many known plaintext/tag pairs?
Well, I did read some elementary work on MAC and HMAC. However I couldn't find somewhere an analysis of the question I am asking. Note I am not asking the recoverability of the input message. Nor I am asking about the probability of tag collisions (which in case of HMAC is given by the generic birthday attack). I wonder why some users make so many assumptions about the people that ask questions.. In any case @D.W. thank you for at least commenting on the question.
May
31
comment Proving HMAC collision probability bounds?
Pointers to actual papers is not that much to ask. If you don't want to answer the original question why bother writing answers or comments that are not helpful?
May
31
comment With HMAC, can an attacker recover the key, given many known plaintext/tag pairs?
Anyone cares to comment on the downvotes?
May
30
comment Proving HMAC collision probability bounds?
I am interested in actual numbers or pointers to papers with actual probability estimation, not in the notation itself ;)
May
30
comment Proving HMAC collision probability bounds?
I am not sure whether I don't understand your answer or whether you didn't understand my question. What is Ao, O(m1) ?
May
30
comment Proving HMAC collision probability bounds?
No. Messages m1 and m2 are both known and might even be very similar (e.g. two consecutive timestamps).
Mar
18
comment How to verify a number encrypted with an unknown key
@antosecret This kind of scenario could be useful when fine grained data must be known only to Alice (e.g. 40, 45, 18, etc..) but the aggregated information is ok to share with Bob (e.g. their sum). Alice could give her secret key for Bob to decrypt the sum but this would enable him also to decrypt the terms. Note that Bob takes the computation overhead by "summing" the terms in encrypted form, he only asks Alice to tell what that number is but would like to verify she is not lying.
Mar
18
comment How to verify a number encrypted with an unknown key
@DavidSchwartz The scheme is not that simple. When Alice stores data, she stores the terms (e.g. 40, 45, 18, etc.) encrypted with her secret key. The terms are then added by Bob, at some later time. So Bob would obtain 40+45+18=103 in encrypted form. 103 is encrypted with Alice's secret key. So Bob needs to ask her to decrypt the value and send it (in my case re-encrypted with Bob's key, but this is not essential). The question is how to verify Alice indeed sends the correct sum and not 103-20 = 80 for example.
Feb
6
comment Is such a crypto-system available?
@poncho Regarding the storage you are right: its either storing or recomputing it every time you need to retrieve/share some data. Making new trees requires recomputing not only the hashes but re-encrypting the database on each insertion :). I hope it is understood that this is just an open discussion. I am not nitpicking or something like that.
Feb
6
comment Is such a crypto-system available?
@poncho Could you point out to a paper that explains the efficiency of the factorization in case same modulus is reused for multiple pairs?
Feb
6
comment Is such a crypto-system available?
@poncho The solution satisfies the requirements although I would like to share my thoughts on its deficiencies (btw. Bob knows k_new and Eve knows k2). First is the storage overhead needed to store the hash tree. With the Barack Obama's solution I have to store k_new (and modulus) only for the portions I share (although public key crypto is much slower than symmetric encryption). If new data is added there is a problem again (if I shared H8 now Bob would know also H16, H17, right?). Regarding my interests: they are mixed indeed, but solving the real example has a bigger priority for me.
Feb
6
comment Is such a crypto-system available?
@BarackObama I think the conditions haven't changed that much from the original (a non-negligible change is that I haven't thought that alternative k2' k_new' pairs might reveal original k1). The use case description is just an example to help other readers understand the abstract description, no new requirements are introduced there. However it may be, I am thankful to all people considering this post worth spending their time, regardless of the actual contributions. By the way using different modulus for different pairs seems to solve the (k2', k_new') problem.
Feb
6
comment Is such a crypto-system available?
@fgrieu there is no need in a trusted authority. Alice generated k1, k2 and computes k_new as a function of k1 and k2. It is ok if k_new is independent of k1 and k2 but I can't imagine something like this is possible (after all c2 is some sort of a function of k1 and k2). Bob needs only k_new to recover the original plaintext.
Feb
6
comment Is such a crypto-system available?
@IlmariKaronen yes the questions seem to be identical, except mine has a "non-theoretical" use case :) and there is no requirement on the type of cryto-system used.
Feb
6
comment Is such a crypto-system available?
It doesn't matter for me as long as it satisfies the properties specified in the question. The originator of the data has key k1, Alice has key k_new. Even if Alice finds k2 or any other pairs (k2', k_new') she shouldn't be able to compute k1.
Feb
6
comment Is such a crypto-system available?
@jug Searching for "DES is not a group" I gradually found proxy re-encryption which seems like something I am looking for.
Feb
6
comment Is such a crypto-system available?
The point is not to make the encryption stronger, the point is to enable a third party see only a subset of the data with minimal overhead (avoiding the naive scenario where one has to decrypt c1, encrypt with k2 and then just share k2).