226 reputation
26
bio website
location
age
visits member for 1 year, 5 months
seen Mar 11 at 6:07

Mar
11
awarded  Revival
Mar
11
answered Is there any restriction in using lossless compression algorithms for huge key sizes?
Mar
7
comment Is key size the only barrier to the adoption of the McEliece cryptosystem, or is it considered broken/potentially vulnerable?
The mathematics behind error correcting codes seems a bit more complicated than "mere linear algebra". At the very least, it involves analyzing polynomials over finite fields.
Jan
15
comment One-Time-Pad with key-reuse: Faster way of decrypting?
Here's what I'd do. Find a corpus and generate a Markov model for the text. This will give you an approximately probability for the original plaintexts given any sequence of xor differences for how ever many characters of history you chose. It will happen that some xor differences are incredibly distinctive meaning you can guess the corresponding plaintext with high confidence. For example, you could probably find all the spaces and punctuation this way, at which point the rest should be easy.
Dec
21
comment SHA-256: (Probabilistic?) partial preimage possible?
@Hanno if it were that easy someone would have done it. SAT solving has been used successfully in cryptanalysis, but usually it's to assist with an attack found by manual analysis. With any modern cipher, you can't just plug the whole thing into a solver and hope to get anywhere.
Dec
21
comment Is there a name for this 'enhanced' caeser shift and if so, is it trivial to break?
Even a general Vigenere cipher is pretty easy to break with low entropy plaintext, and this is just a special case of that.
Dec
21
comment How can uniformity of hash functions (e.g. SHA-256) be proved?
It relies on partial pre-image resistance, not uniformity. It's trivial to create hash functions with provably uniform output (such as the identity function) but that doesn't mean they're secure.
Dec
17
comment Help with linear cryptanalysis
Using a more accurate probability calculation, my best equation has an estimated bias of around $2^{-74.6}$, which is obviously worse than brute force.
Dec
17
comment Help with linear cryptanalysis
I've read several of those papers, as well as Matsui's original paper. But I haven't seen anything better than what I'm already doing. I'm beginning to suspect that the cipher I'm trying to break just has too much mixing and too many rounds to be vulnerable to linear crpytanalysis, despite the weak sbox. Comparing the design to DES, which linear crypto was invented to attack, it seems that DES doesn't have the mixing stage (T and the extra xor) that rj2 does. With DES, it's just a straight permutation, but here the intermediate bits are being xored together.
Dec
16
awarded  Yearling
Dec
15
asked Help with linear cryptanalysis
Dec
14
comment Randomized stream cipher using multivariant quadratic equations
Why are $n^2$ plaintext bits required instead of $n^2/2$?
Aug
6
comment Practical consequences of using functional encryption for software obfuscation
The constants involved in FHE mean it is not even remotely practical. Also, obfuscation will never been practical in situations where maximum performance is critical since there is an inherent penalty to not being able to understand the code you're executing (branch misprediction, cache misses, etc.) It's conceivable that advances in obfsucation may someday let it be executed within a small factor of native performance though (Say 100x slowdown), in which case it would see potential applications.
Jul
3
comment Can two cipher letters per plaintext letter easily defeat character frequency analysis?
Given sufficient ciphertext, you can still do frequency analysis. All you did was make the alphabet much larger.
Jul
3
comment Seemingly simple (?) decryption question
This isn't a known plaintext attack. It's not really cryptography at all. What you're trying to do is reverse engineering, and would likely be better off in a different forum.
Jun
28
awarded  Critic
Jun
28
comment Is my one time pad cipher secure?
The answer to "Is my custom crypto implementation secure?" is always "probably not".
Jun
24
comment If we can find prime numbers larger than 17 milion digits, why can't we find all 1024bit primes?
Generally when you see stuff about largest primes, it's all Mersenne Primes, which don't really have anything to do with general purpose primality testing. And neither has anything to do with cracking RSA.
May
29
awarded  Commentator
May
29
comment What security authorities and standards reject $e=3$ in RSA, when, and with what rationale?
@fgrieu Personally, when I see a string of partial attacks on e=3, that leads me to worry about future development of more general attacks. Why not reduce the risk now at minimal cost by using a larger exponent?