153 reputation
4
bio website
location Troy, NY
age 30
visits member for 1 year, 11 months
seen Jun 26 at 15:59

Oct
10
comment Is it possible to demonstrate that md5(x) != x for any x?
This might be a better fit for cryptography. I'm really not sure how this is security related.
Jun
26
awarded  Commentator
Mar
13
comment Why does SHA-1 have 80 rounds?
As a note, the larger versions of SHA-2 also have 80 rounds.
Aug
16
revised MIT says: mathematical theory behind encryption is wrong. What are the consequences?
added 8 characters in body
Aug
16
comment MIT says: mathematical theory behind encryption is wrong. What are the consequences?
Great answer. Gets my upvote. Thanks for taking the time to dig in to the paper as well.
Aug
16
comment MIT says: mathematical theory behind encryption is wrong. What are the consequences?
@imichaelmiers - updated to clarify my initial intent that it was talking about finding weaknesses based on any lack of ideal randomness since it only needs to find worst cases rather than average cases. Also agree it shouldn't be the accepted answer though. I responded quickly simply to indicate there was nothing major to see here and honestly didn't bother giving it much thought beyond that since it's a fluff paper without much in the way of significant merit from what I could tell. It was intentionally a minimal first answer and I fully agree that others have done better since I posted.
Aug
16
revised MIT says: mathematical theory behind encryption is wrong. What are the consequences?
deleted 6 characters in body
Aug
15
answered MIT says: mathematical theory behind encryption is wrong. What are the consequences?
Dec
10
awarded  Editor
Dec
10
revised Can I use PGP to sign a message without providing cryptographic non-repudation?
Updated to clarify on a concern raised in comments
Dec
10
comment Can I use PGP to sign a message without providing cryptographic non-repudation?
@DChest - I'd classify DH as asymmetric, but any part of DH mutually attests to the sender and recipient. The only thing DH provides that isn't non-repudiative is the shared key which is used by a symmetric algorithm. I do think I see where you are coming from though if you assumed I was taking a looser definition of asymmetric vs symmetric. I have updated my answer to provide further clarification on this point. Thanks.
Dec
10
awarded  Teacher
Dec
10
awarded  Supporter
Dec
10
comment Can I use PGP to sign a message without providing cryptographic non-repudation?
@Flimm - Incorrect. The only thing that can be non-repudiated is the providing of the shared key. A third party can not tell if the sender or the receiver performed the symmetric encryption since it is not reliant on any secret of the sender. In other terms, it only proves that sender talked to recipient at some time.
Dec
10
comment Can I use PGP to sign a message without providing cryptographic non-repudation?
@Flimm - put more briefly, Encrypt (public_key, symmetric_key) is incomplete. It is Encrypt(public_key, Sign(private_key, symmetric_key)). Thus all that can be proven directionally is that sender sent a key to recipient.
Dec
10
comment Can I use PGP to sign a message without providing cryptographic non-repudation?
@Flimm - The symmetric key is signed by the private key of the sender. You are talking about wanting a key exchange in your question. If you limit your asymmetric cryptographic operations to only the key exchange, then the payload can not be proven to be from either party since the only encryption on the information was exposed to both parties. Since the key exchange was signed by the sender and encrypted to the receiver's public key, no third party can have access to the shared secret key.
Dec
10
comment Can I use PGP to sign a message without providing cryptographic non-repudation?
@dchest - What is possible is to exchange messages via asymmetric cryptography that allow for the secure establishment of a shared key. Anything that is shared on that shared key will then be known to be between those two parties, but the originator can not be proven as both parties have the shared secret.
Dec
10
comment Can I use PGP to sign a message without providing cryptographic non-repudation?
@dchest - Diffie Hellman key exchange is not using Asymmetric crypto to provide the service I was talking about, it was providing an agreed upon symmetric key which can then be used by both parties to exchange data. By definition, asymmetric cryptography means that only the private key holder can decrypt information encrypted with the public key and only the holder of the private key could encrypt data such that it is decryptable by the public key. Thus, it is not possible for the receiver to produce an asymmetric validation that they could have been the sender as they lack the private key.
Dec
10
answered Can I use PGP to sign a message without providing cryptographic non-repudation?