26,078 reputation
11847
bio website
location
age
visits member for 2 years, 8 months
seen 8 mins ago

7h
answered One time pad: why is it useless in practice?
8h
comment Security of permutation cipher
@Thomas: actually, if you can recover $\sigma_1$, you can recover essentially everything. You can compute $\sigma_1^{-1}(Ciphertext)$, and that gives you essentially a simple substitution cipher within each generation; solving a substituion cipher given 256 bytes of encrypted ASCII English is trivial.
1d
comment Security of permutation cipher
@Thomas: if we know $\sigma_1$, we can compute $\sigma^{-1}(C)$ for the entire ciphertext in a generation. Within that generation, we know that $\sigma_2(\sigma_3(...\sigma_n(P))...)$ is a fixed permutation, hence $\sigma_1^{-1}(C_i) = \sigma_1^{-1}(C_j)$ (note: those two $\sigma_1$'s have a known shift in relationship to each other) iff the corresponding plaintext bytes are the same. Does this help???
1d
comment Is it possible to crack any MD5 hash?
If by "private key", he meant "the text that was hashed", well, if it's short, I'm sure someone has built a Rainbow table for MD5. If it's long, it's infeasible.
1d
answered Security of permutation cipher
1d
comment Existence of a map $\phi:\mathbb{Z}_{N^2}^* \mapsto \mathbb{F} $
Actually, that's the problem: $\mathbb{Z}_{N^2}^*$ is not a cyclic group.
1d
comment Is there a simple zero knowledge proof of $x$ for $b=x^x\pmod p$?
I just don't trust the argument "our normal techniques cannot solve this problem, hence this problem cannot be solved". We know that a complex ZK proof is possible; the standard ways to generate a short proof do not work, however I cannot say that there isn't an alternative short way (that we haven't thought of) that would work.
1d
comment Existence of a map $\phi:\mathbb{Z}_{N^2}^* \mapsto \mathbb{F} $
Actually, we know that a bijective function cannot exist (even if you omit the element 0 of the field).
1d
comment Existence of a map $\phi:\mathbb{Z}_{N^2}^* \mapsto \mathbb{F} $
@tylo: actually, because he wants the multiplicative operation to be preserved, the appropriate order is $x^a-1$. In any case, we can show that an injective map cannot exist; a surjective map (where surjective is defined to mean "we map to all elements of the field other than 0") does exist, however whether a nontrivial map exists in general is less clear.
1d
answered Composing hashes and/or MACs
1d
comment Existence of a map $\phi:\mathbb{Z}_{N^2}^* \mapsto \mathbb{F} $
If you want to define a mapping between one set and the other, it's easy; you can define a mapping to $GF(2^{256})$ using SHA256. However, presumably you also insist that the mapping also preserve the group operation; however any field has two operations defined on it; which field operation should the group operation be mapped to? In other words, should $\phi(ab) = \phi(a)+\phi(b)$ or $\phi(ab) = \phi(a)\phi(b)$?
2d
comment Is there a simple zero knowledge proof of $x$ for $b=x^x\pmod p$?
I disagree; just because someone can deduce some information from $b$ doesn't disqualify a ZK proof; all it means is that the ZK proof can't reveal anything more. You can obviously put together a ZK proof by designing a circuit that computes $z^z \bmod p$ for $z<p$, and prove that you know an input $z$ that generates $b$. While this shows that a ZK proof is possible, it really doesn't answer the question; we are asked for a simple proof, and unless your definition of simple is considerably broader than mine, the circuit method wouldn't qualify.
2d
revised Has there ever been more then a theortetical difference between preimage resistance and second preimage resistance?
added 448 characters in body
2d
answered Has there ever been more then a theortetical difference between preimage resistance and second preimage resistance?
2d
revised Block cipher and parity of permutation
Changed 'all Feistel cipher' to 'most Feistel cipher'; I did give a counterexample
2d
answered Block cipher and parity of permutation
2d
comment Does IKEv2 protocol have two modes like IKE
@Gev_sedrakyan: I tried to cover that in my answer; during initial SA bring up, IKEv2 does not have one set of exchanges to bring up the IKE SA, and then a second set to bring up the IPSec SA; it's done with one set. Now, afterwards, there is a "Child SA" exchange; that's used both as a "non-initial Quick Mode" (both to rekey IPSec SAs, and to create new ones), and as a way to rekey an IKE SA (which IKEv1 doesn't do; it does an independent Main Mode/Aggressive Mode to "rekey" an IKE SA).
2d
comment Does IKEv2 protocol have two modes like IKE
@Gev_sedrakyan: actually, they are separate, for example, you can rekey one without the other, and one IKEv2 SA can parent multiple IPSec SAs simultaneously. However the IKEv2 mandates that they be initially generated at the same time, and that they are related in a closer way than what IKEv1 mandated.
2d
revised Does IKEv2 protocol have two modes like IKE
Expanded explination
2d
revised Does IKEv2 protocol have two modes like IKE
edited tags