26,223 reputation
11947
bio website
location
age
visits member for 2 years, 8 months
seen 8 hours ago

8h
comment Are the MD5 constants an S-Box?
@HennoBrandsma: Yes, I know; I did say that the sboxes in AES were not the original. However, it is easier to explain the sboxes there than the sboxes within DES, hence I used that as the example.
1d
comment Are the MD5 constants an S-Box?
@BastianBorn: no, that data is added to the current data; it's no more an "sbox" than the "S" constants are.
1d
answered Are the MD5 constants an S-Box?
1d
comment Is less security required for a short stream cipher than for the AES enciphering of very long messages?
"If I invent my own crypto scheme ... I will know it is free of ... other weakness that the community just doesn't know about today". Actually, you don't know that; in fact, any scheme you can come up with is likely to be less secure than AES.
1d
comment Why does computing g^a * g^{-a} with the PBC library result in zero?
Also, doesn't element_pow_zn take three parameters?
2d
comment One time pad: why is it useless in practice?
@rossum: What you say is true; however I didn't raise that issue because the secure channel may have significant latency (e.g. require a physical meeting), and you cannot tolerate that latency when sending the actual message; hence OTP may be useful that way. That said, conventional crypto also does the same thing, and generally in a more useful way.
2d
awarded  Necromancer
Apr
17
answered One time pad: why is it useless in practice?
Apr
17
comment Security of permutation cipher
@Thomas: actually, if you can recover $\sigma_1$, you can recover essentially everything. You can compute $\sigma_1^{-1}(Ciphertext)$, and that gives you essentially a simple substitution cipher within each generation; solving a substituion cipher given 256 bytes of encrypted ASCII English is trivial.
Apr
16
comment Security of permutation cipher
@Thomas: if we know $\sigma_1$, we can compute $\sigma^{-1}(C)$ for the entire ciphertext in a generation. Within that generation, we know that $\sigma_2(\sigma_3(...\sigma_n(P))...)$ is a fixed permutation, hence $\sigma_1^{-1}(C_i) = \sigma_1^{-1}(C_j)$ (note: those two $\sigma_1$'s have a known shift in relationship to each other) iff the corresponding plaintext bytes are the same. Does this help???
Apr
16
comment Is it possible to crack any MD5 hash?
If by "private key", he meant "the text that was hashed", well, if it's short, I'm sure someone has built a Rainbow table for MD5. If it's long, it's infeasible.
Apr
16
answered Security of permutation cipher
Apr
16
comment Existence of a map $\phi:\mathbb{Z}_{N^2}^* \mapsto \mathbb{F} $
Actually, that's the problem: $\mathbb{Z}_{N^2}^*$ is not a cyclic group.
Apr
16
comment Is there a simple zero knowledge proof of $x$ for $b=x^x\pmod p$?
I just don't trust the argument "our normal techniques cannot solve this problem, hence this problem cannot be solved". We know that a complex ZK proof is possible; the standard ways to generate a short proof do not work, however I cannot say that there isn't an alternative short way (that we haven't thought of) that would work.
Apr
16
comment Existence of a map $\phi:\mathbb{Z}_{N^2}^* \mapsto \mathbb{F} $
Actually, we know that a bijective function cannot exist (even if you omit the element 0 of the field).
Apr
16
comment Existence of a map $\phi:\mathbb{Z}_{N^2}^* \mapsto \mathbb{F} $
@tylo: actually, because he wants the multiplicative operation to be preserved, the appropriate order is $x^a-1$. In any case, we can show that an injective map cannot exist; a surjective map (where surjective is defined to mean "we map to all elements of the field other than 0") does exist, however whether a nontrivial map exists in general is less clear.
Apr
16
answered Composing hashes and/or MACs
Apr
16
comment Existence of a map $\phi:\mathbb{Z}_{N^2}^* \mapsto \mathbb{F} $
If you want to define a mapping between one set and the other, it's easy; you can define a mapping to $GF(2^{256})$ using SHA256. However, presumably you also insist that the mapping also preserve the group operation; however any field has two operations defined on it; which field operation should the group operation be mapped to? In other words, should $\phi(ab) = \phi(a)+\phi(b)$ or $\phi(ab) = \phi(a)\phi(b)$?
Apr
15
comment Is there a simple zero knowledge proof of $x$ for $b=x^x\pmod p$?
I disagree; just because someone can deduce some information from $b$ doesn't disqualify a ZK proof; all it means is that the ZK proof can't reveal anything more. You can obviously put together a ZK proof by designing a circuit that computes $z^z \bmod p$ for $z<p$, and prove that you know an input $z$ that generates $b$. While this shows that a ZK proof is possible, it really doesn't answer the question; we are asked for a simple proof, and unless your definition of simple is considerably broader than mine, the circuit method wouldn't qualify.
Apr
15
revised Has there ever been more then a theortetical difference between preimage resistance and second preimage resistance?
added 448 characters in body