29,875 reputation
12359
bio website
location
age
visits member for 3 years
seen 13 mins ago

Feb
21
comment Compared to GCM or XTS modes, how secure is H xor R1, E (R2, R1, Message) for confidentiality and integrity?
I don't see any immediate way how malleability of $E$ can be immediately exploited. Yes, you can change what the $Message$ (and $R1$, $R2$) decrypts to; however unless you can predict what $R1$ and $R2$ are, I see no obvious way for the attacker to adjust the sent $H \oplus R1$ so that it matches the computed $Hash(R1', R2', Message') \oplus R1'$ (assuming, of course, that the hash function is nonlinear)
Feb
20
answered Does Runge phenomenon affect Shamir's secret sharing scheme?
Feb
18
comment Exercise: Attack on a Two-Round DES Cipher
Yes, I mean precisely that.
Feb
18
comment Exercise: Attack on a Two-Round DES Cipher
Also, you have a number of plaintext/ciphertext pairs (and hence multiple $F(R_0, K_0)$, $R_0$ pairs. How can you use these multiple sets to make recovering $K_0$ even easier?
Feb
18
comment Exercise: Attack on a Two-Round DES Cipher
"[I'm] not at all sure whether I am on the right path"; you are on the right path. If you know $F(R_0, K_0)$ and $R_0$, how can you recover $K_0$? Hint: look at the details of $F$.
Feb
18
comment Finding if exponent share is present in dlog instance
If $y$ is an integer, and $x_1$ is a group element, how does $y - x_1 = x_2$ make sense? Are you assuming a specific group representation (so you can map between integers and group elements)? Are, if you compute $y - x_1$ either in the integers or within the group, won't such an $x_2$ always exist?
Feb
18
revised Digital signatures under plain RSA
deleted 2 characters in body; edited tags
Feb
18
comment Digital signatures under plain RSA
We rather expect you to do your own homework. What have you tried?
Feb
17
revised ElGamal in private set intersection: how to handle negative numbers?
More explicit
Feb
17
comment Partially-known-plaintext attack of a stream cipher based on modular arithmetic
This is homework, right? Well, you're supposed to learn from homework. Neither fgrieu nor I will give you the answer, because you'll learn by figuring it out yourself. The point of this exercise is not this specific question, but how to think about problems like this. Just consider the hints that we've been giving you.
Feb
17
comment Partially-known-plaintext attack of a stream cipher based on modular arithmetic
$n$ and $e$??? You mean $g$ and $p$, maybe? Hint: it turns out you don't really need $g$. And, for extra credit (after you solve this problem), if you don't have $p$, but do have the first 3072 bits of plaintext-ciphertext, how can you recover $p$?
Feb
17
comment Partially-known-plaintext attack of a stream cipher based on modular arithmetic
You have the first 1024 bits of plaintext-ciphertext; how can you deduce $F(r)$ from that? If you have $F(r)$, how do you deduce $F(2\cdot r)$?
Feb
17
answered ElGamal in private set intersection: how to handle negative numbers?
Feb
17
comment GCM encryption for 256-bit and 512-bit block ciphers
@CodesInChaos: hmmm, good point. GCM, as specified, matches the block size with the field size. If we break that assumption, and: use the first 128 bits of the encryption of 0 as your H; and do some reasonable splitting of the keystream to encrypt the payload and the tag (I can think of two reasonable alternatives), well, one gets something that is distinctly GCM-ish, and I still believe the security proofs still apply.
Feb
16
comment Simplified Fiat-Shamir example generates wrong output
No, he means checking whether $y^2 \equiv x \cdot v^e\ (\bmod\ n)$. One way of writing that is checking whether $(y^2 \bmod n) = ((x v^e) \bmod n)$. Remember, the squaring of $y$ occurs within the group, and hence is implicitly done modulo $n$.
Feb
15
answered GCM encryption for 256-bit and 512-bit block ciphers
Feb
15
comment Hash functions with or without secret key
"Usually MACs are not called hash functions (with key)"; this is certainly true, because often a MAC is not a secure hash function against someone who knows the MAC key. Nothing in the definition of a MAC requires it to be, and a lot of real MACs in practice (e.g. CMAC) don't even have preimage resistance if you know the key.
Feb
15
reviewed Approve suggested edit on alternating-step tag wiki
Feb
15
reviewed Approve suggested edit on threshold-cryptography tag wiki excerpt
Feb
15
reviewed Approve suggested edit on alternating-step tag wiki excerpt