poncho
Reputation
42,352
97/100 score
 May 19 comment Has a collision ever been found for SHA-1/2/3 when truncated to 128 bits? @Anon2000: nope; remember, the cycle is unlikely to include the beginning value; instead, there'll be a series of unique values, and then you'll hit the cycle. Now, you could arbitrarily zero out the XOR after it's likely you've entered the cycle; that'll allow to do detect the size of the cycle; it's not as clear how you'd find out how you entered the cycle (which is what you're really interested in) May 19 comment Has a collision ever been found for SHA-1/2/3 when truncated to 128 bits? @Anon2000: I don't see how you would make it work. When you hit a cycle, the XOR wouldn't zero out (as the values prior to when you hit the loop wouldn't zero out); instead the XOR's would return to values you've previously seen. And, looking for values previously seen is the problem we're trying to solve... May 19 comment Has a collision ever been found for SHA-1/2/3 when truncated to 128 bits? @Anon2000: yes, the method that SOJPM suggested is known as rho cycle finding. The approach that I suggested (which is rather different) is more related to the Hellman time-memory tradeoff. I suspect the method I suggested is more practical (for one, it's more parallelizable; rather important if you're contemplating $2^{64}$ computations...) May 19 comment Has a collision ever been found for SHA-1/2/3 when truncated to 128 bits? @Anon2000: one obvious way is to do iterated hashing (where we compute $x_i = Hash_{128}(x_{i-1})$, and stop at distinguished points (say, the first 32 bits are all zero), and store the initial/final values in a table. Build up a long list of such table entries (circa $2^{32}$ should do), and look for collisions in the final value -- if we find one, then the two chains merge (and finding where the chains merge is straight-forward). That's not a zero-memory solution, however it gets the memory requirements small enough... May 19 comment Has a collision ever been found for SHA-1/2/3 when truncated to 128 bits? Also note that there are ways to search for such a collision that radically reduce the amount of memory required (at not that huge of a computational cost). May 19 reviewed Close What should I think about these unique certificate serial numbers May 19 reviewed Leave Open Does failure of indistinguishability of encryptions imply lack of CPA-security? May 19 comment Elliptic Curve Cryptography Encryption and text representation implementation Is implementing ECIES allowed? That's a way of doing public key encryption with Elliptic Curves that doesn't involve translating the plaintext into a point. May 19 revised Post-quantum authenticated encryption added 101 characters in body May 19 revised Post-quantum authenticated encryption added 238 characters in body May 19 answered Post-quantum authenticated encryption May 19 reviewed Leave Open Building a combined encryption scheme from two encryption schemes that's secure if at least on of them is secure May 19 reviewed Delete Post-quantum authenticated encryption May 19 reviewed No Action Needed Is the hash function defined in this exercise collision-resistant? May 19 reviewed No Action Needed Elliptic Curve Cryptography Encryption and text representation implementation May 18 comment What are some hashes that do not exhibit the avalanche effect? Also, what security properties do you need from the hash? Collision resistance (we can't find two messages that hash to the same value)? Preimage resistance (given a value, we can't find a message that hashes to that value)? May 18 comment Which of these is a secure MAC? @user110219: I still don't understand how we are in danger; if the attacker has two message/tag pairs $(M_1, T)$ and $(M_2, T)$, how can they use that to find a tag for a third message? May 18 comment Which of these is a secure MAC? @user110219: how would security be compromised? Remember, MACs need not be compromised if you find a 'collision'; that are compromised if the attacker finds a new message/tag pair. May 17 revised On composition of encryption schemes added 392 characters in body May 17 comment On composition of encryption schemes Yes, we need to assume that the keys are independent; I'll update my answer accordingly