Reputation
44,934
Next tag badge:
392/400 score
82/80 answers
Badges
1 51 107
Newest
 Nice Answer
Impact
~747k people reached

Feb
5
comment Is IPsec IND-CCA secure provided the used block cipher is a pseudorandom function?
@SkyPassaro: this imples that you can't prove IND-CCA for all modes of operation (that's actually known not to be true; for example, you don't have to encrypt). Instead, you need to make assumptions about which IPsec transforms are being used (and in which order).
Feb
5
comment Is IPsec IND-CCA secure provided the used block cipher is a pseudorandom function?
@SkyPassaro: technically speaking, GCM is neither EtA nor AtE nor E&A, but instead is a combined mode (which does both encryption and authentication; all the details are hidden within the mode). As for CBC and CTR mode, the modes themselves don't do authentication; however the standard ways of doing the transform is, in fact, EtA. However, there's nothing in the RFCs that say that you have to do it that way (or, in fact, that you have to do authentication at all); if you somehow configure things to do AH and then an outer ESP (without authentication), you're in AtE-land.
Feb
5
answered How to generate a random number so server cannot cheat?
Feb
5
awarded  dsa
Feb
4
answered What is the difference between SHA-3(Keccak) and previous generation SHA algorithms?
Feb
4
comment How does a non-prime modulus for Diffie-Hellman allow for a backdoor?
@SamuelNeves: with $p-1 = 2^i3^jk^k$, $i, j, k$ would have to be fairly modest, and so I suspect that a standard P.H. attack would break it easier than you'd hope. As for $(2^{32}-c)^{16}$, I suspect that has a better chance, but mostly because a standard attack wouldn't bother trying that. In any case, what I'm trying to take advantage of is, if $p-1$ has a largest factor $q$, then using the backdoor would take $O(\sqrt{q})$ time, but finding the backdoor would take $O(q)$ time. I'm trying to arrange $q$ so that $\sqrt{q}$ effort is feasible, but $q$ is not
Feb
4
revised Secure randomized data matching?
added 6 characters in body
Feb
4
revised Secure randomized data matching?
added 766 characters in body
Feb
4
answered Secure randomized data matching?
Feb
4
answered Multi-target attacks on AES-CTR with a random nonce
Feb
4
awarded  number-theory
Feb
4
answered Security of a parallelizable block cipher mode
Feb
4
comment How does a non-prime modulus for Diffie-Hellman allow for a backdoor?
@David天宇Wong: I think you mean $a + kp_1$. In any case, all those values are exactly the same, as $g^a = g^{a + kp_1)$, so there's no difference; there's no point in brute-forcing anything. Remember, the order of $g$ is $p_1$...
Feb
3
comment Need help with PKCS#12 3 key triple des key expansion
Typically, when we generate a (3 key) 3DES key, yes, we do indeed generate 192 bits of key (and the lsbits end up being ignored). However, I haven't worked with PKCS#12, and so I won't make this an answer.
Feb
3
comment How does a non-prime modulus for Diffie-Hellman allow for a backdoor?
@David天宇Wong: if the order of $g$ is $p_1$, then the value of $a \pmod{p_1}$ gives us the value of $a$ in $g^a \bmod{p}$
Feb
3
comment How does a non-prime modulus for Diffie-Hellman allow for a backdoor?
@David天宇Wong: no; however if you get to choose $g$ (the generator for the DH operation), you don't have to; as long as you can perform the dlog operation on $g^a$, that's good enough.
Feb
3
comment Secure blinding factor switching at malicious server-side (Switching in One Time pad)
What's the problem you're trying to solve? From the title you gave your question, you're thinking of some specific use - I have no idea what that is.
Feb
3
comment How does a non-prime modulus for Diffie-Hellman allow for a backdoor?
@David天宇Wong: I'm looking at how someone who picks the modulus ("the attacker") can use a composite modulus to hide a small group (or other) attack. Yes, he could also pick a 1024 bit prime that is vulnerable to a small group attack, but anyone else who notices that $p-1$ is smooth can also listen in - I'm going through ways we can do NOBUS ("nobody but us") - that is, the installer can listen in, but it's hard for anyone else, even if they have a guess to what the attacker did.
Feb
3
revised How does a non-prime modulus for Diffie-Hellman allow for a backdoor?
added 59 characters in body
Feb
3
revised How does a non-prime modulus for Diffie-Hellman allow for a backdoor?
added 359 characters in body