Reputation
48,191
Next tag badge:
94/100 score
20/20 answers
Badges
1 57 113
Impact
~831k people reached

Aug
18
comment Is calculating HMAC from hashed input a good idea?
It comes down to what the question is. Is it "would doing HMAC(K, H(M)) yield any practical attacks", or "might there be academic attacks on HMAC(K, H(M)) that would be easier than HMAC(K, M)?"
Aug
18
answered Is calculating HMAC from hashed input a good idea?
Aug
17
awarded  Nice Answer
Aug
15
comment Perfect secrecy with n-time key
Actually, in your example, $E(M) = (K_1M + K_0) \bmod p-1$, then either you leak $M_0 - M_1 \bmod 2$, or you can't uniquely decrypt. If $K_1$ is even, you can't uniquely decrypt (because $p-1$ is even). If $K_1$ is odd, then $E(M_0) - E(M_1) \equiv M_0 - M_1 \pmod{2}$ (again, because $p-1$ is even). Try $E(M) = (K_1M + K_0) \bmod p$ instead
Aug
14
comment Simple example to describe Bilinear mapping
@hanugm: I selected 3 because the order of 3 (mod 11) is 5; that is, $3^5 \bmod 11 = 1$ and $3^x \bmod 11 \ne 1$ for $0 < x < 5$. Any such value with this property will work, and in fact, 5 will (in fact) work.
Aug
13
answered Is (AES-)GCM parallelizable?
Aug
13
comment How to hash similar strings to the same hash value?
And, it's easy to show that the only hash function where $H(s_1) = H(s_2)$ holds consistently is one which is constant (for a specific input length). So, assuming that a constant output isn't the answer you're looking for, how often must $H(s_1) = H(s_2)$ hold?
Aug
12
comment Standard format to encode AES cipher and random IV
The most common format I've seen is just prepend the IV, that is, store the IV as the first 16 bytes of the ciphertext (and the actual ciphertext as the rest). BTW: AES-256 does not have the same length key as the CBC mode size; instead, it has 32 byte (256 bit key, that's what the -256 in AES-256 means) key, and a 16 byte (128 bit) block size.
Aug
12
comment Can one construct OTPs without using XOR?
Hint: what does "perfect secrecy" mean? In addition, you need to consider what precisely do you mean by $r \in (0;n)$. Is that equivalent to $0 < r < n$?
Aug
12
comment How to generate a large random number from smaller ones?
That's too small to be secure; there are known ways to solve the DLog problem practically against a prime that small. Instead, you need a $p$ at least around $2^{1024}$, and nowaways $2^{2048}$ is considered prudent
Aug
11
comment How to generate a large random number from smaller ones?
Actually, if you're generating a value for DH, there's isn't much point in generating a value from the entire range $[1, p-2]$; you get as much security from a smaller range, perhaps $[1, 2^{256}]$. On the other hand, if you're doing ECDH, you really do want to generate from the entire range $[1, n-1]$ (where $n$ is the point order)
Aug
11
revised How to generate a large random number from smaller ones?
added 1 character in body
Aug
11
comment Simple example to describe Bilinear mapping
@hanugm: actually, in my case, $\mathbb{G}_T$ really is the group of quadratic residues modulo 11, and the size of that group is 5.
Aug
10
awarded  Yearling
Aug
10
comment How can I compare two hash algorithms?
Can't add much to CodesInChaos's correct comment. However, when it comes to using NP-complete problems in crypto, we try to do it so that breaking it implies that we can solve the hard problem; can you show that in your case - can you show that if you (for example) find a collision, you can quickly solve a hard instance of the NP-complete problem?
Aug
10
comment How do we generate AES S-BOX?
I voted to reopen, because I don't think it's an exact duplicate. The 'How are the AES S-Boxes calculated' question assumes we understand inversion in $GF(2^8)$ (note, not $GF(2)^8$); this question explicitly assumes the submitter doesn't.
Aug
10
comment Factors of the group order to secure against Pohlig-Hellman
@RickyDemer: good catch; I was focusing in on what Controlk obviously meant, and forgot to read the actual words he used.
Aug
10
revised Factors of the group order to secure against Pohlig-Hellman
added 1 character in body
Aug
10
answered Padding size with a CBC Block cipher in TLS
Aug
10
comment Any reason to use Shamir given faster XOR threshold secret sharing algos?
@SEJPM: actually, if you go by 'first invented' and not 'first published' date, RSA still wins; a version of it was discovered by Clifford Cocks in 1973 (which he didn't publish until much later). In any case, as we're talking about public knowledge of a system, the 'first published' date would appear to be what's relevant.