poncho
Reputation
48,191
94/100 score
 Aug 18 comment Is calculating HMAC from hashed input a good idea? It comes down to what the question is. Is it "would doing HMAC(K, H(M)) yield any practical attacks", or "might there be academic attacks on HMAC(K, H(M)) that would be easier than HMAC(K, M)?" Aug 18 answered Is calculating HMAC from hashed input a good idea? Aug 17 awarded Nice Answer Aug 15 comment Perfect secrecy with n-time key Actually, in your example, $E(M) = (K_1M + K_0) \bmod p-1$, then either you leak $M_0 - M_1 \bmod 2$, or you can't uniquely decrypt. If $K_1$ is even, you can't uniquely decrypt (because $p-1$ is even). If $K_1$ is odd, then $E(M_0) - E(M_1) \equiv M_0 - M_1 \pmod{2}$ (again, because $p-1$ is even). Try $E(M) = (K_1M + K_0) \bmod p$ instead Aug 14 comment Simple example to describe Bilinear mapping @hanugm: I selected 3 because the order of 3 (mod 11) is 5; that is, $3^5 \bmod 11 = 1$ and $3^x \bmod 11 \ne 1$ for $0 < x < 5$. Any such value with this property will work, and in fact, 5 will (in fact) work. Aug 13 answered Is (AES-)GCM parallelizable? Aug 13 comment How to hash similar strings to the same hash value? And, it's easy to show that the only hash function where $H(s_1) = H(s_2)$ holds consistently is one which is constant (for a specific input length). So, assuming that a constant output isn't the answer you're looking for, how often must $H(s_1) = H(s_2)$ hold? Aug 12 comment Standard format to encode AES cipher and random IV The most common format I've seen is just prepend the IV, that is, store the IV as the first 16 bytes of the ciphertext (and the actual ciphertext as the rest). BTW: AES-256 does not have the same length key as the CBC mode size; instead, it has 32 byte (256 bit key, that's what the -256 in AES-256 means) key, and a 16 byte (128 bit) block size. Aug 12 comment Can one construct OTPs without using XOR? Hint: what does "perfect secrecy" mean? In addition, you need to consider what precisely do you mean by $r \in (0;n)$. Is that equivalent to $0 < r < n$? Aug 12 comment How to generate a large random number from smaller ones? That's too small to be secure; there are known ways to solve the DLog problem practically against a prime that small. Instead, you need a $p$ at least around $2^{1024}$, and nowaways $2^{2048}$ is considered prudent Aug 11 comment How to generate a large random number from smaller ones? Actually, if you're generating a value for DH, there's isn't much point in generating a value from the entire range $[1, p-2]$; you get as much security from a smaller range, perhaps $[1, 2^{256}]$. On the other hand, if you're doing ECDH, you really do want to generate from the entire range $[1, n-1]$ (where $n$ is the point order) Aug 11 revised How to generate a large random number from smaller ones? added 1 character in body Aug 11 comment Simple example to describe Bilinear mapping @hanugm: actually, in my case, $\mathbb{G}_T$ really is the group of quadratic residues modulo 11, and the size of that group is 5. Aug 10 awarded Yearling Aug 10 comment How can I compare two hash algorithms? Can't add much to CodesInChaos's correct comment. However, when it comes to using NP-complete problems in crypto, we try to do it so that breaking it implies that we can solve the hard problem; can you show that in your case - can you show that if you (for example) find a collision, you can quickly solve a hard instance of the NP-complete problem? Aug 10 comment How do we generate AES S-BOX? I voted to reopen, because I don't think it's an exact duplicate. The 'How are the AES S-Boxes calculated' question assumes we understand inversion in $GF(2^8)$ (note, not $GF(2)^8$); this question explicitly assumes the submitter doesn't. Aug 10 comment Factors of the group order to secure against Pohlig-Hellman @RickyDemer: good catch; I was focusing in on what Controlk obviously meant, and forgot to read the actual words he used. Aug 10 revised Factors of the group order to secure against Pohlig-Hellman added 1 character in body Aug 10 answered Padding size with a CBC Block cipher in TLS Aug 10 comment Any reason to use Shamir given faster XOR threshold secret sharing algos? @SEJPM: actually, if you go by 'first invented' and not 'first published' date, RSA still wins; a version of it was discovered by Clifford Cocks in 1973 (which he didn't publish until much later). In any case, as we're talking about public knowledge of a system, the 'first published' date would appear to be what's relevant.