31,167 reputation
12464
bio website
location
age
visits member for 3 years, 2 months
seen 11 mins ago

Mar
9
answered Is $H(x) = x^2 \bmod p$ pre-image resistant, second pre-image resistant and/or collision resistant
Mar
8
answered Attack of an RSA signature scheme using PKCS#1 v1.5 encryption padding
Mar
7
answered SHA-256 Partial Collision of initial 36 bits and more
Mar
7
comment Adding “salt” to “doHash” function in Java
Is this homework? If it is, you might want to recheck the requirements; true "pre-image resistance" (in the cryptographical sense) is actually fairly difficult (and unless you copy a primitive designed by someone else, it is seriously more advanced than where you are right now). And, no, salt does not particularly help with preimage resistance.
Mar
7
answered Is this a pseudo random function (PRF)? F(k,x) = f(k,x) - f(k,x-1)
Mar
7
reviewed Approve suggested edit on What is the difference between PKCS#5 padding and PKCS#7 padding
Mar
5
revised SHA-256 Wrong registers
added 27 characters in body
Mar
5
answered SHA-256 Wrong registers
Mar
5
comment What key exchange protocols give Forward-Secrecy resisting future progress?
@user54609: no, it doesn't, or rather, it doesn't in the specific scenario that fgrieu is talking about: what if someone later obtains the ability to solve the asymmetric problem (which is, in this case, the DH problem). This question came up during a discussion of "what happens if the adversary gets a Quantum computer; can they go back and decrypt old transcripts of encrypted traffic"
Mar
5
comment Long-term data protection, storage of old encrypted traffic and quantum cryptocalipse
One minor nit: the standard implementation of forward secrecy within protocols (DHE in TLS, PFS in IPSec) doesn't help against a future adversary with a working quantuum computer. Where protocols achieve forward secrecy by performing a DH exchange (using fresh random secrets); this gives us PFS against someone who learns the long term keys... as long as the DH problem is hard. With a Quantum Computer, the cDH problem is easy, hence we're not actually secure against such a future potential adversary.
Mar
5
revised Fast modular reduction
Made it a bit more explicit
Mar
5
answered Fast modular reduction
Mar
4
comment Is Dropbox's hashing method cryptographically secure?
Two hints (if you want any more, submit a question): you can create a $2^{33}$-way collision with the effort of finding 33 MD5 collisions, and you can use the linearity properties of CRC so you don't have to evaluate the CRC's of all $2^{33}$ messages.
Mar
4
comment Is Dropbox's hashing method cryptographically secure?
Actually, you can find a collision for $CRC32(M)||MD5(M)$ with effort of only 33 times an $MD5$ collision, or about $2^{23}$ compression function evaluations.
Mar
3
comment What RC4 key value will completely invert $S$ after initial permutation?
In case you're wondering why no one is stepping up to give you the answer, well, the whole point of homework is for you to learn. If someone would just give you the answer, well, that might mean that you can hand in your homework, but you won't learn from it.
Mar
2
answered Check the validity of a rsa key pair with only the public key?
Mar
1
comment Determine the iteration times using Pollard's rho Method for factoring
Brock is correct; you can give a plausibility argument that it should usually take around $O(\sqrt{p})$ iterations (where $p$ is the smaller prime factor), but it looks unlikely you'll be able to say something like "this will take precisely 165 iterations" without actually running it.
Feb
28
comment Find out which keying option is being used in Triple DES?
@fgrieu: I don't immediately see how knowledge of (even) the entire cycle structure would give you a hint about which keying option was used. For example, if $A$, $B$, $C$ are random even permutations, then both $AB^{-1}C$ and $AB^{-1}A$ are also random even permutations; hence you would need to make some assumptions about what permutations DES may generate beyond 'it's always an even permutation'
Feb
27
answered Does it make sense to have a 4000 bit long key?
Feb
25
comment Detecting steganography in the stream of short messages
@Moonwalker: that question is both broad and tough; there's no really good way, even if you had access to the RNG design, which you don't. About the best you can do against an unknown generator is run a bunch of statistical tests on the output, and see if you see something unexpected.