Reputation
39,865
Next tag badge:
398/400 score
83/80 answers
Badges
1 40 88
Newest
 Nice Answer
Impact
~594k people reached

Aug
9
revised Any reason to use Shamir given faster XOR threshold secret sharing algos?
edited body
Aug
9
answered Any reason to use Shamir given faster XOR threshold secret sharing algos?
Aug
8
comment Attacking RSA signature verification that ignores padding
@RickyDemer: he said it was the standard PKCS 1.5 padding, and so that'd be bigendian
Aug
7
comment Any reason to use Shamir given faster XOR threshold secret sharing algos?
As for your question being in the context of wanting informational theoretic security; the point I was making is the practical reason why people would not directly secure share a 1Mbyte secret. In most practical cases, we don't actually demand informational theoretic security; we'll be happy with computational complexity security if it's cheaper, and if share size is important (and the shared secret is large), it very well may be.
Aug
7
comment Any reason to use Shamir given faster XOR threshold secret sharing algos?
As for generating the shares, well, assuming that the dealer has the original file, and the $k-1$ random file-sized values on hand (and for informational theoretic security, you need that much randomness), generating the share for a particular id is the same; compute the coefficients $c_i$ based on the id (in this case, $c_i = id^{i-1}$, and compute $c_1f_1 + c_2f+2 + ... + c_kf_k$ (and in this case, $f_1$ is the original file, and $f_2$ through $f_k$ are the random ones).
Aug
7
comment Any reason to use Shamir given faster XOR threshold secret sharing algos?
I would dispute that Shamir's method is "slow to compute"; given $k$ large files (each containing a set of shares for one particular id), the combination process is 'compute the coefficients $c_i$ based on the id's' (which you need to do once), and then 'for each position in the files, compute $c_1f_1 + c_2f_2 + ... + c_kf_k$. You might be able to faster than that, but not by a factor of hundreds. We typically don't do this, but mostly because there's no particular reason, if we're sharing a 1MByte file, to make each share 1 MByte big.
Aug
7
comment Are deployed MACs IND-CPA?
For GCM, you can show independence of the GHASH output from the block cipher output (at least for 96 bit nonces), as the block cipher output is from a plaintext that is distinct from any out the block cipher outputs used to generate the GHASH; hence if the block cipher is a PRP, and we haven't seen enough outputs to distinguish the PRP from a PRF, we're golden. For non-96 bit nonces, it's a bit more subtle.
Aug
6
comment How can recovered 5-letters plain text help me to recover reused OTP key
Sorry; I meant C3
Aug
6
comment How can recovered 5-letters plain text help me to recover reused OTP key
Use C3 to check. There are two possibilities; one in which P1 has " the ", and one in which P2 has " the "; by checking both against C3, the correct one should be obvious.
Aug
6
answered Formula for the number of expected collisions
Aug
6
reviewed No Action Needed Public key of a split key without calculating private key
Aug
6
reviewed Reviewed Signatures with Hybrid Encryption
Aug
6
comment How to encrypt dates using format preserving encryption and avoid collisions
@erotavlas: actually, there's no need to change the key for every date; that's what the tweak is for.
Aug
6
comment How to encrypt dates using format preserving encryption and avoid collisions
And, it doesn't leak if two encrypted dates are from the same year; if the attacker sees 'Jan 23, 1932' and 'November 19, 1932', with your encoding, they don't know the year, but they can deduce both were from the same one.
Aug
6
answered How to encrypt dates using format preserving encryption and avoid collisions
Aug
6
answered Simple example to describe Bilinear mapping
Aug
6
awarded  Enlightened
Aug
6
awarded  Nice Answer
Aug
5
comment Is the encryption of a hash a good MAC?
@cooky451: why would it fail? What if the attacker intercepted the original $(M, Mac)$, so the receiver never got it, and replaced it with $(M', Mac')$?
Aug
4
awarded  Excavator