Reputation
Next tag badge:
399/400 score
85/80 answers
Badges
1 31 76
Impact
~522k people reached

45m
comment Hash length extension attack - SHA256 to 512 - impossible, correct?
@MaartenBodewes: yes; different initial values would. In fact, that's precisely the reason why (for example) SHA-256 and SHA-224 use different initial values.
2d
comment Would this method deliver a perfectly non-malleable encryption for at least two blocks?
@StevePeltz: how would you decrypt? In any case, I suspect Anon2000 is looking for a mode that doesn't do any ciphertext expansion
2d
comment Would this method deliver a perfectly non-malleable encryption for at least two blocks?
@Anon2000: how in the world would you be able to decrypt with your suggestion? If the decryptor got a ciphertext $(A,B)$, how does he guess whether to use the normal method, or whether he should use the derived key? As for figuring out the answer, well, that's straightforward; start with a ciphertext with two identical blocks, and step through the decrypt process
May
19
comment Has a collision ever been found for SHA-1/2/3 when truncated to 128 bits?
@Anon2000: nope; remember, the cycle is unlikely to include the beginning value; instead, there'll be a series of unique values, and then you'll hit the cycle. Now, you could arbitrarily zero out the XOR after it's likely you've entered the cycle; that'll allow to do detect the size of the cycle; it's not as clear how you'd find out how you entered the cycle (which is what you're really interested in)
May
19
comment Has a collision ever been found for SHA-1/2/3 when truncated to 128 bits?
@Anon2000: I don't see how you would make it work. When you hit a cycle, the XOR wouldn't zero out (as the values prior to when you hit the loop wouldn't zero out); instead the XOR's would return to values you've previously seen. And, looking for values previously seen is the problem we're trying to solve...
May
19
comment Has a collision ever been found for SHA-1/2/3 when truncated to 128 bits?
@Anon2000: yes, the method that SOJPM suggested is known as rho cycle finding. The approach that I suggested (which is rather different) is more related to the Hellman time-memory tradeoff. I suspect the method I suggested is more practical (for one, it's more parallelizable; rather important if you're contemplating $2^{64}$ computations...)
May
19
comment Has a collision ever been found for SHA-1/2/3 when truncated to 128 bits?
@Anon2000: one obvious way is to do iterated hashing (where we compute $x_i = Hash_{128}(x_{i-1})$, and stop at distinguished points (say, the first 32 bits are all zero), and store the initial/final values in a table. Build up a long list of such table entries (circa $2^{32}$ should do), and look for collisions in the final value -- if we find one, then the two chains merge (and finding where the chains merge is straight-forward). That's not a zero-memory solution, however it gets the memory requirements small enough...
May
19
comment Has a collision ever been found for SHA-1/2/3 when truncated to 128 bits?
Also note that there are ways to search for such a collision that radically reduce the amount of memory required (at not that huge of a computational cost).
May
19
comment Elliptic Curve Cryptography Encrytion and text representation implementation
Is implementing ECIES allowed? That's a way of doing public key encryption with Elliptic Curves that doesn't involve translating the plaintext into a point.
May
19
comment application for cryptography algorithms
Google finds lots of performance comparisons between AES/DES/3DES; what is special about your article? Also, any performance measurement is quite hardware specific; what hardware are you looking to do the comparison on?
May
18
comment What are some hashes that do not exhibit the avalanche effect?
Also, what security properties do you need from the hash? Collision resistance (we can't find two messages that hash to the same value)? Preimage resistance (given a value, we can't find a message that hashes to that value)?
May
18
comment Which of these is a secure MAC?
@user110219: I still don't understand how we are in danger; if the attacker has two message/tag pairs $(M_1, T)$ and $(M_2, T)$, how can they use that to find a tag for a third message?
May
18
comment Which of these is a secure MAC?
@user110219: how would security be compromised? Remember, MACs need not be compromised if you find a 'collision'; that are compromised if the attacker finds a new message/tag pair.
May
17
comment On composition of encryption schemes
Yes, we need to assume that the keys are independent; I'll update my answer accordingly
May
15
comment How do we know one-way functions can be iterated?
How is this a cryptographical question?
May
15
comment How can one improve Rijndael's with more efficient SBoxes?
"A Hamming weight of about the half of the word size". Unless you're going to change how the sbox is used within AES, the sbox needs to be invertable (otherwise, decryption is a bit tricky), and so all 256 outputs (including the ones with hamming weight 0 and 8) must be possible.
May
15
comment How do we guarantee plaintext is coprime in RSA?
And, as fkaiem points out, even if N and P aren't coprime, it turns out RSA works out as well, as $x^{ed} \equiv x \pmod{N}$ for all $x$, including those not relatively prime to N
May
14
comment SHA-512 partial preimage
Write a quick program that selects a preimage, calls OpenSSL to generate the SHA512 hash, then look at the value it generated; if it didn't start with the value you were looking for, try again with a different preimage. You can optionally keep a count of how many iterations you go through before you succeed.
May
14
comment SHA-512 partial preimage
Perhaps OpenSSL...
May
14
comment SAT as a basis for a PKCS - Effective?
In addition, the cryptosystem doesn't work: the system assumes that the operator $X \otimes Y = (XY) Mod(2^p) Div(2^q)$ is associative; that is $(X \otimes Y) \otimes Z = X \otimes (Y \otimes Z)$; this is not true, and so (for example) the holder of the private key may not be able to decrypt.