CppLearner
Reputation
Top tag
Next privilege 250 Rep.
 Sep14 comment RSA-KEM construction So C1 is just AES(message)? So when does the KDF come in? From what I understand, the whole point of KEM is an alternative to padding RSA_E_pk(m). When you say ordered pair, what is its actual appearance? If C1 is 1 and C2 is 2, send 12? Sep14 asked RSA-KEM construction Feb23 awarded Scholar Feb23 accepted Why is h(m||k) insecure? Oct28 comment Why does Merkle's Puzzle requires Eve quadratic complexity of effort to break the system? Thanks. I will read that paper later this week. I am not convinced. Each message corresponds to a different x. x is just an index for looking up the secret key for Bob to reply back to Alice. So if x is known to Eve, that is, Eve knows exactly which one to try, then she just needs to brute force the initial message x. In other words, if Bob sends [1,2,3] and Alice brute forced 2 and sends (2, message) to bob, then Eve just brute force 2 like Alice does and that's only 2^20 bits of secret keys trial (because different key produce different ciphertext). Oct28 comment Why does Merkle's Puzzle requires Eve quadratic complexity of effort to break the system? Thanks. If x is encrypted in Alice's response, how is Bob able to tell which x in constant time? Now that I think about it, Bob might only need to do n encryption to find out which x. In other words, since Bob has a table with x and key as columns, he can do 2^20 encryptions to find out. So this is the difference and my assumption that Bob does only O(1) is wrong right? Otherwise, Eve can do O(1) as well. Am I correct? Does x really have to be encrypted in Alice's response? Oct27 asked Why does Merkle's Puzzle requires Eve quadratic complexity of effort to break the system? Aug19 awarded Autobiographer Dec17 comment Why is h(m||k) insecure? OKay. I read it again. Basically, if the assumption that the hash function is not crypto-safe anymore, then we will see collision at some point. But what about H(K||X). If we use MD5, we not only experience length extension attack, but also collision attack, right? Dec17 awarded Student Dec17 asked Why is h(m||k) insecure? Dec17 awarded Supporter