Reputation
2,905
Top tag
Next privilege 3,000 Rep.
Cast close & reopen votes
Badges
7 18
Newest
 Yearling
Impact
~60k people reached

Apr
20
accepted State of the art low memory arbitrary-domain PRP?
Apr
18
comment State of the art low memory arbitrary-domain PRP?
@RickyDemer I think I misunderstood sometimes-recurse shuffle then. Either way, feel free to post your thoughts as an answer :)
Apr
18
comment State of the art low memory arbitrary-domain PRP?
@RickyDemer I am interested in your claimed algorithm that has a fixed security level of $2^{128}$ (AKA $b = 128$) which gives a PRP on an arbitrary domain of size $n$ (where $n \geq 35$) in $O(1)$ memory.
Apr
18
comment State of the art low memory arbitrary-domain PRP?
@RickyDemer I don't fully understand your question. $b$ is not really relevant to the question, and you can assume it's some fixed value, e.g. 128 or 256. Unless my math fails me the number of possible permutations of $n$ elements is $n!$, and $35! > 2^{128}$, so a too small domain will only be an issue in the smallest possible cases.
Apr
18
comment State of the art low memory arbitrary-domain PRP?
@RickyDemer The security level is distinct from the block (domain) size. E.g. AES has a block size of 128, but provided security levels of 128, 192 and 256 bits (although the latter two have later found attacks reducing their security, this is besides the point).
Apr
18
comment State of the art low memory arbitrary-domain PRP?
@RickyDemer As an example, the core function used in Blake2 is a PRP on domain $\{0, 1\}^{512} $ that uses $2 \cdot 512$ bits of memory.
Apr
18
comment State of the art low memory arbitrary-domain PRP?
@fgrieu Added the tag.
Apr
18
revised State of the art low memory arbitrary-domain PRP?
edited tags
Apr
18
asked State of the art low memory arbitrary-domain PRP?
Jan
24
comment Is there any more information on this RSA backdoor?
While this is certainly a smart alternative scheme, I do not believe this answers the question. It does not shed additional light on the scheme mentioned above.
Jan
24
comment Is there any more information on this RSA backdoor?
@fgrieu There are two different keyspaces here. One assuming an agent with knowledge of $A$, and one without that knowledge. Presumably, if you know $A$ the key space is $256$ bits.
Jan
24
comment Is there any more information on this RSA backdoor?
I would suggest using two different symbols for the two $k$s, as they do not refer to the same value.
Jan
7
awarded  Yearling
Jun
23
awarded  Caucus
Jun
23
awarded  Constituent
May
11
awarded  Popular Question
May
10
revised Reciprocal block ciphers
added 21 characters in body
May
10
comment Reciprocal block ciphers
@Melab That's just silly. You can make it swap the halves after the last round without any loss to security - any attacker can trivially swap halves of the ciphertext as they please.
May
10
answered Reciprocal block ciphers
May
10
comment Reciprocal block ciphers
When you say reciprocal block cipher, do you mean that $Dk$ and $Ek$ are the same function?