Reputation
2,673
Top tag
Next privilege 3,000 Rep.
Cast close & reopen votes
Badges
10 26
Newest
 Quorum
Impact
~41k people reached

Apr
19
answered Generating random non-repeating numbers from a small group
Apr
17
comment Compare Blockmode CBC (with diffuser) against XTS
@Yura That will depend on how AES is used (XTS for example, usually is built on top of AES). If you use CTR-AES mode twice, the result doesn't become less malleable (flipping a bit in the ciphertext still flips the corresponding bit in the plaintext). If you use CBC-AES mode twice, you can still do the same attack I mentioned in my answer, but the length of the uncontrolled random "garbage" section will double. Finally, using AES in a secure "wideblock" mode would be roughly as fast as either of these solutions, anyway. So might as well do that, instead.
Mar
22
comment What is the benefit of artificially padding messages?
Where did you hear this? In some cases there may be a minor benefit to hiding some information about a message's length, you may be misinterpreting what you've read: If you want to allow messages that aren't a multiple of the block size, then padding is required even for a message that is a multiple of the block size. Otherwise, how can you tell a padded message apart from a plaintext that happens to end in a sequence of bytes that is also valid padding?
Feb
9
revised What is the difference between MAC and HMAC?
Clarified that HMAC is not an algorithm by itself, but a way to turn hash functions into MACs
Jan
11
answered To understand a fact related to padding in MD5
Nov
6
awarded  Quorum
Oct
15
comment Values of p and q when e = 3 (RSA)?
Do you need to know how to find large primes, or just how to find large primes with that property?
Sep
29
comment How can a Encrypt-And-MAC scheme be insecure if the encryption is CCA secure?
Is this homework? Some things to consider: What happens if a message is repeated? Can you construct a MAC that is unforgeable under a chosen message attack, but that leaks information about the input?
Aug
15
awarded  Yearling
Jul
28
awarded  Revival
Jun
21
comment Turning a 64 bit block cipher into a 128 bit block cipher
Almost. It's a Feistel network, except that you encrypt the left half with the right half as the tweak, instead of using a PRF-then-XOR approach. See the left side of Figure 5 of the linked PDF (pg 11). You'll only get a q^2/2^64 security bound, though. (If you were to start with a TBC that had beyond-birthday-bound security, you could instead use a three-round Feistel construction to avoid this problem. But this would probably be far too slow).
Jun
19
comment Turning a 64 bit block cipher into a 128 bit block cipher
The same paper shows that you can construct a 2n-bit TBC out of an n-bit TBC using two rounds, which might be the answer @Maarten_Bodewes is looking for (since a TBC can be used as a traidtional blockcipher). So that works out to be two blockcipher calls plus two 64-bit finite field operations (assuming LRW) or four blockcipher calls (assuming XEX).
Jun
11
revised How is an epsilon of 1/1000 non-negligible?
added 343 characters in body
Jun
11
revised How is an epsilon of 1/1000 non-negligible?
added 343 characters in body
Jun
11
revised How is an epsilon of 1/1000 non-negligible?
added 1 character in body
Jun
11
revised How is an epsilon of 1/1000 non-negligible?
added 1 character in body
Jun
11
answered How is an epsilon of 1/1000 non-negligible?
May
31
reviewed Leave Open Operation modes of block ciphers how are used?
May
27
reviewed Close Why is public key cryptography not widely used in governments?
May
27
reviewed Reviewed Is HMAC-MD5 still secure for commitment or other common uses?