Seth

730 reputation

bio	website
	location
	age
visits	member for	1 year, 9 months
	seen	May 16 at 23:33
stats	profile views	10

I am a math/computer nerd. Nothing to see here, move along.

	730 reputation	bio	website		visits	member for	1 year, 9 months
15 badges		location			seen	May 16 at 23:33

summary answers questions tags badges favorites bounties reputation activity

51 Actions

suggestions reviews revisions comments badges posts accepts all

Jan 10	comment	Is it possible to break a hash-based block cipher? It might be worth noting that SHA-2, for example, does not become a pseudorandom function when keyed in this way; length-extension attacks may not be applicable in this particular context, but you'd still be making non-standard assumptions about $H$.
Dec 9	comment	Why is OCB-AES mode not becoming a standard for authenticated encryption? OCB does allow additional authenticated data (which the author calls "associated data"); see this description of the algorithm. While including associated data would take about the same amount of time as simply including it (redundantly) in the plaintext, you do save something in terms of bandwidth/storage.
Dec 8	revised	Information leakage in real-time voice encryption typo
Dec 8	revised	Information leakage in real-time voice encryption deleted 81 characters in body
Dec 8	answered	Information leakage in real-time voice encryption
Dec 5	revised	Compare Blockmode CBC (with diffuser) against XTS added 6 characters in body
Dec 5	answered	Compare Blockmode CBC (with diffuser) against XTS
Dec 1	revised	Security implications of using constant string to verify AES key? Added summary.
Dec 1	answered	Security implications of using constant string to verify AES key?
Nov 5	comment	Is tokenization really alternative to encryption? @PaŭloEbermann: I see where you're coming from, but I'm not sure "Should one encrypt or use some replacement?" is a fair summary of the question. Would you be willing to consider reopening if the title was more in line with the questions in the body? (E.g., "Has tokenization received any formal analysis in cryptographic literature?")
Oct 31	revised	Why is a non fixed-length encryption scheme worse than a fixed-length one? added 56 characters in body
Oct 24	awarded	Commentator
Oct 24	comment	Why is a non fixed-length encryption scheme worse than a fixed-length one? @AlanBletchley: In most practical schemes, the length of the ciphertext depends deterministically on the length of the plaintext, and there will exist at least two plaintexts that, with probability 1, map to ciphertexts with different lengths. You can certainly find counterexamples (Alexandre gives one based on padding). But defining the security of an algorithm in a way that prevents length information from leaking excludes many useful, otherwise secure algorithms. The security definition in your question is useful and "good enough" for most contexts.
Oct 24	answered	Why is a non fixed-length encryption scheme worse than a fixed-length one?
Sep 9	comment	Is it safe to use file's hash as IV? As a side note, if you store the HMAC-derived IV and use it as an authentication token, you do in fact have a provably secure deterministic authentaction scheme (DAE): SIV. (See the DAE paper by Rogaway and Shrimpton.) Of course, barring restrictions like the ones Thomas mentions, a standard (non-deterministic) AE scheme would be better.
Aug 15	awarded	Yearling
Aug 10	comment	Why can't the IV be predictable when its said it doesn't need to be a secret? @StephenHarris It's actually worse than that. If $M$ message are sent, each at most $L$ blocks long (1 block = 16 bytes for AES), then the birthday paradox (en.wikipedia.org/wiki/Birthday_problem) implies counter "collisions" will occur with probability approximately $(ML)^2/2^{128}$ (this is an upper bound). But this still means that after billions (say, $2^{38}$) of 16 MB messages, the probability of a a collision is less than 1-in-1-trillion. This is a comfortable safety margin, and nonce-based CTR outputs become distinguishable from random bits in "birthday time" anyway.
Aug 10	answered	Why can't the IV be predictable when its said it doesn't need to be a secret?
Aug 10	comment	Do MD5's weaknesses affect Oplop? Perhaps another question you might want to ask is, "Is there good reason to believe that MD5 has properties that would allow one to PROVE Oplop is secure?". The relevant definition of "secure" here should probably be unforgeability (i.e., is it a secure MAC?). Personally, I'd feel more comfortable with a scheme based on HMAC-MD5 or HMAC-SHA256...
May 6	comment	Order of hashing concatenation Given Hash(X + "blue"), it might be easy to compute Hash(X + "blue pink") using a length-extension attack (assuming an iterated hash function, such as MD5, SHA-1, or SHA-2). As CodeInChaos mentioned, you probably want to use a message authentication code, such as HMAC, rather than a hash function.