1,913 reputation
715
bio website
location
age
visits member for 3 years
seen Aug 25 at 20:26

I am a math/computer nerd. Nothing to see here, move along.


May
22
comment Can you determine an unknown value when it is combined with a known value and you are given the resulting hash?
If this is motivated by a homework question asking about the security of H(K|M) as a MAC (for hash function H, key K, and message M), you should consider the possibility that an attacker may not need to learn K in order to produce a forgery. Think about how SHA256 works internally.
May
22
comment Simple way to extend AES to 256-bit block size
possible duplicate of Is it possible to construct a secure block cipher of size $2n$ given a secure block cipher of size $n$?
May
20
awarded  Nice Answer
May
17
reviewed Approve suggested edit on tea tag wiki excerpt
May
16
answered Why do “nothing up my sleeve numbers” have low entropy?
May
15
reviewed Reject suggested edit on Is it possible to construct a secure block cipher of size $2n$ given a secure block cipher of size $n$?
May
15
answered Is it possible to construct a secure block cipher of size $2n$ given a secure block cipher of size $n$?
May
15
revised modulo operations in crypto algorithms
added 137 characters in body
May
15
revised modulo operations in crypto algorithms
Changed mathematical expressions to LaTeX.
May
15
answered modulo operations in crypto algorithms
May
4
revised How do I produce a stream of secure random numbers from AES-Counter mode?
added 96 characters in body; added 8 characters in body
May
4
comment How do I produce a stream of secure random numbers from AES-Counter mode?
Updating the nonce won't let you beat the birthday bound. Additionally, the 2^64 bound is when the provable security of CTR becomes worthless; if you want the security to remain strong (say, by limiting an adversary's advantage to 2^{-40}), then you'd need to stop at 2^{44} bits. Not that this is usually a problem!
May
4
answered How do I produce a stream of secure random numbers from AES-Counter mode?
May
2
reviewed Approve suggested edit on How to argue to a paranoid that RSA is safe?
Apr
18
answered How vulnerable is the C rand() in public cryptography protocols?
Mar
14
comment Is this a pseudo random function (PRF)? F(k,x) = f(k,x) - f(k,x-1)
I think there may be a (minor) error in the reduction to f, which is queried twice as often as F. Set n = 2, and consider the function family index by keys $(a_1, a_2, a_3) \in (\lbrace 0, 1 \rbrace^n)^3$, where $f = f_{(a_1, a_2, a_3)}$ is defined by $f(i) = a_i$ (for i = 1, 2, 3) and $f(4) = a_2 - a_1 + a_3$. Then because - and + are group operators, any three values of f are statistically independent over the choice of key. So f is $(\infty, 3, 0)$-secure PRF. However, for every key, $F(4) = F(2) = a_2 - a_1$. Therefore $F$ is not $(\infty, 2, 0)$ secure.
Mar
11
comment Is this a pseudo random function (PRF)? F(k,x) = f(k,x) - f(k,x-1)
I managed to convince myself late last night that this proof was incorrect, "fixed" it, and then realized today that there's a reason one should never do math while tired. I apologize for the numerous edits. Hopefully everything is fine now. I made one of the arguments more explicit to reduce the probability that I made another mistake.
Mar
11
revised Is this a pseudo random function (PRF)? F(k,x) = f(k,x) - f(k,x-1)
added 328 characters in body, reverted early, incorrect "fix" to the proof
Mar
11
revised Is this a pseudo random function (PRF)? F(k,x) = f(k,x) - f(k,x-1)
added 328 characters in body
Mar
11
revised Is this a pseudo random function (PRF)? F(k,x) = f(k,x) - f(k,x-1)
added 136 characters in body