1,863 reputation
615
bio website
location
age
visits member for 2 years, 11 months
seen 2 days ago

I am a math/computer nerd. Nothing to see here, move along.


Feb
11
comment Should tweak be unique per message?
@sashank: Yes, FPE, like full-fisk encryption, is another example of when the tweak is exposed to the programmer (hence "almost" never). I think we might be using slightly differently terminology here, though. When you say IV in the context of "block cipher + IV", do you mean using the tweak as a nonce (i.e., never repeating it)? That is, are you asking if FPE is more secure if you don't repeat tweaks? The answer to that question is: a little. If you repeat a tweak, an attacker can only learn if the corresponding plaintexts are equal. Unique tweaks prevent even this.
Feb
11
comment Should tweak be unique per message?
@RichieFrame Yes, and this was precisely my point: that tweaks belong to tweakable blockciphers and IVs belong to modes of operation. I've edited the part of my answer that talks about OCB to hopefully make this more clear.
Feb
11
revised Should tweak be unique per message?
deleted 139 characters in body
Feb
11
comment Should tweak be unique per message?
It depends on the algorithm. For encryption algorithms, such as OCB, tweak values are usually derived from the IV.
Feb
11
revised Should tweak be unique per message?
added 353 characters in body
Feb
11
answered Should tweak be unique per message?
Jan
27
awarded  Custodian
Jan
27
reviewed Approve suggested edit on How long will my encryption remain private?
Jan
6
awarded  Custodian
Jan
5
revised Deterministically combine more than one source of entropy
added 120 characters in body
Jan
5
answered Deterministically combine more than one source of entropy
Dec
22
awarded  Enlightened
Dec
22
awarded  Nice Answer
Dec
21
reviewed Excellent Why don't we use MACs to store passwords?
Dec
21
reviewed Excellent Are there any differences in operation between existing Diffie-Hellman specifications?
Dec
21
reviewed Excellent Why is sharing the seed and using SecureRandom “deterministically” so bad?
Dec
21
reviewed Satisfactory Why send a challenge with CHAP?
Dec
21
awarded  Custodian
Dec
21
reviewed Satisfactory Serpent cipher : Osvik S-Boxes confusion and test vectors
Dec
15
comment Game traffic encryption AES CTR + HMAC
Regarding GCM-AES tag length, 8 bytes may be enough here. See eprint.iacr.org/2012/438.pdf, theorem 2. Assuming the 70-byte upper limit to plaintext length mentioned by the OP can be assured even against adversarial players, then $\ell_A = 5$. So the probability of a successful forgery after q forgery attempts would be at most ~ 6q/2^{64}. Which is, I think, perfectly reasonable for a game.