Reputation
36,290
Next tag badge:
99/100 score
20/20 answers
Badges
2 56 151
Newest
 Good Answer
Impact
~631k people reached

10h
comment Is a PRF applied to a secure MAC also a secure MAC?
One needs some condition on the PRF's input and output size; otherwise, a PRF applied to a secure MAC could well be a much less secure MAC than the original MAC is. Even if the PRF's input and output are the MAC's output size, odds of forgery by reusing a former MAC value are slightly better for the resulting MAC than they are for the original MAC.
1d
comment Is 3 rounds more secure than 2 in this simplified DES?
Hint: show that with two rounds, an adversary doing chosen-plaintext queries (that is, obtaining the encryption of any input s/he wills) can find the output of $f$ for any input s/he likes. Combine with the result of I.
1d
awarded  Good Answer
Apr
27
revised Tackling encryption problems with “Zipf's law”?
Polish
Apr
26
revised Key size for HMAC-SHA256
Polish
Apr
26
revised Key size for HMAC-SHA256
mentionb performance for 64-byte key; remove duplicate definition of full-entropy
Apr
26
comment Key size for HMAC-SHA256
@Ralph P: That seems to make sense. The weakest links are likely to be the quality of the password combined with the entropy-stretching of PBKDF2 (which is far from being the best entropy-stretching function around), the ability of the user to recognize where s/he can safely type the password, and the integrity of the device used to process the password; any of these will be incomparably weaker than 256-bit.
Apr
26
revised Key size for HMAC-SHA256
typo
Apr
26
answered Key size for HMAC-SHA256
Apr
26
revised Tackling encryption problems with “Zipf's law”?
Mention ECB
Apr
26
answered Tackling encryption problems with “Zipf's law”?
Apr
25
comment RSA when n= 2360221 and encryption = 5 find decryption key d, when M =1234
If indeed "this was the question asked in exam" and there is no computer allowed in the exam, the right answer is: Finding private exponent $d$ is believed as hard as factorization of $n$, which is non-trivial by hand; C=1637411.
Apr
25
revised Trapdoor and RSA (Schneier)
polish
Apr
22
comment Can multi-prime RSA be used to create an abuse-resistant lawful interception mechanism?
@poncho: yes, using Shamir's secret sharing for the private key suffers form the problem you describe. I do not see that there's a similar issue with the last system that I propose. Sure, the shares could be meaningless, but there's a similar problem in the question's system: the RSA cryptogram could be gibberish, only trying (which requires rebuilding the private key) can tell.
Apr
22
answered Can multi-prime RSA be used to create an abuse-resistant lawful interception mechanism?
Apr
22
comment How secure is this logarithmic encryption algorithm?
@MrCyber: if R had enough decimals, that would markedly improve, but not fully fix, the total insecurity that we have now (the minimum and maximum for R will remain a weakness allowing sizable information about M to leak from x). That would also markedly increase the size of R, which is a serious problem since we need to move Rsecretly to the receiver side.
Apr
22
revised How secure is this logarithmic encryption algorithm?
typo
Apr
22
answered How secure is this logarithmic encryption algorithm?
Apr
22
revised Trapdoor and RSA (Schneier)
Question has changed; fixes and simplifications
Apr
22
revised Trapdoor and RSA (Schneier)
Name the generic exponent k, since that's part of a key