fgrieu
Reputation
36,290
99/100 score
 10h comment Is a PRF applied to a secure MAC also a secure MAC? One needs some condition on the PRF's input and output size; otherwise, a PRF applied to a secure MAC could well be a much less secure MAC than the original MAC is. Even if the PRF's input and output are the MAC's output size, odds of forgery by reusing a former MAC value are slightly better for the resulting MAC than they are for the original MAC. 1d comment Is 3 rounds more secure than 2 in this simplified DES? Hint: show that with two rounds, an adversary doing chosen-plaintext queries (that is, obtaining the encryption of any input s/he wills) can find the output of $f$ for any input s/he likes. Combine with the result of I. 1d awarded Good Answer Apr 27 revised Tackling encryption problems with “Zipf's law”? Polish Apr 26 revised Key size for HMAC-SHA256 Polish Apr 26 revised Key size for HMAC-SHA256 mentionb performance for 64-byte key; remove duplicate definition of full-entropy Apr 26 comment Key size for HMAC-SHA256 @Ralph P: That seems to make sense. The weakest links are likely to be the quality of the password combined with the entropy-stretching of PBKDF2 (which is far from being the best entropy-stretching function around), the ability of the user to recognize where s/he can safely type the password, and the integrity of the device used to process the password; any of these will be incomparably weaker than 256-bit. Apr 26 revised Key size for HMAC-SHA256 typo Apr 26 answered Key size for HMAC-SHA256 Apr 26 revised Tackling encryption problems with “Zipf's law”? Mention ECB Apr 26 answered Tackling encryption problems with “Zipf's law”? Apr 25 comment RSA when n= 2360221 and encryption = 5 find decryption key d, when M =1234 If indeed "this was the question asked in exam" and there is no computer allowed in the exam, the right answer is: Finding private exponent $d$ is believed as hard as factorization of $n$, which is non-trivial by hand; C=1637411. Apr 25 revised Trapdoor and RSA (Schneier) polish Apr 22 comment Can multi-prime RSA be used to create an abuse-resistant lawful interception mechanism? @poncho: yes, using Shamir's secret sharing for the private key suffers form the problem you describe. I do not see that there's a similar issue with the last system that I propose. Sure, the shares could be meaningless, but there's a similar problem in the question's system: the RSA cryptogram could be gibberish, only trying (which requires rebuilding the private key) can tell. Apr 22 answered Can multi-prime RSA be used to create an abuse-resistant lawful interception mechanism? Apr 22 comment How secure is this logarithmic encryption algorithm? @MrCyber: if R had enough decimals, that would markedly improve, but not fully fix, the total insecurity that we have now (the minimum and maximum for R will remain a weakness allowing sizable information about M to leak from x). That would also markedly increase the size of R, which is a serious problem since we need to move Rsecretly to the receiver side. Apr 22 revised How secure is this logarithmic encryption algorithm? typo Apr 22 answered How secure is this logarithmic encryption algorithm? Apr 22 revised Trapdoor and RSA (Schneier) Question has changed; fixes and simplifications Apr 22 revised Trapdoor and RSA (Schneier) Name the generic exponent k, since that's part of a key