Reputation
26,464
Next tag badge:
411/400 score
78/80 answers
Badges
2 36 109
Newest
 Revival
Impact
~398k people reached

Mar
24
comment Is it true that for RSA with no padding, the length of data must be equal to the length of key?
@user3100783: I only partially agree: even without padding, when enciphering a random bit string of $n-1$ bits, the plaintext can be changed in predictable ways because of unpadded RSA's malleability only in very specific ways, related to the multiplicative properties of RSA; it is not like the adversary can change a bit here or there by messing with the ciphertext. We can build use cases where it is better for the adversary to take advantage of the genuine RSA ciphertext, than it is to craft another one from scratch (with fully chosen plaintext), but they tend to be artificial.
Mar
24
revised Explanations for the complexity values for second preimage attack on GOST?
Answer #3 and #4. Less whitespace. Polish.
Mar
24
comment Is it true that for RSA with no padding, the length of data must be equal to the length of key?
@user3100783: The padding check will fail if the enciphered data has been accidentally modified (with overwhelming odds for RSAES-OAEP, still quite likely for RSAES-PKCS1-v1_5). But that's NOT a security feature! One who wants to alter the enciphered data without being detected can do it trivially (just encipher whatever you want the deciphered thing to be); remember the adversary knows anything public, thus including the public key!
Mar
24
revised Explanations for the complexity values for second preimage attack on GOST?
Answer #2.
Mar
24
comment How secure is the AES master key if Round Keys are found
This looks like homework, that's why I let you find the answer. Hint: Examine how the round keys are computed from the master key. Also, check how hardware implementations find the round keys during decryption. Read the rationale for AES, section 7.5.
Mar
24
comment Generating Random Primes
Here is an approach to select a random prime nearly free of bias. Say that for some $a,b$ with $2≤a≪b$ we want a random prime $p$ with $a≤p<b$. Pick a random $s$ with $0<s<b-a$ until $\gcd(s,b-a)=1$. Pick a random $t$ with $0≤t<b-a$. Use for $p$ the first prime among the $p_i=(i⋅s+t)\bmod(b-a)+a$. Simple variants can be made to select prime $p$ such that $p-1$ has a big known prime factor $s$, or/and such that $p+1$ has another big known prime factor, see e.g. FIPS 186-4 section B.3.6.
Mar
24
comment Entropy when iterating cryptographic hash functions
@StephenTouset: Or, more simply said: truncating the output of a PRF yields a PRF. Notice that as worded now, the question truncates the output of SHA-256, at each use, effectively building a 128-bit hash. Initially, the question truncated the input of SHA-256. There is a simple reduction form the initial question to the current one: first truncation reduces to 128 bit of entropy, then there are a number of 128-bit hashes, then a final SHA-256 that is almost entropy-preserving.
Mar
24
revised Is it true that for RSA with no padding, the length of data must be equal to the length of key?
Try to improve usefullness.
Mar
23
revised Is it true that for RSA with no padding, the length of data must be equal to the length of key?
Emphasize and justify "Do not use RSA with no padding"
Mar
23
revised Is it true that for RSA with no padding, the length of data must be equal to the length of key?
Polish
Mar
23
revised Is it true that for RSA with no padding, the length of data must be equal to the length of key?
edited body
Mar
23
answered Is it true that for RSA with no padding, the length of data must be equal to the length of key?
Mar
21
comment SHA-224 Purpose
@ntkskml: I frown at not vulnerable: the adversary trying an obvious modification of a length extension attack has odds of success $n/2^{32}$ with $n$ attempts.
Mar
21
answered Explanations for the complexity values for second preimage attack on GOST?
Mar
21
revised SHA-224 Purpose
More and better references
Mar
21
revised SHA-224 Purpose
Update to explain 224
Mar
21
revised SHA-224 Purpose
Update to explain 224
Mar
21
comment SHA-224 Purpose
@TruthSerum: No! Half the length of a 3DES key would be 96 or 84 bit, depending on if you count parity or not. It is more like 224 is twice the the base-two logarithm of an estimation of the number of operations in the best known attack for 3DES, assuming unlimited memory.
Mar
21
revised What is difference among eavesdropper attack, multiple message attack and CPA attack?
Fix the game! And manage to make that gender neutral (I don't want to risk prosecution from Eves United)
Mar
21
revised What is difference among eavesdropper attack, multiple message attack and CPA attack?
Polish