Reputation
25,640
Next tag badge:
401/400 score
77/80 answers
Badges
2 33 106
Impact
~376k people reached

Mar
5
comment Prime factors of non-random keys
Recommended reading for this occurring in real life; and these strips to relax.
Mar
5
revised Is Dropbox's hashing method cryptographically secure?
Polish conclusion; tweak case of first preimage for MD5 with long message.
Mar
4
revised Is Dropbox's hashing method cryptographically secure?
We can be near x32 and no more than 4kiB, unless I err
Mar
4
comment Is Dropbox's hashing method cryptographically secure?
@poncho: ah I now see the clever idea; that will make a message of 4 kiB.
Mar
4
revised Is Dropbox's hashing method cryptographically secure?
Better bound thanks to poncho
Mar
4
comment Is Dropbox's hashing method cryptographically secure?
@poncho: I can't find right now how that 33 would hold for any collision attack against MD5 (and I have not considered the internals of the attack). Any hint, or pointer to a general result?
Mar
4
comment In RSA, rationale for prime $p$ with $p-1$ having prime factor $u$ with $u-1$ having large prime factor?
@Brett Hale: I think you mean that ECC has made redundant the requirement to choose primes $p$ such that $(p−1)$ has a large prime factor $u$. The question is about a different second requirement. Also, ECC may not obsolete the first requirement in some cases: more than 2 primes, and enormously many public moduli, with the adversary content factoring a single one.
Mar
4
answered Is Dropbox's hashing method cryptographically secure?
Mar
4
comment Is Dropbox's hashing method cryptographically secure?
@e-suchi: Are you meaning that I interpret " CRC32 and md5 in combination " of the question as concatenation of CRC32 and MD5, when other forms of combination are conceivable?. Even if that was, it would remain that concatenation is a possibility, and leads to a hash that is significantly stronger than CRC32 (with the exception of the first preimage problem when hashing less than about 8 bytes). Thus, in the answer, " using a combination of CRC32 and MD5 could theoretically only be as strong as it's weakest part and that weakest part would be CRC32 " is wrong.
Mar
4
revised NTRU crypto from unseen.is; myth busting help
add reference to Falsifiable
Mar
4
awarded  Nice Answer
Mar
4
comment Is Dropbox's hashing method cryptographically secure?
@e-suhi: You give a single link stating that " you can download any file from Dropbox's servers if you know its Dropbox hash, which apparently is a sequence of SHA256 hashes of 4MB blocks "; but you mention rumors (plural) that confirm something similar. Can you point to the original statement, other substantiated rumor(s), or anything that substantiates such claim?
Mar
4
comment Is Dropbox's hashing method cryptographically secure?
I disagree with " using a combination of CRC32 and MD5 will only be as strong as it's weakest part ". Change MD5 to SHA-512 in this statement and now, just because you can break CRC32, you can break CRC32||SHA-512 ? That's not correct. It remains that the collision-resistance of CRC32||MD5 is only marginally better than that of MD5; which is, bad.
Mar
4
comment Is Dropbox's hashing method cryptographically secure?
Are you sure what's done amounts to a 160-bit hash that is the concatenation of (32-bit) CRC32 and (128-bit) MD5? Any pointer or evidence? Also, do you know (or have information that could help to determine) if, in the use made of that, the required property is collision resistance, or preimage resistance? That's of paramount importance, for MD5 is not cryptographically secure w.r.t. collision resistance, but largely remains so w.r.t. preimage resistance.
Mar
4
revised NTRU crypto from unseen.is; myth busting help
Expand last paragraph
Mar
4
revised Is it meaningful to consider the leakage of master key of KGC?
Link to Ricky Demer's greatly enhanced answer. Add an hypothesis to my statement.
Mar
3
revised Is it meaningful to consider the leakage of master key of KGC?
Add missing word
Mar
3
revised Is it meaningful to consider the leakage of master key of KGC?
Clarify I'm incompetent in IBKE. Make reference to scheme outlined by Ricky Demer.
Mar
3
comment Example of second preimage attack
What's wrong with "toggle the $i+1$-th bit in the fifth word" in my comment, or $m_4\gets m_4\oplus\text{0x400000}$ in the paper's 4.4, which is how $M'$ is obtained from $M$?
Mar
3
comment NTRU crypto from unseen.is; myth busting help
@Stephen Touset: I can't point any publication about a symmetric cipher with 4096-bit key. However for many ciphers (AES, DES..) it is standard practice to consider separately key expansion (generating subkeys independent of plaintext); and the rest, which is in some attacks modeled as a random key as wide as the subkeys are. So arguably, that variant of AES-256 (with 1920-bit key) is somewhat studied. yAES defined as AES with 31 rounds and no key expansion would be a 4096-bit cipher, at least as strong in a random-key setup as AES-256 is (but horribly vulnerable to related-key attacks).