Reputation
25,305
Next tag badge:
391/400 score
76/80 answers
Badges
2 32 104
Impact
~371k people reached

May
17
answered Is the HMAC construction really neccessary for a fixed length message?
May
17
comment Is One Time Pad considered Chosen-Plaintext Attack Secure?
@Gordon: Yes, I used cipher where I meant encryption scheme! My mistake! And I'm the one trying to be rigorous, shame on me. That's fixed. $\;$ Now I'm not in a position to object against your definition of OTP, which allows reusing the pad, making it an encryption scheme (that is not secure in any definition of that).
May
17
revised Is One Time Pad considered Chosen-Plaintext Attack Secure?
Oh I meant encrytion scheme and wrote cipher!
May
17
revised Is One Time Pad considered Chosen-Plaintext Attack Secure?
Firmly state the key point in the definition of OTP; expand on what twist are customary to the definition of a cipher.
May
17
comment Is One Time Pad considered Chosen-Plaintext Attack Secure?
@Gordon: I (now) see what you mean. If we consider that the OTP allows key reuse then, yes, it is a cipher (perhaps, by a variation of the above definition where the plaintext size is restricted), but not a secure one under even the weakest definition of security (unknown plaintext with known redundancy). On the other hand, two of out three words in the name One TIme Pad are there to emphasize that the pad/key can not be reused, so this twists the definition of OTP.
May
17
revised Is One Time Pad considered Chosen-Plaintext Attack Secure?
polish
May
17
comment Is One Time Pad considered Chosen-Plaintext Attack Secure?
@fkraiem: even if we restrict the message space of a cipher to $\{0,1\}^{|k|}$, the OTP does not fit that definition of a cipher, because a cipher must allow encryption of multiple messages with the same key, and the OTP does not.
May
17
revised Is One Time Pad considered Chosen-Plaintext Attack Secure?
Expand
May
16
revised Is One Time Pad considered Chosen-Plaintext Attack Secure?
Improve link
May
16
revised Is One Time Pad considered Chosen-Plaintext Attack Secure?
added 273 characters in body
May
16
answered Is One Time Pad considered Chosen-Plaintext Attack Secure?
May
16
comment CCA secure or not?
I do not understand how decryption could be done, or what $\bigoplus0^n$ is supposed to achieve. Is there a typo somewhere?
May
16
reviewed Leave Closed Is Information Loss in Crystalline Cipher a Good Approach to Anti-Cryptanalysis?
May
16
comment SAT as a basis for a PKCS - Effective?
You do not give a proof for this $+10$ patch, and indeed it's leaky: $p=20$, $q=4$, $m=4$, $l=20$, $Z=885730$, $X=6$ ($U=4468$), $Y=11$ ($V=19115$), Bob gets $W=3$, while Alice gets $W=4$.
May
16
comment SAT as a basis for a PKCS - Effective?
Indeed Poncho oversimplified, but the paper's assertion that Alice and Bob compute the same $W$ is wrong. Try it with $p=20$, $q=10$, $m=6$, $l=24$, $Z=10574004$, $X=34$ ($U=881$), $Y=52$ ($V=385$). Bob gets $W=12$, while Alice gets $W=11$. $\;$ Even if this was somewhat fixed, I'm afraid that the scheme can not be used more than very few times with the same $Z$, until an adversary can guess the shared key $W$, which goes against the goal of a key agreement protocol.
May
16
comment Is Information Loss in Crystalline Cipher a Good Approach to Anti-Cryptanalysis?
The usual meaning of "Information Loss" in encryption would be that several distinct plaintexts can lead to the same ciphertext, for identical key and salt, making decryption impossible at least without redundancy in the plaintext. Crytalline Cipher aims at allowing exact decryption for any plaintext, thus must use "Information Loss" differently, but does not give a definition. Hence version 2 of the question (in title and 1) remains unsatisfactory, for reasons other than version 1.
May
16
comment Authenticate a short message with redundant encryption instead of using a MAC?
@user1636512: your feeling is right (the adversary gets twice as much plaintext with the same key); yet modern ciphers like AES are perfectly fit for this.
May
15
comment Authenticate a short message with redundant encryption instead of using a MAC?
If you can spare a single bit out of the plaintext (say, the leftmost of the 128 bits is always 0 in a valid plaintext), you can have authenticated encryption with a single key: make the cryptogram $E_K(plaintext)\|E_K(plaintext+2^{127})$ and make the obvious checks of the 129 constrained bits on the receiver side. If size is an issue, the second block can be truncated.
May
15
comment Meet-in-the-Middle attack on 3DES
(re-revised) In the section on attacking 2-key 3DES: odds of having made a valid guess at step 1, stated at step 4, are $p/{2^m}$. The storage requirement is OK (I had to get at the article to confirm that). $\;$ Minor TeXpo in the section on attacking 3-key 3DES: $2^56$ should be $2^{56}$
May
15
revised Practical Uses for Timing Attacks on Hash Comparisons (e.g. MD5)?
polish