Reputation
26,464
Next tag badge:
411/400 score
78/80 answers
Badges
2 36 109
Newest
 Revival
Impact
~397k people reached

Jun
15
answered Trial divisions before Miller-Rabin checks?
Jun
14
comment RSA decrypting of a huge file by parts
If the data is really already encrypted, give us the encryption format used; "RSA" just does not cut it. Else, change the question on the tune of "what would be an appropriate RSA-based file encryption format given that I want to..". In any case, please tell us your security goals; in particular, if it is an issue that an adversary can guess something about the relation between old and new data (including but not limited to: what changed?) [reposted with fix]
Jun
12
comment Compact digital signature for noisy data
@jbms: Yes, that works (provided the ECC scheme adds extra information to the original message, as does Reed-Solomon). The ECC is used in an unusual setup where the added ECC info is never damaged, but that's a minor loss of bandwidth. However the ECCs I know are intended to correct individual bit errors, and would work quite poorly (take a lot of space) for the $M$ consisting of symbols each $b$-bit, because a minor error on one symbol affects many bits, perhaps all (e.g. 127->128 changes 8 bits).
Jun
12
comment Compact digital signature for noisy data
@Ricky Demer: I now understand; thank you! Yes, noisetolerantsignature(M) = sketch's_helper_data(M) || standardsignature(M) works, including with the sketch an ECC (as suggested by @jbms) consisting of an appendix (e.g. Reed-Salomon), if that has error-correction capacity matching $β$. The recovery procedure computes the alleged $M$ from the noisy $X$ and helper data, checks standardsignature(M), and checks $Δ(M,X)\leβ$ where $X$ is the noisy message. We get property 1 regardless of $α$. Optionally we can sign the helper data, or/and the verifier can recompute and check it.
Jun
11
revised Compact digital signature for noisy data
Fix a formula
Jun
11
asked Compact digital signature for noisy data
Jun
11
comment Given $n$ bits, how many “truly random” sequences/numbers can be constructed?
What matters to entropy is what the sequence could be, not what it happens to be.
Jun
11
comment Attack on a key-exchange,symmetric-key cryptography protocol
@user3283751: Other that the difficult article I quoted, no I do not have a formal definition of DY. But intuitively: without a common time reference, the best a secure protocol authenticating Bob to Alice can do, is ensure that Bob was part of the protocol at a moment in time later that the first message Alice sends in the normal protocol. A replay of an earlier session to Alice that works using past involvement from Bob would break that. But e) is NOT among that because Bob is actively involved at step 2' of attack, AND that's after Alice started the protocol form her standpoint at step 1.
Jun
9
revised Attack on a key-exchange,symmetric-key cryptography protocol
Polish
Jun
9
revised Time Capsule cryptography?
Given a clear NO
Jun
9
revised Attack on a key-exchange,symmetric-key cryptography protocol
added 5 characters in body
Jun
9
revised Attack on a key-exchange,symmetric-key cryptography protocol
Add summary and prepare for undelete
Jun
9
revised Attack on a key-exchange,symmetric-key cryptography protocol
Add summary and prepare for undelete
Jun
9
revised Attack on a key-exchange,symmetric-key cryptography protocol
Add summary and prepare for undelete
Jun
9
revised Attack on a key-exchange,symmetric-key cryptography protocol
Prepare for undelete
Jun
9
comment Attack on a key-exchange,symmetric-key cryptography protocol
@user3283751: in e), the adversary is relaying unmodified messages to intended recipients, and impersonates as Bob to Alice by making Bob part of the protocol; this is NOT an attack in the Dolev-Yao model, and is unavoidable with common networks like Internet. In Ricky Demer's reflexion-to-different-instance attack, Bob is impersonated though not involved, therefore this is a valid attack in the Dolev-Yao model. This is avoidable assuming $E$ is not malleable [for example, by using a different $K_{BA}$ when Bob initiates the connection, or including identity aside $nounce$ in steps 2/3].
Jun
9
revised Attack on a key-exchange,symmetric-key cryptography protocol
Prepare for undelete
Jun
9
revised Attack on a key-exchange,symmetric-key cryptography protocol
Prepare for undeletion
Jun
9
revised Attack on a key-exchange,symmetric-key cryptography protocol
Prepare for undeletion
Jun
9
revised Attack on a key-exchange,symmetric-key cryptography protocol
Prepare for undeletion