Reputation
25,370
Next tag badge:
391/400 score
76/80 answers
Badges
2 32 104
Impact
~371k people reached

May
16
comment Is Information Loss in Crystalline Cipher a Good Approach to Anti-Cryptanalysis?
The usual meaning of "Information Loss" in encryption would be that several distinct plaintexts can lead to the same ciphertext, for identical key and salt, making decryption impossible at least without redundancy in the plaintext. Crytalline Cipher aims at allowing exact decryption for any plaintext, thus must use "Information Loss" differently, but does not give a definition. Hence version 2 of the question (in title and 1) remains unsatisfactory, for reasons other than version 1.
May
16
comment Authenticate a short message with redundant encryption instead of using a MAC?
@user1636512: your feeling is right (the adversary gets twice as much plaintext with the same key); yet modern ciphers like AES are perfectly fit for this.
May
15
comment Authenticate a short message with redundant encryption instead of using a MAC?
If you can spare a single bit out of the plaintext (say, the leftmost of the 128 bits is always 0 in a valid plaintext), you can have authenticated encryption with a single key: make the cryptogram $E_K(plaintext)\|E_K(plaintext+2^{127})$ and make the obvious checks of the 129 constrained bits on the receiver side. If size is an issue, the second block can be truncated.
May
15
comment Meet-in-the-Middle attack on 3DES
(re-revised) In the section on attacking 2-key 3DES: odds of having made a valid guess at step 1, stated at step 4, are $p/{2^m}$. The storage requirement is OK (I had to get at the article to confirm that). $\;$ Minor TeXpo in the section on attacking 3-key 3DES: $2^56$ should be $2^{56}$
May
14
comment Meet-in-the-Middle attack on 3DES
I'm not seeing that this question is a true duplicate; various other answers do not really describe the basic MitM applied to 3DES. The closest I found is in this question but the table is built my enumerating 2 keys rather than 1, which makes it require a ludicrous amount of memory; hence my answer.
May
14
comment System of linear congruence, not relatively prime
Reference requests are off-topic. Solving straight dump of homework also. I suggest that you at explain (in the question, that you can edit) what you have tried and where where you are stuck in trying to applying my hint.
May
14
comment System of linear congruence, not relatively prime
Hint: use that you know the factorization of all the $m_i$ to write an equivalent system of equations where all the ${m_i}'$ are prime; check if it has solutions; and determine them using the CRT. $\;$ That can be made to work even if you do not known the factorizations of the $m_i$, by using $\gcd$. Complexity is is low, dominated by the final CRT step, I guess.
May
12
comment Is Information Loss in Crystalline Cipher a Good Approach to Anti-Cryptanalysis?
Granted, the bad telltale signs that I point are no proof of insecurity. That's why I did not make an answer, only a comment.
May
12
comment Is Information Loss in Crystalline Cipher a Good Approach to Anti-Cryptanalysis?
We have a policy stating, in Q&A style: " Do we accept questions asking for cryptanalysis of your cipher (hash function, ...) design? No, we do not. " $\;$ Also, the source code has bad telltale signs: no method stated, long key, "demonstration" of security limited to analysis of the statistical characteristics of keystream/cyphertext...
May
10
comment Key Check Value standard pratice for asymetric cryptography?
That indeed matches the question as asked. However there's a significant issue: it's big!
May
7
comment Algorithm for n-of-m keys with partial results
If " nobody is trusted to hold the complete key " in the question rules out that a trusted party (not among those holding a key share) holds the complete key, it's going to be critical to specify what the complete key is supposed to allow.
May
7
comment Information-theoretic bound on leakage by timing measurement
Your answer and comment above seems very close to my goal as set in the second section of the question: we bound the channel capacity in the situation of Q3, disregarding the considerations of Q1 and Q2 (also I realize that a practical adversary can often choose the input to the black box or Smart Card, which is even more handy than having an internal counter in the black box). $\;$ So the only thing left to do is dig the formula for computing the Shannon capacity of the channel in the presence of noise $U$.
May
7
comment Key derivation design to avoid key leaks
When the adversary exercises the extra capability, a chosen input is chosen_seed, a known input is seed, an unknown input is key, but what is the output? If there's none, the extra capability is useless! If that is derived_key_2 (my best idea to make sense of the question), how come " second goal is to get derived_key_2 " ? Or perhaps the adversary observes something through a side channel like timing, power analysis?
May
7
comment Information-theoretic bound on leakage by timing measurement
Ah, did not knew fountain codes, that seems a fine (optimal ?) tool for the hypothetical attacker. Yes I'm hoping that the answer to Q3 (assuming Q2) can come from coding theory (which is off my area of practiced expertise, even though I was in modems in an earlier life).
May
6
comment Information-theoretic bound on leakage by timing measurement
The methods you describe work, with the first matching Q1, and "Another approach.." matching Q2. I'm uncertain this optimal, though: getting all the key fragments (or coupons) is long, and perhaps it is better to build a redundant form of the key, and leak that; sort of forward error correction, where error is missing coupons.
May
6
comment Brute-force attack given small search-space and hash prefix
I'm reading " the attacker only has the first 8 characters of the SHA1 " as meaning the first $8\cdot4=32$ bits of the hash. Thus it is expected about $2^{24}$ candidates.
May
5
comment Special case of format-preserving encryption
This is a form of steganography. It is feasible if we accept that ciphertext is significantly larger than plaintext, for some definition of natural language (especially if that includes modern poetry, or something looking like the output of automatic translation, or/and if we feed the encryption program with natural text that it slightly transforms).
May
5
comment RSA : Is finding Public key given Private key as hard as finding Private key given Public key?
@Myth17: Notice that the other question is not quite the same as your's. $\;$ The answer to your question depends on the form in which the private key is known [ $(n,d)$ versus $(p,q,dp,dp,qInv)$ ]; on the key generation method [ how $e$ was chosen ], and what is meant by "finding Public key" [ if we are content with knowing $e$ within addition of a multiple of $\operatorname{lcm}(p-1,q-1)$ ]. Thus there is no yes-or-no answer.
May
4
comment RFC 5297 implementation
Was re-posted (in slightly better form) in this (off-topic) question.
May
4
comment trying to get calculator and RSA calculatin does not make sense
First part (the only one close to being on-topic) is addressed in Calculating RSA private exponent