Reputation
36,230
Next tag badge:
99/100 score
20/20 answers
Badges
2 55 151
Impact
~628k people reached

Apr
14
comment Sending KCV (key check value) with cipher text
@Maarten Bodewes: Granted, one should not trust a key identifier (and my well, some level of certainty was tongue-in-cheek for: less than perfect certainty even when Murphy, famous for his law, is the only adversary). On the other hand, to support key rotation, you do need a key identifier; and then you can do without a KCV.
Apr
14
comment Sending KCV (key check value) with cipher text
Many real systems send a key identifier, which allows selection of the appropriate key with, well, some level of certainty.
Apr
14
comment how to use common modulus attack?
The question assumes that Alice, Bob and Chris are using raw/textbook RSA, rather than RSA with random padding or hybrid encryption, as they should; therefore, Eve can verify a guess of a message sent by Alice to Bob, e.g. tell if it is head or tail; this fails modern security definition. Independently: Chris can factor his modulus, and since that the same as Bob's, Chris can find Bob's private key (or an equivalent), and decipher messages intended to Bob only, another disaster.
Apr
13
comment SHA-1: number of possible inputs, number of possible outputs, how many inputs have the same output,
suggestion: use of double dollar sign, added parenthesis, added spacing$$\sum_{l=0}^{2^{64}-1} 2^l\;=\;2^{(2^{64})} - 1$$
Apr
13
comment Is there an AES identity key?
I do not think that you can rigorously infer "a known property of AES is that modifying the plain text by one bit will affect the ciphertext by more than one bit". This is true for a single round, but I fail to see how that extends to many rounds. In fact, it seems unlikely that this property holds.
Apr
13
comment Are there any hash functions that use integers of arbitrary bit size (e.g., int63)?
Is there really any platform out there with 63-bit integers, and no support for 64-bit unsigned integers (perhaps disguised as 63-bit signed integers) ?
Apr
13
comment Attacks of the MAC construction $\mathcal{H}(m||k)$ for common hashes $\mathcal{H}$?
I conclude there is no known attack better than this generic attack, and accept the answer.
Apr
12
comment What may be causing conflicts in Whirlpool implementation versions?
Are you sure there is no gremlin (like a rogue terminating byte) in the input you feed to OpenSSL and rHash? At least, check if the file size is what it should be. You would not be the first one to be caught by that.
Apr
12
comment Calculate if a digital signature is valid
Breaking the discrete logarithm modulo $N$ of unknown factorization would indeed break RSA; but the RSA problem is of different nature, and we have no proof that it is not easier. In particular, in the discrete logarithm problem, one is not given the equivalent of $e$ in RSA. That knowledge of $e$ makes the RSA problem modulo any known prime trivial, when the discrete logarithm modulo that prime could be hard.
Apr
12
comment Will the contents of a password protected Zip 2.0 file be safe for a week
You removed "Baring hypothesis change or progress in some of the above" before my statement; among the perhaps unfounded hypothesis are: a single file is encrypted, and nothing is known about its content (it is random, most importantly its beginning), and PKZIP 2.04g was used, and no weakness is discovered about its RNG (or appears, e.g. due to running it in some VM context). All in all, I see a problem with direct use of my statement in the context of this question.
Apr
12
comment Secret construction
By an entropy argument, the added requirement "The string $S$ should be smaller in length than all the lengths of $s_i$ combined", together with the initial requirement "we should be able to deconstruct the $S$ back to initial set of $w =\{s_1,s_2,\dots,s_n\}$", implies that at least one of the $s_i$ has entropy lower than its length in bit, or the $s_i$ are not independent.
Apr
11
comment Calculate if a digital signature is valid
The RSA private key operation is not a logarithm; RSA is not: exponentiation is easy but logarithm is hard.
Apr
11
comment Calculate if a digital signature is valid
Fact: $870099^{87953}\bmod1562501$ is easy to compute, and is $161153$; but computing $870099$ from the other three values is harder, and requires factoring $1562501$, or comparable effort [revised].
Apr
11
comment Does the SHA-256 sum of a 256-bit key help you crack it?
The hash of a password (in the sense hash has in the present question) often allows to recover the password! There are rainbow tables for that.
Apr
8
comment How to encrypt an image with logistic chaotic map?
Correction: the drawing is not quite CFB, even if you notice that the top feekback is cancelled: there are 2 bytes of key input from a 256-byte circular buffer at each step. I'm leaning towards unclear and unsafe. @Yuriy N.: you may need to encrypt a color image; but why would you need to use a logistic chaotic map for that purpose? If that's an assignment, can you politely repel the "logistic chaotic map" part of it as unacademic, and replace it by something that is?
Apr
8
comment How to encrypt an image with logistic chaotic map?
@E. Rose: the paper contains: "The proposed (sic) is a simple block cipher with block size of 8-bit and 256-bit secret key". The drawing below that shows something that could be block cipher in CFB mode, and an 8-bit block cipher in CFB mode can't be safe. So the system in the paper is unsafe, OR the paper is unclear (with OR being used in it's inclusive form).
Apr
7
comment Homomorphic Encryption with Addition and Exponentiation
As of practicality of the leading edge two years ago, the introduction of Shai Halevi and Victor Shoup's Bootstrapping for HElib is very telling.
Apr
6
comment Question about "toy: streamcipher
Exactly: the black box represents the Clock (or/and Control) Bit of each LFSR. The complex-looking table just tells that a LFSR remains unclocked if, and only if, its own CB disagrees with both other CBs. The CBs otherwise operate just like any other LFSR bit. The clocking controlled by CBs is A5/1's defining feature.
Apr
6
comment Filling in MD5 input variables
If the input string is long, and the unknown part is near the end, there is an obvious shortcut to brute force, giving an improvement about proportional to (length of the input string in bytes)/64. $\;$ John the Ripper or a small variation might help.
Apr
6
comment Question about "toy: streamcipher
This problem is perfectly understandable as is, without reference. You are not supposed to get internet access on exams. A busy engineer solves many problems a week which solution is nowhere on the internet. That said, this toy stream cipher is A5/1 with shorter LFSRs.