Reputation
Next tag badge:
106/100 score
19/20 answers
Badges
2 32 102
Newest
 Nice Answer
Impact
~350k people reached

Apr
12
comment AES-XTS: find key from ciphertext and plaintext
All known ways to obtain the key require more input; like, the power consumption over time of the device that performed the computation.
Apr
11
comment OTP - Reusing key IS SECURE! PROVED!
By XORing the 4 formulas, it comes that independent of keys and IVs, $character_4=$ $character_1⊕character_2⊕character_3⊕cipher_1⊕cipher_2⊕cipher_3⊕cipher_4$.
Apr
11
comment OTP - Reusing key IS SECURE! PROVED!
This "proof" is not even wrong. Also, even if "IVs" are secret, character 4 is trivialy found from ciphertexts and the other three characters.
Apr
11
comment OTP - Reusing key IS SECURE! PROVED!
In standard terminology, Initialization Vectors are public (if they are not, they are keys). This makes the scheme trivially weak: character 3 (resp.4) can be found from knowns and character 1 (resp.2)
Apr
10
comment How cryptographically secure was the original WW2 Enigma machine, from a modern viewpoint?
Much of the answer will depend on what qualifies as "operator mistakes" and to what degree they are known; what "the original Enigma machine" is assumed to be (there was several variants, even the number of rotors was variable); and if the wiring of rotor (and plugboard, if any) is assumed known or not.
Apr
9
comment algebraic attacks for mixed operations (mod 2 and mod 256)
Anything wrong with the trivial: if $\oplus$ is addition modulo $2$ and $\widetilde+$ is addition modulo $2^8$, then for all integers $a$ and $b$, $a\oplus b=((a\widetilde+b)\bmod 2)$? Or perhaps you have a definition of $\oplus$ which is bitwise XOR, not "addition mod $2$" as stated in the question ?
Apr
8
comment Creating a random password based off of a prime number
You depend heavily on the quality of the initialization of Random(), which itself depends on the particular version of Java, and on the platform. Thus the answer is context-dependent (and largely off-topic).
Apr
8
comment How does the certificate authority generate a signature F?
Question and tentative answer are broken to the point that IMHO they are best abandoned. Some issues: 1) The question is about certificates, which require a signature scheme, which is not achievable by encryption of a hash. $\;$ 2) The two basic steps of proving identity are not distinguished/explained: a) proving tie between identity and public key; b) proving knowledge of the associated private key. $\;$ 3) Certificate authorities typically do not generate a user's public-private key pair; they issue a certificate for a public key.
Apr
3
comment Crack linear congruential generator knowing every other word in sequence
@Gravian: hints: The algorithm you used (successfully I guess) can obtain a multiple of the actual $m$. The right $m$ is likely not too much above the highest output available.
Apr
3
comment Crack linear congruential generator knowing every other word in sequence
Hint: compute $X_{n+2}$ as a function of $X_n$; suprises, that's a standard LCG with the same $m$, and you know consecutive output for it. From that find $a'$, $b'$, $m$ for that other LCG using a standard method, then from that derive $a$, $b$ of the original.
Apr
3
comment Required key size for an ideal cipher with a 32 bit block size
$\log_2(2^{32}!)\approx131,242,625,471$ bit. Storing that key for would require slightly less than 16GiB. It is quite easy to make a program implementing such a theoretically perfect 32-bit block cipher; the challenging thing is to make it bearably fast.
Apr
1
comment Is it safe to encrypt random data using ECB mode?
Perhaps, in the second paragraph: reasonable amounts of random data
Apr
1
comment Is computing roots moduli a composite $N$ a hard problem without knowing the factorization of $N$?
@curious: no, $v\equiv u^{-1}\pmod N$ does not imply that $x= (x^{u})^v\pmod N$. Just try with e.g. $N=55$, $u=3$, $x=2$, $x^u=8$, $v=37$ (since $u\cdot v=1+2\cdot N$), $(x^u)^v\equiv13\pmod N$.
Mar
30
comment During electronic voting, how does one hide the choice from Voting device?
The hypothesis "none of the authorities collude with the device" is one we'd want to eliminate; we'd want any cheating by colluding authorities to be detectable. $\;$ The voting system where paper ballots, put in opaque envelopes, put in transparent sealed urns, are publicly counted at each voting place, and the results hierarchically added and published, is the best one I know. Paper and plexiglass do not collude with anyone, an observer has good chance to detect a local fraud, and can verify that results s/he verified are properly published and added, and trust other observers do the same.
Mar
30
comment Is there any pattern in points on EC?
The Elliptic Curves used in cryptography have a public equation, e.g. $y^2=x^3+ax+b$ with $x,y$ the coordinate of points on the curve, and $a,b$ public constants, with all arithmetic in $\mathbb Z_p$ for some public constant prime $p$. The equation allows easily determining if a point of given coordinates $x,y$ is on the curve, or not. There are so many points that one can't make a list of all the points, for practical parameters. However it is still possible to determine ("count") how many points there are. $\;$ Is that what you are asking?
Mar
30
comment The effect of truncated hash on entropy
@user40602: the definition of entropy rate that I know is for a process; what would it be in the context of the question? $\;$ If that process is: generate a 128-bit random string and output its SHA-256 (resp. SHA-256 truncated to 128-bit), its entropy rate is $\approx128$ (resp. $\approx127.173$) bit per output symbol.
Mar
30
comment Is there an existing authorative definition of the cryptographic term 'pepper'
I've never met the second usage, of pepper as forgotten salt. I can imagine it occurring accidentally when the salt is lost or becomes somewhat ambiguous. But I can't imagine that designed-in, for it seems to have no advantage whatsoever compared to bumping iteration count.
Mar
29
comment Stacked LFSR - why not used?
@H. Circlebeach: you have not defined your scheme fully: it is unclear if at each step, 2 or 33 LFSRs are stepped, and by how many bit steps; what are the polynomials; and how the initial state is chosen. $\;$ Whatever these details, once they are known, there's a trivial attack: enumerate the possible states of the selector LFSR (that's only $2^{32}$ possibilities), and check that hypothesis against known keystream, focusing on the most-often selected of the 32 other LFSRs. Finding state and predicting future output from 1024 bytes of past output would require minutes.
Mar
27
comment The effect of truncated hash on entropy
@D.W.: given your long-running interest in entropy loss by iterated hashing, you might like this which solves the question for the first iteration (asymptotically, and in practice). Also, it shows we can numerically explore the first few iterations, and the reference I cite gives estimates.
Mar
27
comment The effect of truncated hash on entropy
@Stephen Touset: if your split a string of independent random bits (with even distribution, or at least the same distribution for all bits), then the entropy spreads evenly. However if the bits are correlated, the sum of the entropy in each half can be greater that the original entropy. In the extreme example of a two-bit string where the first bit is drawn by coin toss, and the second bit decided as the opposite of the first, there's one bit of entropy in the whole string, in the first bit, and in the second bit.