Reputation
26,564
Next tag badge:
419/400 score
79/80 answers
Badges
2 37 111
Newest
 Necromancer
Impact
~409k people reached

Jul
22
comment Is my implementation of a PRG at least intuitively secure?
We can tell you the exact opposite: there is not (and can't be) a test, using a PRG as a black box, that can give a useful indication that a PRG is secure; much less a proof. The best a test does is tell that a PRG is not secure. Existing tests of CSPRNGs are designed to catch faulty implementations, or badly misguided (more often than not, both).
Jul
22
comment Is my implementation of a PRG at least intuitively secure?
Without a meticulously precise description of a PRG, one can't conclude that it is secure. Such description is not given, thus the question can't be answered; and it would probably be off-topic anyway. $\;$ Keep in mind that any experimental randomness test not tailored to the PRG tested can only invalidate the hypothesis that it is secure, NOT validate that hypothesis. An analogy: that's similar to a Fermat primality test, which can often invalidate that an integer is prime, but can never tell 1436697831295441 is not prime.
Jul
22
comment MAC using a modified CBC mode of operation
Hint: what happens to the tag when two blocks of plaintext are exchanged?
Jul
21
comment understanding the proof of knowledge
Anything in particular remains unclear after reading Wikipedia's entry on proof of knowledge? Or/and Mihir Bellare and Oded Goldreich's reference article: On Defining Proofs of Knowledge?
Jul
21
comment Is there a generic attack on encrypted CRC32 when used as a MAC?
In my first comment, read "the adversary able to mount a chosen-PLAINTEXT attack".
Jul
21
comment Is there a generic attack on encrypted CRC32 when used as a MAC?
@RickyDemer: Yes. Adapted to the present context (with CRC instead of Hash, but that works for a hash just the same): one decides the desired Forgery, computes its CRC, builds 6zeroes||Headers||CRC||Forgery, submits that as (chosen) Data for authentication and encryption; and from the resulting cryptogram removes the first 16 bytes (including 8 bytes IV). What remains will pass verification (the first 8 bytes will be the IV).
Jul
21
comment Is there a generic attack on encrypted CRC32 when used as a MAC?
The terminology is not quite right: CRC32 can't be used as (a weak substitute for) a MAC, for it is a keyless transformation of the message. Rather, here, it is used as (a weak substitute for) a hash in a hash-then-encrypt scheme, something which itself does not generally insure message integrity. $\;$ If the IV for the 3DES-CBC encryption is 8 random bytes prepended to the cryptogram, and the length of Data variable, and the adversary able to mount a chosen-ciphertext attacks, then such generic attacks on hash-then-CBC-encrypt work here.
Jul
18
comment Is TripleDES 168bit vulnerable to Differential Cryptanalysis?
One should not trust a table/paper where the time to enumerate all 56-bit DES key is given as 400 days at a rate intended to be realistic (the EFF cracker did that in few days in 1998).. and where for 112-bit 2keys-3DES, all other things being equal, the time is only twice that!! $\;$
Jul
17
comment Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
That answer was written for that early statement; and assumes $\gcd(b,p-1)$, which is not a given, and is rare for some $p$. $\;$ Also, the current statement and that comment suggest that the given $g^{ab}$ really is $g^{a\cdot b\bmod r}\bmod p$, not $g^{a\cdot b}\bmod p$ as assumed in this answer; that's usually not the same, for the statement now rules out $g^r\bmod p\;=1$.
Jul
17
comment How secure is using a pad (using xor) on a encrypted data, for the purpose of obfuscating/hiding the underlying encryption?
If in “The key is repeatedly used” that “key” is the same as “pad cipher”, then that “repeatedly” is the exact opposite of “one time” in the title's “one time pad”.
Jul
17
comment Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
By "in group $\mathbb Z_r$" are you meaning $a$ and $b$ are in $\mathbb N$ and less than $r$, or that $a\cdot b$ is computed in that group?
Jul
17
comment Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
@curious: I can't parse what "it's" refers to in your previous comment. Rather, my bets are on the inverse $\pmod{p-1}$
Jul
17
comment How long does it take to crack PBKDF2?
@Henrick Hellström: very true. That's a possible usage of PBKDF2, not the one I had in mind with my "used to manage passwords".
Jul
17
comment Attack on DSA modification with bad hash function
Write down the main equation used by the verifier for testing that $(m,r,s)$ is an acceptable signature in the weak system. The valid signature gives known values satisfying that equation. Your goal is finding $(m',r',s')$ with $m'\not\equiv m\pmod q$ which keeps the equation satisfied. What's $g^q\bmod p$? $y^q\bmod p$? What kind of changes does that allow while maintaining the equation satisfied? Perhaps replacing $s$ with $w=s^{-1}\bmod q$ in the equation (and $s'$ with $w'=s'^{-1}\bmod q$) will help you finding the appropriate changes.
Jul
17
comment Attack on DSA modification with bad hash function
Again, if for any $t$ you could forge the signature for $m′=t+m\bmod q$ in the weakened system, that would also break the real DSA [by choosing $t=H(m′)-H(m)\bmod q$ and using the same attack]. So no this does not cut it, and you need a narrower choice of $m$, of the form $m'=f(m,r,s,p,q,g,y,t)$ for some $f$; and it won't be possible to find $t$ to obtain a chosen $m'$. The mistake in the argument given is that it is assumed $s$ does not change, rather than proven that with $s$ unchanged the verification procedure will pass with the $r'$ that you propose; indeed the verification will fail.
Jul
16
comment Attack on DSA modification with bad hash function
@CGFoX: If for any $t$ you could forge the signature for $m'=t\cdot m\bmod q$ in the weakened system, that would also break the real DSA [by choosing $t=H(m')\cdot H(m)^{-1}\bmod q$ and using the same attack]. You want to exhibit a narrower class of transformations $m'=f_t(m,r,s,p,q,g,y)$ for which an acceptable signature $(r',s')$ can be forged.
Jul
16
comment Does having a known plaintext prefix weaken AES256?
As rightly answered, the answer to the question as in title and second paragraph is NO. $\;$ But suitability of counter mode can't be ascertained, for we do not know: $\;$ A) If the data ever legitimately changes, and how the counter is setup in that case; $\;$ B) If we should consider an attack model where the adversary changes the enciphered data, observes how the system then behaves when manipulating the (modified) deciphered data [e.g. error indication, or lack thereof], and deduce something about the actual clear data.
Jul
15
comment Attack on DSA modification with bad hash function
Does the statement allow the attacker to choose $m$ or/and $m'$? With what constraints?
Jul
9
comment How can I calculate the Rijndael SBox?
Some links: A new combinational logic minimization technique with applications to cryptology by Joan Boyar and René Peralta; this code-challenge; this code-golf; and this implementation.
Jul
9
comment Is calculating a hash code for a large file in parallel less secure than doing it sequentially?
@CodesInChaos: Very right! I fixed the answer according to your observation.