Reputation
26,444
Next tag badge:
411/400 score
78/80 answers
Badges
2 36 109
Newest
 Revival
Impact
~396k people reached

May
18
comment Could this alternative hash based MAC construction be as, or even more secure than an HMAC?
@Anon2000: in crypto perhaps more than elsewhere, the devil is in the details. If you look closely at a typical SHA-1 implementation, the state has the 160-bit chaining variable so far, the length so far (usually 64-bit, could be in bits or bytes), and the message-block-not-hashed-yet (usually up to 511-bit, which length may or may not be tracked separately). If you want a portable implementation enciphering or hashing that, you need to care of all these details, including endianness and order of the various fields. If you consider only the chaining variable, you must be careful about padding.
May
18
comment Could this alternative hash based MAC construction be as, or even more secure than an HMAC?
(continued) if for some reason the length of the message is not known at the beginning of the MAC, there's the more elaborate CMAC; or OMAC2. Do not use straight CBC-MAC with a variable-length message.
May
18
comment Could this alternative hash based MAC construction be as, or even more secure than an HMAC?
If you are concerned with speed of a MAC and have hardware-accelerated AES encryption, you definitely want to consider CBC-MAC with the length of the message at start, and right-padding of the message with zeroes; this is demonstrably secure (when using a key dedicated to MAC), and even standardized as ISO/IEC 9797-1:2011 Padding Method 3. As they put it: "The [first] block consists of the binary representation of the length (in bits) of the unpadded [message], left-padded with as few (possibly none) ‘0’ bits as necessary to obtain a [128-]bit block".
May
18
comment What is the difference between online and offline brute force attacks?
Yes; but that's typically not the meaning of online in cryptography, as understood in online brute-force attack.
May
18
comment Does failure of indistinguishability of encryptions imply lack of CPA-security?
Yes, except for use of OTP as an example. Let's take the semantic step of considering that the OTP can be subjected to the test while still remaining worth of its name, despite the fact that a single key $k$ is drawn at step 1, and it is shorter than the total (or even individual) size of messages at 2 and 4. We have to admit that this OTP is used with the same pad at each use in 2 and 4 (with the pad a repetition of the key for longer messages). This OTP fails the test of indistinguishablity of encryptions under eavesdropping, and is thus not a proper example of the point discussed.
May
18
comment What is the difference between online and offline brute force attacks?
@Jingwei: OK for that description of offline brute force attacks; for online brute force attack, what's important is that the other entitie(s) is/are what is under attack. I'll add a note to clarify.
May
17
comment Is the HMAC construction really neccessary for a fixed length message?
@Anon2000: for your need of a fast MAC, have you considered Siphash?
May
17
comment Is One Time Pad considered Chosen-Plaintext Attack Secure?
@Gordon: Yes, I used cipher where I meant encryption scheme! My mistake! And I'm the one trying to be rigorous, shame on me. That's fixed. $\;$ Now I'm not in a position to object against your definition of OTP, which allows reusing the pad, making it an encryption scheme (that is not secure in any definition of that).
May
17
comment Is One Time Pad considered Chosen-Plaintext Attack Secure?
@Gordon: I (now) see what you mean. If we consider that the OTP allows key reuse then, yes, it is a cipher (perhaps, by a variation of the above definition where the plaintext size is restricted), but not a secure one under even the weakest definition of security (unknown plaintext with known redundancy). On the other hand, two of out three words in the name One TIme Pad are there to emphasize that the pad/key can not be reused, so this twists the definition of OTP.
May
17
comment Is One Time Pad considered Chosen-Plaintext Attack Secure?
@fkraiem: even if we restrict the message space of a cipher to $\{0,1\}^{|k|}$, the OTP does not fit that definition of a cipher, because a cipher must allow encryption of multiple messages with the same key, and the OTP does not.
May
16
comment CCA secure or not?
I do not understand how decryption could be done, or what $\bigoplus0^n$ is supposed to achieve. Is there a typo somewhere?
May
16
comment Authenticate a short message with redundant encryption instead of using a MAC?
@user1636512: your feeling is right (the adversary gets twice as much plaintext with the same key); yet modern ciphers like AES are perfectly fit for this.
May
15
comment Authenticate a short message with redundant encryption instead of using a MAC?
If you can spare a single bit out of the plaintext (say, the leftmost of the 128 bits is always 0 in a valid plaintext), you can have authenticated encryption with a single key: make the cryptogram $E_K(plaintext)\|E_K(plaintext+2^{127})$ and make the obvious checks of the 129 constrained bits on the receiver side. If size is an issue, the second block can be truncated.
May
15
comment Meet-in-the-Middle attack on 3DES
(re-revised) In the section on attacking 2-key 3DES: odds of having made a valid guess at step 1, stated at step 4, are $p/{2^m}$. The storage requirement is OK (I had to get at the article to confirm that). $\;$ Minor TeXpo in the section on attacking 3-key 3DES: $2^56$ should be $2^{56}$
May
14
comment Meet-in-the-Middle attack on 3DES
I'm not seeing that this question is a true duplicate; various other answers do not really describe the basic MitM applied to 3DES. The closest I found is in this question but the table is built my enumerating 2 keys rather than 1, which makes it require a ludicrous amount of memory; hence my answer.
May
10
comment Key Check Value standard pratice for asymetric cryptography?
That indeed matches the question as asked. However there's a significant issue: it's big!
May
7
comment Algorithm for n-of-m keys with partial results
If " nobody is trusted to hold the complete key " in the question rules out that a trusted party (not among those holding a key share) holds the complete key, it's going to be critical to specify what the complete key is supposed to allow.
May
7
comment Information-theoretic bound on leakage by timing measurement
Your answer and comment above seems very close to my goal as set in the second section of the question: we bound the channel capacity in the situation of Q3, disregarding the considerations of Q1 and Q2 (also I realize that a practical adversary can often choose the input to the black box or Smart Card, which is even more handy than having an internal counter in the black box). $\;$ So the only thing left to do is dig the formula for computing the Shannon capacity of the channel in the presence of noise $U$.
May
7
comment Key derivation design to avoid key leaks
When the adversary exercises the extra capability, a chosen input is chosen_seed, a known input is seed, an unknown input is key, but what is the output? If there's none, the extra capability is useless! If that is derived_key_2 (my best idea to make sense of the question), how come " second goal is to get derived_key_2 " ? Or perhaps the adversary observes something through a side channel like timing, power analysis?
May
7
comment Information-theoretic bound on leakage by timing measurement
Ah, did not knew fountain codes, that seems a fine (optimal ?) tool for the hypothetical attacker. Yes I'm hoping that the answer to Q3 (assuming Q2) can come from coding theory (which is off my area of practiced expertise, even though I was in modems in an earlier life).