Reputation
26,444
Next tag badge:
411/400 score
78/80 answers
Badges
2 36 109
Newest
 Revival
Impact
~395k people reached

May
6
comment Information-theoretic bound on leakage by timing measurement
The methods you describe work, with the first matching Q1, and "Another approach.." matching Q2. I'm uncertain this optimal, though: getting all the key fragments (or coupons) is long, and perhaps it is better to build a redundant form of the key, and leak that; sort of forward error correction, where error is missing coupons.
May
6
comment Brute-force attack given small search-space and hash prefix
I'm reading " the attacker only has the first 8 characters of the SHA1 " as meaning the first $8\cdot4=32$ bits of the hash. Thus it is expected about $2^{24}$ candidates.
May
5
comment Defining format-preserving encryption for natural language
This is a form of steganography. It is feasible if we accept that ciphertext is significantly larger than plaintext, for some definition of natural language (especially if that includes modern poetry, or something looking like the output of automatic translation, or/and if we feed the encryption program with natural text that it slightly transforms).
May
4
comment RFC 5297 implementation
Was re-posted (in slightly better form) in this (off-topic) question.
May
4
comment trying to get calculator and RSA calculatin does not make sense
First part (the only one close to being on-topic) is addressed in Calculating RSA private exponent
May
4
comment Where can I learn the basics of AES?
I guess your primary reference should be AES Proposal: Rijndael. At a very high level, remember that the key schedule is here to build, from the key, one more (blockwide) subkey than there are rounds, because the block is XORed with a subkey on input, between rounds, and on output; and the subkeys should not be so closely related that it creates a weakness.
May
3
comment Energy necessary for brute-forcing or decryption
@Ricky Demer: According to the private key format, the public modulus is available in clear in the private key. A critical parameter is the value of the s2kcount parameter, which controls the work factor used for stretching of the passphrase. Depending on that, the point of least hardest attack is the passphrase, or the factorization of the public modulus. By default stretching used to hash about $2^{16}$ bytes, but I have read about plans to increase that.
May
2
comment How can AES be considered secure when encrypting large files?
@kasperd: my $r$ is residual risk as a base-2 log, not comparable to the security of a key in bits (the adversary can use more brute force against the later, not former). When making a 100 miles trip by car in the US, one accepts a residual risk of death about $2^{-20}$, compare to $2^{-40}$ of being hacked; see also my consideration about oblivion by asteroid.
May
2
comment SipHash - 64 bit (second) preimage security?
Are you considering SipHash with the supposedly secret key gone public, making SipHash as hash, when normally SipHash is a MAC (aka Pseudo Random Function Family) rather than a hash (aka random public menber of a Pseudo Random Function Family) ?
May
2
comment How can AES be considered secure when encrypting large files?
@kasperd: your rule of thumb is way overly conservative; CBC/CFB modes are good for $b\cdot2^{(b+1-r)/2}$ bits where residual odds of duplication of one block are $2^{-r}$. With AES and $r=40$ (residual odds of one in a million millions, entirely negligible compared to oblivion by asteroid on any given day) that's 3 petabit (nearly 400 terabyte). CTR/OFB modes are good for even more.
May
1
comment Is it safe to derive two different keys with the same password and key derivation function using two different salts?
@rossum: your appendix is to belt what salt+KDF are to suspenders.
May
1
comment If a DES key correctly decrypts one message, what's the probability it's the real key?
Hint: if DES was an ideal cipher, $X\to DES_X(M)$ would behave like a random function, Using this, estimate odds that there exists no $T$ less than $K$, as a function of the value of $K$; then that expected odd for random $K$; then what's asked.
May
1
comment Key space vs Cardinality of 1024-bit RSA
@dave_thompson_085; good catch, thanks
May
1
comment What crypto scheme should I use on embedded m2m system with assymetric uplink/downlink bandwidth?
You should define your objectives better. You mention asymmetric encryption, what about authentication of the origin of messages? Can there be two-way communication with the intended final receiver of the encrypted message? Do you want forward secrecy? Do you need some level of resistance to traffic analysis? What can adversaries attempt (in particular, on what are they in a position to hook a jtag probe or equivalent? On other devices, can they measure the device's power consumption? Exploit EM emission beyond the radio link?) What's the legal context?
May
1
comment Information-theoretic bound on leakage by timing measurement
@kodlu: you are right, the space requirement I gave was way too high, I had left a $\log_2$ factor out. Thanks for pointing that error!
Apr
30
comment Discrete logarithm over prime modulo: small input, large exponent, larger prime
That would not be a hash as usually defined, since part of its definition ($e$) is secret. Rather, that's a keyed one-way function; it is the encryption part of a cipher if $\gcd(e,p-1)=1$
Apr
30
comment Zero knowledge / proof of knowledge sudoku solution
Nice trick.Describing in more details how it's done from a distance would be awesome.
Apr
30
comment What crypto scheme should I use on embedded m2m system with assymetric uplink/downlink bandwidth?
128 bit (16-byte) is too short for an asymmetric ciphertext. You'll have to use asymmetric encryption (or key agreement) split over a few packets to establish a symmetric key.
Apr
28
comment Looking for encryption algorithm not subject to known-plaintext attack with IV reuse
Can you expand on " but we have no room to store IVs "? Do you mean you can't afford the bandwidth to transfer an IV? Or you have no reliable TRNG at hand to generate a random IV? Or you equate IV to permanent counter, and do not have permanent memory for that? Or it is too much trouble (or slow, hardware-wearing..) making that memory permanent-enough facing an adversary, or just Murphy pulling the plug? Or ..?
Apr
27
comment Is the Salsa20/ChaCha20 keystream generation one-way?
The last two sentences are correct, but do not answer the question. Based on definition of Salsa20, $Salsa20(x)$ is an un-keyed (conjectured-one-way) function used to build the Salsa20 cipher, hence this answer does not touch the question of if the key can be found. Also three errors crept in the first sentence; actually $Salsa20(x)=x+doubleround^{10}(x)$ where $+$ is addition skipping carry every $32$ bit, and we have $1$ such addition and $10$ chained $doubleround$, rather than a chaining of $20$ times (different) additions and $doubleround$ as stated.