Reputation
25,400
Next tag badge:
391/400 score
76/80 answers
Badges
2 32 104
Impact
~372k people reached

Apr
22
comment side channel attacks against TDES (compared to AES)
Search for DES (differential) power analysis, you'll see tons of papers, including Paul Kocher's (he was the first to come out with the technique), and this intro from the company he founded, basically around solving that problem.
Apr
22
comment Super-simple encryption of short strings
The letter-to-integer, and back, is trivial. For the permutation Fisher-Yates is theoretically perfect, and feasible since you mention R (on some CPUs I practice, 36kB is many times all the RAM); FPE has a number of methods that allows to perform this step, and back, without a table; this would be elegant.
Apr
22
comment Super-simple encryption of short strings
If for example there was only one patient with 3-letters ID, s/he is not going to like your "I think it is ok to preserve their length".$\;$ Formally, you want Format Preserving Encryption on the set of 2-or-3-letters blobs, which has 26⋅26⋅27 elements. This is so small that a table of 18252 at-least-15-bit values implementing a pseudo-random permutation is feasible, and might be the simplest.
Apr
21
comment Is it possible to break enigma code with a todays laptop
What do you know about the Enigma variant ?
Apr
21
comment What is SHA-256 in Conjunctive Normal Form?
@cpast: indeed, the CNF formula is of manageable size only for bounded message size. The CNF formula is many times as big as the message is, and about proportional to that; the number of variables also is about proportional.
Apr
21
comment What is SHA-256 in Conjunctive Normal Form?
@cpast: an exact equivalent to the huge CNF formula that you are considering can be written with very manageable time and size. The trick is introducing the right extra variables. See e.g. the article I link to here
Apr
21
comment What is SHA-256 in Conjunctive Normal Form?
Dejan Jovanović and Predrag Janičić's Logical Analysis of Hash Functions (in Frontiers of Combining Systems, 2005) has a section on Encoding of Hash Functions into Instances of SAT Problem, which is what you are looking for. $\;$ Caveat: I only glanced at it; this is a pointer, not a recommendation.
Apr
21
comment What is SHA-256 in Conjunctive Normal Form?
The equation $\text{SHA-256}(m)=h$ where $m$ is of fixed (or bounded) size, and $h$ 256-bit, CAN easily be written in CNF by applying the definition of SHA-256, step by step; the CNF problem resulting will not be huge. and can legitimately be considered a CNF representation of the SHA-256 algorithm. A standard CNF solver using it will compute $h$ from $m$; or a few missing bits of $m$ from the other bits and $h$.$\;$ Asking for "the simplest" such representation is not well defined (and it will likely be hard to get the simplest); what's your criteria for "simple"? (please edit question)
Apr
20
comment Rabin cryptosystem with 1 mod 4
If you are lucky, $p\equiv q\equiv5\pmod8$ and you can use Alg 3.37. Otherwise, you have to use Alg 3.39 for $r$ or/and $s$; in its point 1, you need Alg 2.149 in order to compute the Jacobi symbol $\Big({b^2-4a\over p}\Big)$.
Apr
20
comment Rabin cryptosystem with 1 mod 4
Anything precise that you do not get in algorithm 3.44 of the HAC?
Apr
19
comment Why does applying 56-bit DES twice only give 57 bits of security?
I ask in meta if we should have closed this question, or should reopen it so as not to loose its simple and useful answer.
Apr
19
comment Why does applying 56-bit DES twice only give 57 bits of security?
@Nova: some user, like Paŭlo Ebermann, consider fine that others edit their post, and explicitly give license to that effect in their profile. In that case (only) I feel comfortable to edit (rather than constructively criticize) their answer when I see something wrong but fixable.
Apr
19
comment Why does applying 56-bit DES twice only give 57 bits of security?
I looked closer, and indeed we have a close match for that question, though asked in more precise and quantitative terms: Meet-in-the-middle with checking complexity, with a good answer.
Apr
19
comment Why does applying 56-bit DES twice only give 57 bits of security?
This basic question is NOT a duplicate of these questions. In fact I do not find it either asked or answered anywhere on CSE. We have a closely related but more complex question, with good answers: Attacking 2DES efficiently.
Apr
19
comment Why does applying 56-bit DES twice only give 57 bits of security?
@CodesInChaos: I would be surprised that distinguished points/cycle finding can work with known plaintext (which seems to be the context of the question, since it is said that DES has 56-bit security, when it has only 55-bit security under chosen-plaintext attack due to DES's complementation property, with $\operatorname{DES}_{k_1}(\operatorname{DES}_{k_2}(M))$ only about 56-bit security, not 57-bit). $\;$ More generally, I'm not sure that I understand what you are thinking about.
Apr
18
comment Is chaotic encryption secure?
I located a review with a section about that chapter. It really is an overview, and totally non-committing.
Apr
17
comment Is chaotic encryption secure?
Count me as fully open to the idea that a chaos-based cryptosystem can be made secure, but highly skeptical that it has any advantage over established cryptosystems.
Apr
17
comment Key space vs Cardinality of 1024-bit RSA
To avoid duplicate moduli we want $p<q$, that about halves the cardinality. And then, what about $e$ ? Setting a fixed $e=3$ reduces the cardinality by a factor of about $4/9$. If $e$ is allowed to vary, and we defined an RSA key as $(p\cdot q,e)$, our cardinality increases (and we should account for equivalent $e$ if very large $e$ are allowed). And then, many practical RSA key generation algorithms only generate primes of a certain form (like, such that $p-1$ and $p+1$ each have a known prime factor of a fixed bit size) and that reduces the cardinality of what they could generate.
Apr
15
comment Asymmetric encryption that is secure for (almost) any foreseeable future
It is not stated to what certainty degree it is required that the scheme remains secure after 1000 years, and that's an important parameter. It is much easier to predict very long term things with 30% chances to be wrong, rather than with 0.03% chances (a residual risk level often accepted in security, about that of having one's Smart Card pin guessed). One reason many key length estimates in the distant future are so conservative is that they are made with the intend to only err on the safe side.
Apr
15
comment Factoring two RSA modulus with known $|p_1 - p_2| < \ell $
I fail to see how the examination of the bits of the ratio$N_1\over N_2$ reveals information on $a$ (as stated in the but-last paragraph of the current answer). As a minor aside, $|p_1-p_2|\le2^s$ is not quite a sufficient condition to insure that $\lfloor p_1/2^s\rfloor=\lfloor p_2/2^s\rfloor$, thus existence of $a$. That part is easily fixable: with $s=\lceil\log_2\ell\rceil+4$, it is quite likely $a$ exists.