Reputation
15,023
Top tag
Next privilege 20,000 Rep.
Access 'trusted user' tools
Badges
3 41 86
Impact
~443k people reached

Dec
10
comment Why does the padding in Merkle–Damgård hash functions like MD5 contain the message length?
@fgrieu (Both @Paŭlo and @Paulo work to ping me ... just use whatever the auto-completion proposes, or what is more easy for you to type.) I think this depends on the definition of collision for a compression function - if every $c(x_1,y_1) = c(x_2,y_2)$ with $(x_1, y_1) \neq (x_2, y_2)$ counts, then there really must be some collision in $c$ (or a "tail-of-message" with a preimage to $I$, as mentioned before). And this seems to be the idea of the proof in the answer. (Of course there must exist some collisions, the problem is just how to find them.)
Dec
10
comment Why does the padding in Merkle–Damgård hash functions like MD5 contain the message length?
@fgrieu I think the point is that we want to avoid ABCD to hash to the same thing as XYZABCD (each letter being one block), when the internal state after hashing XYZ is the initialization vector again. This would be the "running out of blocks" mentioned there. The simple 10000... padding would do nothing here, it just helps against the simplest appending attacks.
Dec
10
comment Why does the padding in Merkle–Damgård hash functions like MD5 contain the message length?
@fgrieu: It was not my answer, I only edited it to add formatting (and an explicit example for Merkle-Damgard). I hope I didn't destroy anything by doing this. The necessary of encoding the message length in the padding is mentioned in the last paragraph, but could be explained in more detail.
Dec
10
revised Why does the padding in Merkle–Damgård hash functions like MD5 contain the message length?
formatting, and example for the Merke-Damgard construction
Dec
10
revised Why does the padding in Merkle–Damgård hash functions like MD5 contain the message length?
formatting, spelling, tags, title
Dec
10
revised Is it safe to store initial counter value for AES-CTR alongside with ciphertext?
edited tags
Dec
10
comment Is it safe to store initial counter value for AES-CTR alongside with ciphertext?
One could generate the nonce together with the key from some password and salt (or from a key exchange algorithm's shared secret), and then not transfer it explicitely.
Dec
10
revised Does hash_df use binary or an ASCII hexadecimal representation for numbers to be passed to the hash function?
formatting
Dec
10
comment Does hash_df use binary or an ASCII hexadecimal representation for numbers to be passed to the hash function?
New users have to wait 8 hours before answering their own question. This is intended to prevent question clarifications as answers, but sometime also hits innocent users. Just get to 100 rep and this limitation will be lifted.
Dec
10
revised Random oracle model proofs and programmability
typo (P instead of V)
Dec
9
comment Demonstrating the insecurity of an RSA signature encoding scheme
Have a look at the corresponding verifying scheme. Can you find a number, which, when taken to the power $e$ (the public exponent), gives something in this encoding? (This depends on the public key, but assume it it something like $3$.)
Dec
9
revised Demonstrating the insecurity of an RSA signature encoding scheme
formatting
Dec
9
comment Demonstrating the insecurity of an RSA signature encoding scheme
Okay, and where do you need help here?
Dec
7
comment Random oracle model proofs and programmability
Have a look at this blog series What is the Random Oracle Model and why should you care? - it explains in some more detail how a random oracle can be used in security proofs for cryptographic algorithms. (I'm thinking of adding a bit about the programmability as an answer, but it might need some time.)
Dec
6
comment Are there two-way encryption algorithms that include a work factor?
Take care to take the hash part of the output, not the part which contains the salt and work factor, though :-)
Dec
4
revised Is HMAC-DRBG or Hash-DRBG stronger?
mention pseudorandomness
Dec
4
revised Is HMAC-DRBG or Hash-DRBG stronger?
typo
Dec
4
answered Is HMAC-DRBG or Hash-DRBG stronger?
Dec
4
revised Is HMAC-DRBG or Hash-DRBG stronger?
tags, rewording/reordering, referring the right sections
Dec
4
revised Is a using salt important when creating a hash data validator?
tag