12,252 reputation
32559
bio website paul-ebermann.tumblr.com
location Berlin, Germany
age
visits member for 2 years, 9 months
seen 59 mins ago

Don't fear to edit my posts: even if I have more reputation than you, I do make mistakes.

I'm now also a Moderator Pro Tempore (= until the first elections) at Cryptography Stack Exchange: feel free to come around and ask some cryptography questions.


My personal name is spoken as /ˈpawlo/ (IPA), in English this would be written similar to Powlo, I think (i.e. the vowels are ow and o), with an accent on the before-last syllable (which is the first in this case). It's the Esperanto form of my given name.

The photo shows my shadow, taken at night. My camera sometimes seems to forget all the other frequencies and only stores the green ones.

My current main private programming project is the game of fencing, an online abstract turn based strategy game. Implemented as a Java applet, using git as a version control system.


Some more links:


Nov
12
comment What is pre-image resistance, and how can the lack thereof be exploited?
I think often a (first-)preimage attack is more devastating than a second-preimage attack, as (usually) preimage attacks are easily extended to second-preimage attacks, but not the other way around.
Nov
12
revised What is pre-image resistance, and how can the lack thereof be exploited?
add preimage example (from Henno's answer), add note about formal definition (thanks to Fixees comment)
Nov
12
comment Best way to reduce chance of hash collisions: Multiple hashes, or larger hash?
@Theodor: For a random collision, a simple look at the combined output size $n$ (in bits) is enough: You need about $2^{n/2}$ blocks to have a good chance. As $256 + 128 = 384$, the probabilities are quite the same. If you fear malicious collisions by attackers, avoid MD5 as its collision resistance is broken, and avoid concatenations of different hash functions, as in the answer by Thomas.
Nov
12
answered What is pre-image resistance, and how can the lack thereof be exploited?
Nov
10
comment Linear Cryptanalysis
Also, have a look at How do I apply differential cryptanalysis to a block cipher?.
Nov
10
comment Linear Cryptanalysis
Did you read the Wikipedia articles about Linear Cryptanalysis and Differential Cryptanalysis? Please note what you don't understand about them, and make your question more concrete.
Nov
10
awarded  Nice Answer
Nov
10
awarded  Enlightened
Nov
9
answered How does one provide a secure and authentic communication channel?
Nov
9
comment Encrypting and obscuring data between site/user without SSL
Also, if the client JavaScript comes from the server over a non-authorized connection, there is no way to be sure that it hasn't been meddled with by the attacker, which makes all the secure protocols moot. See Javascript Cryptography Considered Harmful.
Nov
9
comment Encrypting and obscuring data between site/user without SSL
What kind of "environment" is there which doesn't support SSL, but does support other kinds of encryption? Do you have filters which block SSL, or is your hardware not good enough to handle the crypto?
Nov
9
comment Is it reasonable to assure that p-1 and q-1 aren't smooth?
@fgrieu, Thomas: What about choosing first a random big prime number $x$, then random (even) factors $y$ until $x·y + 1$ hits a prime number (and then take this as $p$ or $q$)? Or use the version which Henno proposed?
Nov
8
comment Encrypting (CBC) identical files with same key and different iv, is it less secure?
As long as your N times the size of your file remains small compared to the $2^{68}$ bytes I mentioned in the last paragraph, the chance to get anything out of the ciphertext remains negligible.
Nov
8
answered Encrypting (CBC) identical files with same key and different iv, is it less secure?
Nov
8
revised How to choose constants in a cryptographic function?
edited tags
Nov
7
revised What is the purpose of four different secrets shared by client and server in SSL/TLS?
better title, formatting/rewording, tags
Nov
7
comment How to choose constants in a cryptographic function?
It does contain this paragraph: The above particular values of opad and ipad were chosen to have a very simple representation (to simplify the function's specification and minimize the potential of implementation errors), and to provide a high Hamming distance between the pads. The latter is intended to exploit the mixing properties attributed to the compression function underlying the hash schemes in use. These properties are important in order to provide computational independence between the two derived keys.
Nov
7
comment How to choose constants in a cryptographic function?
Looking at Keying hash functions for message authentication, which seems to be a fuller version of a paper which appeared in Crypto 96, there is no Lemma 5.2 (though section 5.2 is "Security of HMAC"). It doesn't contain any "rka-advantage".
Nov
7
comment How to choose constants in a cryptographic function?
@Henno: Do you have some link for the HMAC-proof? I had a look at New Proofs for NMAC and HMAC: Security without Collision-Resistance, but this proof seems to work with any values of ipad and opad.
Nov
7
revised How to choose constants in a cryptographic function?
add HMAC, some links, put nothing-up-my-sleeve in front.