3,984 reputation
11032
bio website bradconte.com
location Texas, USA
age 27
visits member for 3 years, 4 months
seen Nov 11 at 6:49

I'm a software engineer with a background in computer science and mathematics. I love cryptography, math, and Linux.

More about me on my website: http://bradconte.com/about.


Sep
18
comment Estimating bits of entropy
Do we have anything better than that for practical entropy estimates in real life? We don't (well, rarely) deal with truly random events, just events where we have a distribution and very little additional insight beyond that distribution. (Top of my head examples: hard drive seek times, mouse coordinates, etc. They aren't truly random, but at some level of detail you're stuck with a distribution of behavior and no way to analyze the source any more finely.)
Sep
18
comment Estimating bits of entropy
I would think we could pragmatically estimate entropy via a combination of statistics and good analysis. Empirically measure a statistical distribution on the lowest level of the entropy source that you can. Calculate $H$ where $Pr[x_i]$ is calculated from that distribution. How good an estimate of entropy this produces will rely on how good of a choice was made for "lowest level". Eg, if you chose the output of a PRG seeded by 0 you will have a false high entropy due to a poor decision. But if you choose a level the attacker won't have deeper insight to, the estimate should be good.
Sep
15
comment Inverting the encryption equation of a symmetric cipher
Not to dissuade you from asking cryptography questions here, but that course has a discussion forum with participants and TAs who should be familiar with the current state of the course and the recently covered material, which will give them good insight into answering questions like this.
Sep
15
reviewed Approve csprng tag wiki excerpt
Sep
15
reviewed Approve csprng tag wiki
Sep
14
revised AES with different modes of operation
Changed wording regarding DES.
Sep
14
comment AES with different modes of operation
@Reid: I agree. The original wording against DES was a bit strong.
Sep
14
answered AES with different modes of operation
Sep
12
revised Break a simple compression function of a cryptographic hash function
Code formatting changes, removed unnecessary line.
Sep
11
revised Hash function based on block cipher (and proof of security in the PRP model)
Added link to source of quote.
Sep
11
comment Hash function based on block cipher (and proof of security in the PRP model)
Very similar to a previous question of yours. Given that that a PRP (this question) is a PRF (previous question) for large enough blocks, the questions are pretty much the same.
Sep
11
comment Break a simple compression function of a cryptographic hash function
(Let D(key, msg) be the corresponding decryption/reversal.) For a collision, we need E(current_block1, last1) = E(current_block2, last2) for some value of those variables. Choose current_block1, last1, current_block2 at random, then set current_block2 = D(current_block2, E(current_block, last)). That line calculates the final state for side 1 (using E), then decrypts that result using the key we chose for side 2. The decryption yields the necessary starting last state for side 2 to encrypt/permute to the same result as side 1. In practice, just replace E by the for loop.
Sep
11
comment Break a simple compression function of a cryptographic hash function
Let's craft a less trivial collision. We can attack this general scheme, ignoring most of the details of compress. First, this is a Merkle–Damgård construction, so a collision for the compression function breaks the scheme. Note that compress is a permutation (16 rounds of a permutation): If you know the current_block that yielded a new value for last, you can run entire thing backward and get the original last that was updated by current_block. So let's model the for loop as a block cipher E(key, msg), using current_block as the key and last being encrypted/permuted.[...]
Sep
10
comment Break a simple compression function of a cryptographic hash function
So we know that compress(0, 0) = 0. Obviously, this can be iterated for an arbitrary number of blocks. Which of the hash properties can we use this fact to break?
Sep
6
comment Break a simple compression function of a cryptographic hash function
As a trivial break, consider the 0 case. What obvious input hashes to 0? If you wanted to generate collisions for 0, how could you force the internal state to reach a value of 0?
Sep
6
comment Break a simple compression function of a cryptographic hash function
This sounds like a homework assignment. A general hint: Consider how current_block and last are combined - it's simple addition. The next two steps are mixing the state using a reversible operation (assuming << and >> are not cyclical, which they are not in the provided language).
Sep
6
comment Who uses Dual_EC_DRBG?
This is not much, so I'll just leave it as a comment, but a notable founder of a security research/pentesting company recently said that, in his assessment, no one really uses it.
Sep
4
reviewed Edit What is an active S-Box?
Sep
4
revised What is an active S-Box?
Language correction and a bit of logic reformatting.
Sep
4
reviewed Approve What are the advantages of TOTP over HOTP?