Reputation
14,125
Next tag badge:
109/100 score
19/20 answers
Badges
1 14 61
Newest
 Curious
Impact
~288k people reached

1d
awarded  Curious
2d
comment Is MCrypt's 8-bit OFB mode secure?
That's a good point, and I'd be grateful for any references to actual peer-reviewed articles proving (or disproving!) this claim. As far as I can tell myself, the proofs by Wooding do look reasonable at a glance, but I must admit that I didn't go over them in full detail, and they do involve a bunch of subtle details and corner cases one could easily stub one's toe against. Hence why I haven't accepted my own answer yet.
2d
asked Is MCrypt's 8-bit OFB mode secure?
2d
answered Is MCrypt's 8-bit OFB mode secure?
Apr
16
comment AES plaintext is smaller than 128 bits - how to expand?
Also note that key expansion does not actually mean what you seem to think it means.
Apr
15
reviewed Reviewed Difference between IPSEC SA and CHILD SA
Apr
15
reviewed Reviewed Website Certificate with different public key
Apr
15
reviewed Close can you attack to this protocol?
Apr
15
comment can you attack to this protocol?
What are $P_A$, $P_B$, $r_1$ and $r_2$?
Apr
15
comment why are both ipad and opad required for HMAC?
We could always replace one of the constants with 0, and the other with ipad ⊕ opad; all this would do is permute the keyspace.
Apr
14
comment RFID Protocol Cryptanalysis
After your edit, it's no longer clear what the actual scheme you're asking about is. You should either revert your question to its original state, or rewrite it to clearly describe the one specific scheme (or family of schemes) that you're interested in analyzing. If you wish to ask about a family of schemes, please try to limit the variation as much as possible, preferably to a small finite number of variants and/or a few adjustable numeric parameters like key length. Do not include parameters like "where $F$ is any function"; nobody can analyze a scheme at that level of generality.
Apr
14
comment RFID Protocol Cryptanalysis
XORing all the keys actually makes is worse: as soon as an attacker intercepts one $(k_i,r_i)$ pair, they can compute $k_{i+1} = k_i \oplus r_i$ and so impersonate the tag as many times as they want. Edit: The same holds also for $k_{i+1} = F(k_i)$, if anybody can compute $F$. If $F$ is secret (say, encryption with a secret key) then the first attack I describe won't apply, but the second may.
Apr
14
comment Are there equivalent IVs in DES/CBC?
If the key and the ciphertext are fixed, then no. If $P_1 = IV_1 \oplus D_K(C)$ and $P_2 = IV_2 \oplus D_K(C)$, then $P_1 \oplus P_2 = IV_1 \oplus D_K(C) \oplus IV_2 \oplus D_K(C) = IV_1 \oplus IV_2$. Thus, $P_1 = P_2$ if and only if $IV_1 = IV_2$.
Apr
14
reviewed No Action Needed Are there equivalent IVs in DES/CBC?
Apr
14
revised Are there equivalent IVs in DES/CBC?
added 899 characters in body
Apr
14
answered Are there equivalent IVs in DES/CBC?
Apr
14
answered RFID Protocol Cryptanalysis
Apr
14
comment Question about feistel network
Alas, I find the question really vague, too. :( Also, I'm pretty sure you've made some typos while typing the formulas here. (Tip: You might find our help pages on Markdown and MathJax syntax useful for clearly formatting your question.)
Apr
14
reviewed Close Question about feistel network
Apr
14
comment KDFs for symmetric encryption master key & serial number
The length of the "info" parameter does not matter; it just needs to be unique for each derived key. Or, to put it the other way around, if you feed the same PRK and info parameters to HKDF-Expand, you get the same key out. As for using separate keys for encryption and authentication, many authenticated encryption schemes (including, notably, those based on generic composition of a cipher and a MAC) require it, for their security proofs to be valid.