Reputation
14,909
Next tag badge:
64/100 score
18/20 answers
Badges
1 20 67
Newest
 Nice Answer
Impact
~320k people reached

2d
comment Establishing encryption key using shared secret
You might not actually need a hash for authentication either, if you e.g. replace HMAC with CMAC. If you're using public key signatures, though, those probably do require a hash (among other machinery).
Jun
28
comment Establishing encryption key using shared secret
The main advantage of using AES for key derivation is that you're using it for encryption anyway, so it doesn't cost you any extra code to include it. Of course, if you need a hash for something else too, then it indeed becomes just a matter of speed and convenience. That said, AES is likely to win the speed contest too.
Jun
25
comment what is possibility of collision in djb2 function?
In particular, it's trivial to construct collisions, or even preimages, for this hash function. As for your second question, see stackoverflow.com/questions/6798111/… (summary: change return hash to return hash >>> 0). Also, just as a tip, hash * 33 is almost certainly equivalent to or faster than (hash << 5) + hash, both in JS and (using any decent optimizing compiler) in C.
Jun
24
comment Why does an algorithm need a keyspace?
@user1688175: $\in$
Jun
23
comment what are the most common stream ciphers algorithms?
If it's not a block cipher in CTR or OFB mode, it's most likely RC4. There are a lot of other interesting stream cipher designs out there, but most of them are rarely seen outside specific niche applications (e.g. tiny embedded ASICs). RC4 is what you'll find in most crypto libraries.
Jun
22
comment Crypto++ - how to use it in Code Blocks
(However, before re-asking this question at SO, I'd suggest making it a bit more specific. Take a look at their help pages for some tips.)
Jun
22
comment Crypto++ - how to use it in Code Blocks
I'm voting to close this question as off-topic because it is about using a specific crypto library (e.g. Crypto++, OpenSSL etc), rather than about the cryptographic techniques it implements. You may be able to get answers at Stack Overflow.
Jun
22
comment Frequency tables for HTML page source
HTML has lots of repetitive strings (e.g. tag names), so you may want to try looking at $n$-gram frequencies for $n\ge2$, or just crib dragging.
May
22
comment HKDF entropy extraction
@StephenTouset: I don't agree. System RNGs have been known to suffer from serious implementation errors (like the Android RNG bug) in the past, not to mention being potentially tempting targets for subversion attacks, and their correct operation is difficult if not impossible for a caller to verify. The safe approach, where possible, is to maintain your own entropy pool, and to treat the system RNG as just another potentially unreliable entropy source for it.
May
22
comment Attacking CBC with predictable but encrypted IV
Based on the known plaintext/ciphertext pair they have, the attacker already knows that $E_K(C_{i-1} \oplus P_i) = C_i$. Thus, they can choose the IV (as long as it's one of the ciphertext blocks they know the plaintext for) by choosing the appropriate nonce.
May
21
comment Elliptic Curve Cryptography Encryption and text representation implementation
This does not appear to answer the question in any meaningful sense.
May
19
comment Do hand-based hash functions / MACs exist?
Similar, maybe duplicate question: crypto.stackexchange.com/questions/765/… (although it doesn't mention MACs).
May
19
comment Why cant Public Key Encryption be perfectly secure?
@RickyDemer: Right, that's more or less what I had in mind. Sorry for the fuzzy language. (Also, if the message length is bounded, you can just check all possible messages. You might still want to weigh the messages by plausibility, though, if reasonable messages only make up a small fraction of the full message space.)
May
19
comment Why cant Public Key Encryption be perfectly secure?
@RickyDemer: Iterate over possible private keys, check whether the private key can correctly decrypt most messages encrypted with the known public key. (We can reasonably assume that nobody would use a private key that doesn't work most of the time, at least unless there's an additional error checking and redundancy layer involved, in which case it really should be considered part of the cryptosystem.)
May
19
comment Is One Time Pad considered Chosen-Plaintext Attack Secure?
... We should be able fix the first issue by making the keyspace $\{0,1\}^*$ and restricting the total length of messages that can be encrypted with each key to a polynomial function of $n$. This seems reasonable enough, since the adversary can only make a polynomial number of queries anyway. But the statefulness issue remains, although I guess we could just make the keys long enough compared to the maximum total message length to make the probability of overlap negligible. Lots of handwaving here, I admit, but it seems like it should work.
May
19
comment Is One Time Pad considered Chosen-Plaintext Attack Secure?
I guess we could define the "keyspace" for a one-time pad as $\{0,1\}^{\Bbb N}$, regardless of the security parameter $n$, and prefix each ciphertext with a starting offset in the key sequence that is guaranteed not to overlap any previously used key segment. That should be enough to (almost) make the one-time pad an IND-CPA secure encryption system, if I'm not mistaken. The only problems being that 1) $\rm Gen$ will not actually be an algorithm in the strict sense, and will surely not be polynomial-time, and 2) $\rm Enc$ would have to be stateful to guarantee the non-overlap property.
May
19
comment Can you make a hash out of a stream cipher?
I don't really see how this adds anything to B-Con's second answer. In particular, as noted in the comments to that answer, it's not quite obvious how to obtain a block cipher that actually satisfies the (rather strict) security properties needed to prove the security of the resulting hash function.
May
19
comment Why cant Public Key Encryption be perfectly secure?
@RickyDemer: I don't really see any way to have sender-deniable public key encryption against a computationally unbounded adversary; in particular, the adversary can always recover the private key by enumerating the keyspace, and then decrypt the message. With overwhelming probability, the plaintext they get is what was originally encrypted, or at least what the intended recipient would have received.
May
19
comment How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?
The answer is basically the PRF/PRP switching lemma, which essentially says that a pseudorandom permutation is indistinguishable from a pseudorandom function unless we observe a collision for one of them. See also this question on cstheory.SE.
May
19
comment What should I think about these unique certificate serial numbers
What is your specific question? "What should I think about X?" is not really something we can answer here. See our help center for more information about asking good questions.