Reputation
15,339
Next tag badge:
67/100 score
19/20 answers
Badges
1 23 67
Newest
 Yearling
Impact
~343k people reached

May
19
comment Do hand-based hash functions / MACs exist?
Similar, maybe duplicate question: crypto.stackexchange.com/questions/765/… (although it doesn't mention MACs).
May
19
comment Why cant Public Key Encryption be perfectly secure?
@RickyDemer: Right, that's more or less what I had in mind. Sorry for the fuzzy language. (Also, if the message length is bounded, you can just check all possible messages. You might still want to weigh the messages by plausibility, though, if reasonable messages only make up a small fraction of the full message space.)
May
19
comment Why cant Public Key Encryption be perfectly secure?
@RickyDemer: Iterate over possible private keys, check whether the private key can correctly decrypt most messages encrypted with the known public key. (We can reasonably assume that nobody would use a private key that doesn't work most of the time, at least unless there's an additional error checking and redundancy layer involved, in which case it really should be considered part of the cryptosystem.)
May
19
comment Is One Time Pad considered Chosen-Plaintext Attack Secure?
... We should be able fix the first issue by making the keyspace $\{0,1\}^*$ and restricting the total length of messages that can be encrypted with each key to a polynomial function of $n$. This seems reasonable enough, since the adversary can only make a polynomial number of queries anyway. But the statefulness issue remains, although I guess we could just make the keys long enough compared to the maximum total message length to make the probability of overlap negligible. Lots of handwaving here, I admit, but it seems like it should work.
May
19
comment Is One Time Pad considered Chosen-Plaintext Attack Secure?
I guess we could define the "keyspace" for a one-time pad as $\{0,1\}^{\Bbb N}$, regardless of the security parameter $n$, and prefix each ciphertext with a starting offset in the key sequence that is guaranteed not to overlap any previously used key segment. That should be enough to (almost) make the one-time pad an IND-CPA secure encryption system, if I'm not mistaken. The only problems being that 1) $\rm Gen$ will not actually be an algorithm in the strict sense, and will surely not be polynomial-time, and 2) $\rm Enc$ would have to be stateful to guarantee the non-overlap property.
May
19
comment Can you make a hash out of a stream cipher?
I don't really see how this adds anything to B-Con's second answer. In particular, as noted in the comments to that answer, it's not quite obvious how to obtain a block cipher that actually satisfies the (rather strict) security properties needed to prove the security of the resulting hash function.
May
19
comment Why cant Public Key Encryption be perfectly secure?
@RickyDemer: I don't really see any way to have sender-deniable public key encryption against a computationally unbounded adversary; in particular, the adversary can always recover the private key by enumerating the keyspace, and then decrypt the message. With overwhelming probability, the plaintext they get is what was originally encrypted, or at least what the intended recipient would have received.
May
19
comment How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?
The answer is basically the PRF/PRP switching lemma, which essentially says that a pseudorandom permutation is indistinguishable from a pseudorandom function unless we observe a collision for one of them. See also this question on cstheory.SE.
May
19
comment What should I think about these unique certificate serial numbers
What is your specific question? "What should I think about X?" is not really something we can answer here. See our help center for more information about asking good questions.
May
19
comment Is the hash function defined in this exercise collision-resistant?
This is true (and should certainly be counted as a correct answer), but it's probably not the answer the author of the exercise was looking for. (If it was, why bother with all the extra details about the internals of the hashing algorithm?)
May
19
comment Is the hash function defined in this exercise collision-resistant?
Generally, the point of homework exercises is to give you some practice in applying the methods you've learned, and to help you notice any gaps in your skillset. Thus, to get the full benefit from the exercises, you should first try to solve them as far as you can on your own, and only then turn to others for help. In particular, when asking for help with homework on Stack Exchange, it helps a lot if you mention how far you've got on your own (even if it's "I tried X and Y and Z, but none of them work because..."), and where specifically (you think) you're stuck.
May
13
comment Time Capsule cryptography?
@kasperd: Sure, but it's a one-time setup cost. You launch the reflector / retransmitter well in advance, so that you can use it later when it's far enough. I never said this was a practical solution right now (if ever). Although, if you only need a delay of a few seconds, there's a convenient reflector already on the Moon. And we do technically have an active retransmitter at about 17 light hours away, even if contacting it discreetly may be tricky. ;-)
May
12
comment Time Capsule cryptography?
@kasperd: An active retransmitter would cut that down to the square of the distance. And, of course, the scaling law only starts to apply at distances where the beam width exceeds the size of the receiver / reflector, so the bigger you can make the reflector, and the better you can collimate the beam, the further you can reach with the same energy.
May
10
comment how does an initialization vector work?
Related question: crypto.stackexchange.com/questions/3965/…
May
9
comment How to create a PEM file for storing an RSA key?
@poncho: Technically, this question is about implementing a standard storage format for cryptographic keys. The mention of OpenSSL is really a red herring. I think it's on topic here, if perhaps marginally. (And there's certainly some overlap with Stack Overflow here; not that there's necessarily anything wrong with that.)
May
9
comment Definition of the term “key”
Note that a key (in the sense of "thing used to open a lock") is also a key (in the sense of "essential to make something work"). Without a matching key, a lock is little more than a useless lump of metal.
May
9
comment Diffie Hellman Exponentiation Implementation Problem
Yeah, it's a dupe, but the original could really use a better answer. Of the three answers so far, one is buggy, one is (mostly) irrelevant and one takes way too long to get to the point.
May
8
comment Discrete logarithm over prime modulo: small input, large exponent, larger prime
Terminology nitpick: HMAC is a specific MAC algorithm (or, rather, a method of constructing a MAC from a cryptographic hash), of which this method is not an instance of. It's not really meaningful to ask whether something is "an HMAC", since only HMAC is an HMAC. You could ask whether this algorithm is a MAC (i.e. whether it satisfies the relevant unforgeability properties), though.
May
7
comment Information-theoretic bound on leakage by timing measurement
For a worst-case scenario, I guess you could just assume that the attacker can leak data at the full Shannon capacity of the channel, even if you don't have an explicit coding scheme approaching that capacity at hand. (Actually calculating the capacity from the noise distribution and the available timing range is beyond what I can do off the top of my head, though, even if I'm confident that, in principle, it should be doable.)
May
5
comment Encrypt file name
If it's OK for the encrypted file names to (always) be longer than the originals, it would probably be easiest and safest to just encode the encrypted names in Base36 or Base32. If you wish to support any filenames that the underlying filesystem allows, things get trickier. (For filesystems like NTFS that are case-preserving but not case-sensitive, it might not even be possible.)