Reputation
14,919
Next tag badge:
64/100 score
18/20 answers
Badges
1 20 67
Newest
 Nice Answer
Impact
~321k people reached

May
12
comment Time Capsule cryptography?
@kasperd: An active retransmitter would cut that down to the square of the distance. And, of course, the scaling law only starts to apply at distances where the beam width exceeds the size of the receiver / reflector, so the bigger you can make the reflector, and the better you can collimate the beam, the further you can reach with the same energy.
May
10
comment how does an initialization vector work?
Related question: crypto.stackexchange.com/questions/3965/…
May
9
comment How to create a PEM file for storing an RSA key?
@poncho: Technically, this question is about implementing a standard storage format for cryptographic keys. The mention of OpenSSL is really a red herring. I think it's on topic here, if perhaps marginally. (And there's certainly some overlap with Stack Overflow here; not that there's necessarily anything wrong with that.)
May
9
comment Definition of the term “key”
Note that a key (in the sense of "thing used to open a lock") is also a key (in the sense of "essential to make something work"). Without a matching key, a lock is little more than a useless lump of metal.
May
9
comment Diffie Hellman Exponentiation Implementation Problem
Yeah, it's a dupe, but the original could really use a better answer. Of the three answers so far, one is buggy, one is (mostly) irrelevant and one takes way too long to get to the point.
May
8
comment Discrete logarithm over prime modulo: small input, large exponent, larger prime
Terminology nitpick: HMAC is a specific MAC algorithm (or, rather, a method of constructing a MAC from a cryptographic hash), of which this method is not an instance of. It's not really meaningful to ask whether something is "an HMAC", since only HMAC is an HMAC. You could ask whether this algorithm is a MAC (i.e. whether it satisfies the relevant unforgeability properties), though.
May
7
comment Information-theoretic bound on leakage by timing measurement
For a worst-case scenario, I guess you could just assume that the attacker can leak data at the full Shannon capacity of the channel, even if you don't have an explicit coding scheme approaching that capacity at hand. (Actually calculating the capacity from the noise distribution and the available timing range is beyond what I can do off the top of my head, though, even if I'm confident that, in principle, it should be doable.)
May
5
comment Encrypt file name
If it's OK for the encrypted file names to (always) be longer than the originals, it would probably be easiest and safest to just encode the encrypted names in Base36 or Base32. If you wish to support any filenames that the underlying filesystem allows, things get trickier. (For filesystems like NTFS that are case-preserving but not case-sensitive, it might not even be possible.)
May
5
comment How to calculate if probability is negligible or not
@henry: See this post on meta.math.SE, and the linked posts in the sidebar, for some information about that message. However, I'm actually retracting my close vote, since, on a closer look, your question does contain a key term ("negligible probability") that is used in a somewhat specialized manner in crypto. (I've also posted an answer below that hopefully clarifies the meaning somewhat.)
Apr
30
comment What does ⊕ mean in cryptography?
BTW, questions like this are probably better suited for Cryptography Stack Exchange than for Stack Overflow. I've flagged this one for moderator attention, and asked them to migrate it there.
Apr
30
comment What do $0^n$ and $1^n$ mean in cryptography?
Related (but, despite what I first assumed, probably not really duplicate) question: What does the expression $1^n$ mean as a function argument?
Apr
22
comment Multiple AES/ECB encryptions of different data with same key all end with same pattern
See: crypto.stackexchange.com/questions/20941/…
Apr
18
comment Is MCrypt's 8-bit OFB mode secure?
That's a good point, and I'd be grateful for any references to actual peer-reviewed articles proving (or disproving!) this claim. As far as I can tell myself, the proofs by Wooding do look reasonable at a glance, but I must admit that I didn't go over them in full detail, and they do involve a bunch of subtle details and corner cases one could easily stub one's toe against. Hence why I haven't accepted my own answer yet.
Apr
16
comment AES plaintext is smaller than 128 bits - how to expand?
Also note that key expansion does not actually mean what you seem to think it means.
Apr
15
comment why are both ipad and opad required for HMAC?
We could always replace one of the constants with 0, and the other with ipad ⊕ opad; all this would do is permute the keyspace.
Apr
14
comment RFID Protocol Cryptanalysis
After your edit, it's no longer clear what the actual scheme you're asking about is. You should either revert your question to its original state, or rewrite it to clearly describe the one specific scheme (or family of schemes) that you're interested in analyzing. If you wish to ask about a family of schemes, please try to limit the variation as much as possible, preferably to a small finite number of variants and/or a few adjustable numeric parameters like key length. Do not include parameters like "where $F$ is any function"; nobody can analyze a scheme at that level of generality.
Apr
14
comment RFID Protocol Cryptanalysis
XORing all the keys actually makes is worse: as soon as an attacker intercepts one $(k_i,r_i)$ pair, they can compute $k_{i+1} = k_i \oplus r_i$ and so impersonate the tag as many times as they want. Edit: The same holds also for $k_{i+1} = F(k_i)$, if anybody can compute $F$. If $F$ is secret (say, encryption with a secret key) then the first attack I describe won't apply, but the second may.
Apr
14
comment Are there equivalent IVs in DES/CBC?
If the key and the ciphertext are fixed, then no. If $P_1 = IV_1 \oplus D_K(C)$ and $P_2 = IV_2 \oplus D_K(C)$, then $P_1 \oplus P_2 = IV_1 \oplus D_K(C) \oplus IV_2 \oplus D_K(C) = IV_1 \oplus IV_2$. Thus, $P_1 = P_2$ if and only if $IV_1 = IV_2$.
Apr
14
comment KDFs for symmetric encryption master key & serial number
The length of the "info" parameter does not matter; it just needs to be unique for each derived key. Or, to put it the other way around, if you feed the same PRK and info parameters to HKDF-Expand, you get the same key out. As for using separate keys for encryption and authentication, many authenticated encryption schemes (including, notably, those based on generic composition of a cipher and a MAC) require it, for their security proofs to be valid.
Apr
9
comment Randomness in generation of Virtual Machines from pre-built Image
I suspect this is more of a question for Super User, or maybe Stack Overflow. But yes, in a sensible VM implementation, the guest OS ought to have some way to obtain entropy from the host (or at least have a seed file provided at start-up).